AutoTimeliner is a forensic utility that automatically extracts chronological evidence from volatile memory dumps.
The software uses Volatility 3 plugins to identify events and artefacts within memory images, combining their results into a single timeline. It supports analysis of memory acquired from Windows, Linux and macOS systems.
AutoTimeliner can extract information about processes, files, command histories and other activities, depending on the operating system and available evidence.
For Windows investigations, it can examine Master File Table records, ShellBags, network connections, process execution and other artefacts. Linux and macOS analysis includes process information, shell history and open file evidence.
Results are merged into a chronologically sorted CSV file, helping investigators reconstruct system activity and identify events of interest.
The software supports filtering by date range, automatic operating system identification and options for selecting individual analysis plugins. It replaces much of the manual work involved in running and combining separate Volatility commands.
This is free and open source software.
Key Features
- Automatically generates forensic timelines from volatile memory images.
- Uses Volatility 3 plugins to extract and correlate memory artefacts.
- Supports memory images from Windows, Linux and macOS systems.
- Examines process activity, file information and other timestamped evidence.
- Provides Windows-specific analysis of MFT records, ShellBags, network activity and process execution.
- Supports Linux and macOS process, shell history and open file analysis.
- Automatically identifies the operating system associated with supported memory images.
- Allows investigators to select plugins and filter results by date range.
- Combines results into a chronologically sorted CSV timeline.
- Provides optional plugins for additional forensic and malware-related analysis.
Website: github.com/andreafortuna/autotimeliner
Support:
Developer: Andrea Fortuna
License: MIT License
AutoTimeliner is written in Python. Learn Python with our recommended free books and free tutorials.
Related Software
| Forensics Memory Tools | |
|---|---|
| MemProcFS | View physical memory as files in a virtual file system |
| pypykatz | Python implementation of Mimikatz |
| PCILeech | Security research and memory acquisition tool |
| Volatility | Advanced memory forensics framework |
| AVML | Acquire Volatile Memory for Linux |
| Volshell | CLI tool for working with memory |
| LeechCore | Physical memory acquisition library |
| EVTXtract | Recovers and reconstructs fragments of EVTX log files |
| mquire | Memory forensics and analysis tool |
| LEMON | Memory acquisition utility |
| yarp | Yet Another Registry Parser |
| emd | Command line memory acquisition tool for Linux systems |
| AutoTimeliner | Extract forensic timeline from volatile memory dump |
Read our verdict in the software roundup.
 LinuxLinks helps you discover the best free and open source software for Linux. Explore our extensive collection of recommended applications, including alternatives to popular proprietary software.We also publish software reviews, Linux tutorials, hardware reviews, free programming books and articles covering the wider open source community. Browse our Linux resources to discover more. Know a useful free and open source Linux application we haven't covered? Suggest a program for inclusion. Has your software been featured on LinuxLinks? Display one of our Featured on LinuxLinks badges on your website or GitHub README. |
Please read our Comment Policy before commenting.