4n6time, formerly "l2t_Review", is a free, cross-platform forensic tool for
timeline creation and review. Since 4n6time is powered by the amazing plaso
engine, formerly log2timeline, users can now create, with a mouse, a raw timeline
storage file from a disk image. Once a timeline has been created, it can be
outputted to a 4n6time
database (sqlite). Using 4n6time, you can then start review with the
ability to filter, highlight, sort, tag, bookmark, and search on common data
fields. Also included are basic reporting features as well as the ability to
export subsets of data back into the CSV and timeline storage files. Please note this documentation is a work in progress. Check back for updates or email with questions.
Get started - Download Instructions.
Here are some highlights of 4n6time:
Users Guide >