A log file parser that produces a body file used to create timelines (for forensic investigations).

Edit Package log2timeline

log2timeline takes a log file (or a directory) and parses it to produce a body file that can be imported into other tools for timeline analysis. The tool has both a modular based approach to the input file as well as the output file. The current version supports exporting the timeline in a several different body formats. log2timeline is build as a series of scripts, this one being the front-end, which uses other scripts to actually parse the log files (called format files). The tool is build to be easily extended for anyone that wants to create a new format or an output file.

As noted above the default output mechanism is in a CSV file format, which can be easily imported into spreadsheet applications, and parsed by the tool l2t_process. The output format can be easily changed with the -o parameter. The output module can be set to output in a body format that needs to be imported into another tool for human readable format, or it can be implemented to print the timeline directly in a human readable format.

The tool is build using multiple so called input modules. Each of those input modules provide a single format that can be parsed, whether that is a log file or a directory containing some files that need to be parsed.

The purpose of the tool is to provide a single tool to parse various artifacts that are either produced by the suspsect operating system or other systems that might have some logs retaining to the investigation.

  • Sources inherited from project openSUSE:13.1
  • Download package
  • osc -A https://api.opensuse.org checkout openSUSE:13.1:Update/log2timeline && cd $_
  • Create Badge
Source Files
Filename Size Changed
log2timeline.changes 0000023113 22.6 KB over 10 years
log2timeline.spec 0000004830 4.72 KB over 10 years
log2timeline_0.65.tgz 0000579325 566 KB over 10 years
Comments 0
openSUSE Build Service is sponsored by