4n6

How to build a super timeline with plaso on a Windows workstation: extract events with log2timeline, filter them with psort and review them in a spreadsheet. Updated with the Docker workflow.

Read the post →