Timesketch
Timesketch
Timesketch is an open-source platform for the collaborative analysis of forensic timelines. It ingests large timeline datasets, makes them searchable and allows several analysts to work collaboratively on the same investigation — with tags, annotations and shared findings. It is the analysis interface for tools such as Plaso (log2timeline) (Plaso).
History & facts. Timesketch solves a practical problem of timeline analysis: the timelines generated by tools such as Plaso (log2timeline) (Plaso) are huge and hardly manageable on their own. The platform makes them searchable, allows filtering and visualisation and supports the joint work of several investigators on one investigation — for instance by tagging relevant events and sharing interim states.
Outlook & recommendation. The added value lies in collaboration and structuring: an unmanageable mass of events becomes a guided, traceable investigation. Combined with Plaso (log2timeline) (Plaso) as a data supplier, an end-to-end workflow from raw acquisition to analysis emerges. As an open-source solution, Timesketch can be integrated into one's own Digital Forensics and Incident Response (DFIR) environment and keeps the investigation data under one's own control.