SlideShare a Scribd company logo

(121215) #fitalk optimize making the timeline

•
•
INSIGHT FORENSIC
INSIGHT FORENSIC

2012 F-INSIGHT TALK

Technology
1 of 18
Download to read offline
Optimize Making The Timeline and yet it does move malware.co.kr - dorumugs - 12년 12월 15일 토요일
Log2Timeline • The tool is written in Perl for Linux • A framework for automatic creation of a super timeline. • The main purpose is to provide a single tool to parse various log files and artifacts found on suspect systems. • A timeline that can be analysed by forensic 12년 12월 15일 토요일
Log2Timeline for Windows 12년 12월 15일 토요일
Heavy • When Examiner analyzes the images, VMware is heavy. • http://katerawlings.com/2010/08/19/looking-for-heavy-metcons/ 12년 12월 15일 토요일
WindowsVer • But It is not working. because we use unicode(korean). • http://log2timeline.net/INSTALL.txt 12년 12월 15일 토요일
Fix Log2Timeline +_+ • http://fixthispcnow.webs.com/virusremovalservice.htm 12년 12월 15일 토요일
Test! ^__^ • perl log2timeline.pl -r -p -z Asia/Seoul -w bodyfile c:timelineImage_name 12년 12월 15일 토요일
Sort T_T 12년 12월 15일 토요일
l2t_process • l2t_Process is boring. because it takes a lot of times. • http://static4.businessinsider.com/image/4fbfb86becad044879000001-400-300/sleepy-tired-boring.jpg 12년 12월 15일 토요일
Column(0) + Column(1) 12년 12월 15일 토요일
Sort +_+ • Python log2_sort.py -i timeline.txt -o timelin.csv -n 1000000 12년 12월 15일 토요일
Speed? 12년 12월 15일 토요일
For More Speed • Gather just necessary files • No change time information • No change folder information OS Artifacts Prefetch MFT Link RegistryEvent Log SysLog ETC 12년 12월 15일 토요일
HOW? • EnScript is a perfect tool to gather OS artifacts. 12년 12월 15일 토요일
and then • Run EnScript. • Log2Timeline Windows ver • Sort Bodyfile 12년 12월 15일 토요일
Enjoy Timeline 12년 12월 15일 토요일
But.... • If your timeline is crash, change the encoding from something to unicode. 12년 12월 15일 토요일
Thank you 12년 12월 15일 토요일

Recommended

Project Panorama: vistas on validated information
Project Panorama: vistas on validated informationProject Panorama: vistas on validated information
Project Panorama: vistas on validated information
Eric Sieverts
 
Metadata, standaarden, interoperabiliteit, semantisch web en linked data
Metadata, standaarden, interoperabiliteit, semantisch web en linked dataMetadata, standaarden, interoperabiliteit, semantisch web en linked data
Metadata, standaarden, interoperabiliteit, semantisch web en linked data
Eric Sieverts
 
(120513) #fitalk windows 8 forensics
(120513) #fitalk windows 8 forensics(120513) #fitalk windows 8 forensics
(120513) #fitalk windows 8 forensics
INSIGHT FORENSIC
 
(Fios#03) 5. 죽은 서비스도 살려내는 포렌식 기술
(Fios#03) 5. 죽은 서비스도 살려내는 포렌식 기술(Fios#03) 5. 죽은 서비스도 살려내는 포렌식 기술
(Fios#03) 5. 죽은 서비스도 살려내는 포렌식 기술
INSIGHT FORENSIC
 
(121027) #fitalk big brother forensics, device tracking using browser-based...
(121027) #fitalk big brother forensics, device tracking using browser-based...(121027) #fitalk big brother forensics, device tracking using browser-based...
(121027) #fitalk big brother forensics, device tracking using browser-based...
INSIGHT FORENSIC
 
A pair of shoes in the thesaurus; some reflexions on human and computer indexing
A pair of shoes in the thesaurus; some reflexions on human and computer indexingA pair of shoes in the thesaurus; some reflexions on human and computer indexing
A pair of shoes in the thesaurus; some reflexions on human and computer indexing
Eric Sieverts
 
(130928) #fitalk cloud storage forensics - dropbox
(130928) #fitalk cloud storage forensics - dropbox(130928) #fitalk cloud storage forensics - dropbox
(130928) #fitalk cloud storage forensics - dropbox
INSIGHT FORENSIC
 
(160820) #fitalk fileless malware forensics
(160820) #fitalk fileless malware forensics(160820) #fitalk fileless malware forensics
(160820) #fitalk fileless malware forensics
INSIGHT FORENSIC
 

Recommended

Project Panorama: vistas on validated information
Project Panorama: vistas on validated informationProject Panorama: vistas on validated information
Project Panorama: vistas on validated information
Eric Sieverts
 
Metadata, standaarden, interoperabiliteit, semantisch web en linked data
Metadata, standaarden, interoperabiliteit, semantisch web en linked dataMetadata, standaarden, interoperabiliteit, semantisch web en linked data
Metadata, standaarden, interoperabiliteit, semantisch web en linked data
Eric Sieverts
 
(120513) #fitalk windows 8 forensics
(120513) #fitalk windows 8 forensics(120513) #fitalk windows 8 forensics
(120513) #fitalk windows 8 forensics
INSIGHT FORENSIC
 
(Fios#03) 5. 죽은 서비스도 살려내는 포렌식 기술
(Fios#03) 5. 죽은 서비스도 살려내는 포렌식 기술(Fios#03) 5. 죽은 서비스도 살려내는 포렌식 기술
(Fios#03) 5. 죽은 서비스도 살려내는 포렌식 기술
INSIGHT FORENSIC
 
(121027) #fitalk big brother forensics, device tracking using browser-based...
(121027) #fitalk big brother forensics, device tracking using browser-based...(121027) #fitalk big brother forensics, device tracking using browser-based...
(121027) #fitalk big brother forensics, device tracking using browser-based...
INSIGHT FORENSIC
 
A pair of shoes in the thesaurus; some reflexions on human and computer indexing
A pair of shoes in the thesaurus; some reflexions on human and computer indexingA pair of shoes in the thesaurus; some reflexions on human and computer indexing
A pair of shoes in the thesaurus; some reflexions on human and computer indexing
Eric Sieverts
 
(130928) #fitalk cloud storage forensics - dropbox
(130928) #fitalk cloud storage forensics - dropbox(130928) #fitalk cloud storage forensics - dropbox
(130928) #fitalk cloud storage forensics - dropbox
INSIGHT FORENSIC
 
(160820) #fitalk fileless malware forensics
(160820) #fitalk fileless malware forensics(160820) #fitalk fileless malware forensics
(160820) #fitalk fileless malware forensics
INSIGHT FORENSIC
 
(150124) #fitalk advanced $usn jrnl forensics (korean)
(150124) #fitalk advanced $usn jrnl forensics (korean)(150124) #fitalk advanced $usn jrnl forensics (korean)
(150124) #fitalk advanced $usn jrnl forensics (korean)
INSIGHT FORENSIC
 
(150124) #fitalk advanced $usn jrnl forensics (english)
(150124) #fitalk advanced $usn jrnl forensics (english)(150124) #fitalk advanced $usn jrnl forensics (english)
(150124) #fitalk advanced $usn jrnl forensics (english)
INSIGHT FORENSIC
 
(140118) #fitalk detection of anti-forensics artifacts using ioa fs
(140118) #fitalk detection of anti-forensics artifacts using ioa fs(140118) #fitalk detection of anti-forensics artifacts using ioa fs
(140118) #fitalk detection of anti-forensics artifacts using ioa fs
INSIGHT FORENSIC
 
(140118) #fitalk 2013 e-discovery trend
(140118) #fitalk 2013 e-discovery trend(140118) #fitalk 2013 e-discovery trend
(140118) #fitalk 2013 e-discovery trend
INSIGHT FORENSIC
 
(141031) #fitalk plaso 슈퍼 타임라인 분석 도구 활용 방안
(141031) #fitalk plaso 슈퍼 타임라인 분석 도구 활용 방안(141031) #fitalk plaso 슈퍼 타임라인 분석 도구 활용 방안
(141031) #fitalk plaso 슈퍼 타임라인 분석 도구 활용 방안
INSIGHT FORENSIC
 
(141031) #fitalk os x yosemite artifacts
(141031) #fitalk os x yosemite artifacts(141031) #fitalk os x yosemite artifacts
(141031) #fitalk os x yosemite artifacts
INSIGHT FORENSIC
 
(140716) #fitalk 전자금융사고에서의 디지털 포렌식
(140716) #fitalk 전자금융사고에서의 디지털 포렌식(140716) #fitalk 전자금융사고에서의 디지털 포렌식
(140716) #fitalk 전자금융사고에서의 디지털 포렌식
INSIGHT FORENSIC
 
(140716) #fitalk digital evidence from android-based smartwatch
(140716) #fitalk digital evidence from android-based smartwatch(140716) #fitalk digital evidence from android-based smartwatch
(140716) #fitalk digital evidence from android-based smartwatch
INSIGHT FORENSIC
 
(140625) #fitalk sq lite 소개와 구조 분석
(140625) #fitalk sq lite 소개와 구조 분석(140625) #fitalk sq lite 소개와 구조 분석
(140625) #fitalk sq lite 소개와 구조 분석
INSIGHT FORENSIC
 
(140407) #fitalk d trace를 이용한 악성코드 동적 분석
(140407) #fitalk d trace를 이용한 악성코드 동적 분석(140407) #fitalk d trace를 이용한 악성코드 동적 분석
(140407) #fitalk d trace를 이용한 악성코드 동적 분석
INSIGHT FORENSIC
 
(140625) #fitalk sq lite 삭제된 레코드 복구 기법
(140625) #fitalk sq lite 삭제된 레코드 복구 기법(140625) #fitalk sq lite 삭제된 레코드 복구 기법
(140625) #fitalk sq lite 삭제된 레코드 복구 기법
INSIGHT FORENSIC
 
(130216) #fitalk reverse connection tool analysis
(130216) #fitalk reverse connection tool analysis(130216) #fitalk reverse connection tool analysis
(130216) #fitalk reverse connection tool analysis
INSIGHT FORENSIC
 
(130216) #fitalk potentially malicious ur ls
(130216) #fitalk potentially malicious ur ls(130216) #fitalk potentially malicious ur ls
(130216) #fitalk potentially malicious ur ls
INSIGHT FORENSIC
 
(130202) #fitalk trends in d forensics (jan, 2013)
(130202) #fitalk trends in d forensics (jan, 2013)(130202) #fitalk trends in d forensics (jan, 2013)
(130202) #fitalk trends in d forensics (jan, 2013)
INSIGHT FORENSIC
 
(130202) #fitalk china threat
(130202) #fitalk china threat(130202) #fitalk china threat
(130202) #fitalk china threat
INSIGHT FORENSIC
 
(130119) #fitalk sql server forensics
(130119) #fitalk sql server forensics(130119) #fitalk sql server forensics
(130119) #fitalk sql server forensics
INSIGHT FORENSIC
 
(130119) #fitalk apt, cyber espionage threat
(130119) #fitalk apt, cyber espionage threat(130119) #fitalk apt, cyber espionage threat
(130119) #fitalk apt, cyber espionage threat
INSIGHT FORENSIC
 
(130119) #fitalk all about physical data recovery
(130119) #fitalk all about physical data recovery(130119) #fitalk all about physical data recovery
(130119) #fitalk all about physical data recovery
INSIGHT FORENSIC
 
(130105) #fitalk trends in d forensics (dec, 2012)
(130105) #fitalk trends in d forensics (dec, 2012)(130105) #fitalk trends in d forensics (dec, 2012)
(130105) #fitalk trends in d forensics (dec, 2012)
INSIGHT FORENSIC
 
(130105) #fitalk criminal civil judicial procedure in korea
(130105) #fitalk criminal civil judicial procedure in korea(130105) #fitalk criminal civil judicial procedure in korea
(130105) #fitalk criminal civil judicial procedure in korea
INSIGHT FORENSIC
 

More Related Content

More from INSIGHT FORENSIC

(140118) #fitalk detection of anti-forensics artifacts using ioa fs
(140118) #fitalk detection of anti-forensics artifacts using ioa fs(140118) #fitalk detection of anti-forensics artifacts using ioa fs
(140118) #fitalk detection of anti-forensics artifacts using ioa fs
INSIGHT FORENSIC
 
(141031) #fitalk plaso 슈퍼 타임라인 분석 도구 활용 방안
(141031) #fitalk plaso 슈퍼 타임라인 분석 도구 활용 방안(141031) #fitalk plaso 슈퍼 타임라인 분석 도구 활용 방안
(141031) #fitalk plaso 슈퍼 타임라인 분석 도구 활용 방안
INSIGHT FORENSIC
 

More from INSIGHT FORENSIC (20)

(150124) #fitalk advanced $usn jrnl forensics (korean)
(150124) #fitalk advanced $usn jrnl forensics (korean)(150124) #fitalk advanced $usn jrnl forensics (korean)
(150124) #fitalk advanced $usn jrnl forensics (korean)
 
(150124) #fitalk advanced $usn jrnl forensics (english)
(150124) #fitalk advanced $usn jrnl forensics (english)(150124) #fitalk advanced $usn jrnl forensics (english)
(150124) #fitalk advanced $usn jrnl forensics (english)
 
(140118) #fitalk detection of anti-forensics artifacts using ioa fs
(140118) #fitalk detection of anti-forensics artifacts using ioa fs(140118) #fitalk detection of anti-forensics artifacts using ioa fs
(140118) #fitalk detection of anti-forensics artifacts using ioa fs
 
(140118) #fitalk 2013 e-discovery trend
(140118) #fitalk 2013 e-discovery trend(140118) #fitalk 2013 e-discovery trend
(140118) #fitalk 2013 e-discovery trend
 
(141031) #fitalk plaso 슈퍼 타임라인 분석 도구 활용 방안
(141031) #fitalk plaso 슈퍼 타임라인 분석 도구 활용 방안(141031) #fitalk plaso 슈퍼 타임라인 분석 도구 활용 방안
(141031) #fitalk plaso 슈퍼 타임라인 분석 도구 활용 방안
 
(141031) #fitalk os x yosemite artifacts
(141031) #fitalk os x yosemite artifacts(141031) #fitalk os x yosemite artifacts
(141031) #fitalk os x yosemite artifacts
 
(140716) #fitalk 전자금융사고에서의 디지털 포렌식
(140716) #fitalk 전자금융사고에서의 디지털 포렌식(140716) #fitalk 전자금융사고에서의 디지털 포렌식
(140716) #fitalk 전자금융사고에서의 디지털 포렌식
 
(140716) #fitalk digital evidence from android-based smartwatch
(140716) #fitalk digital evidence from android-based smartwatch(140716) #fitalk digital evidence from android-based smartwatch
(140716) #fitalk digital evidence from android-based smartwatch
 
(140625) #fitalk sq lite 소개와 구조 분석
(140625) #fitalk sq lite 소개와 구조 분석(140625) #fitalk sq lite 소개와 구조 분석
(140625) #fitalk sq lite 소개와 구조 분석
 
(140407) #fitalk d trace를 이용한 악성코드 동적 분석
(140407) #fitalk d trace를 이용한 악성코드 동적 분석(140407) #fitalk d trace를 이용한 악성코드 동적 분석
(140407) #fitalk d trace를 이용한 악성코드 동적 분석
 
(140625) #fitalk sq lite 삭제된 레코드 복구 기법
(140625) #fitalk sq lite 삭제된 레코드 복구 기법(140625) #fitalk sq lite 삭제된 레코드 복구 기법
(140625) #fitalk sq lite 삭제된 레코드 복구 기법
 
(130216) #fitalk reverse connection tool analysis
(130216) #fitalk reverse connection tool analysis(130216) #fitalk reverse connection tool analysis
(130216) #fitalk reverse connection tool analysis
 
(130216) #fitalk potentially malicious ur ls
(130216) #fitalk potentially malicious ur ls(130216) #fitalk potentially malicious ur ls
(130216) #fitalk potentially malicious ur ls
 
(130202) #fitalk trends in d forensics (jan, 2013)
(130202) #fitalk trends in d forensics (jan, 2013)(130202) #fitalk trends in d forensics (jan, 2013)
(130202) #fitalk trends in d forensics (jan, 2013)
 
(130202) #fitalk china threat
(130202) #fitalk china threat(130202) #fitalk china threat
(130202) #fitalk china threat
 
(130119) #fitalk sql server forensics
(130119) #fitalk sql server forensics(130119) #fitalk sql server forensics
(130119) #fitalk sql server forensics
 
(130119) #fitalk apt, cyber espionage threat
(130119) #fitalk apt, cyber espionage threat(130119) #fitalk apt, cyber espionage threat
(130119) #fitalk apt, cyber espionage threat
 
(130119) #fitalk all about physical data recovery
(130119) #fitalk all about physical data recovery(130119) #fitalk all about physical data recovery
(130119) #fitalk all about physical data recovery
 
(130105) #fitalk trends in d forensics (dec, 2012)
(130105) #fitalk trends in d forensics (dec, 2012)(130105) #fitalk trends in d forensics (dec, 2012)
(130105) #fitalk trends in d forensics (dec, 2012)
 
(130105) #fitalk criminal civil judicial procedure in korea
(130105) #fitalk criminal civil judicial procedure in korea(130105) #fitalk criminal civil judicial procedure in korea
(130105) #fitalk criminal civil judicial procedure in korea
 

(121215) #fitalk optimize making the timeline