DFIRKuiper / Kuiper

Digital Forensics Investigation Platform
760 stars 111 forks source link

Option to generate new timeline instead of using version or checking for older ones #65

Closed nyrm-f closed 2 years ago

nyrm-f commented 2 years ago

Hello,

Looked at some of the code for building master Timeline, it seems that when I hit download timeline and it activates 'timeline_build_ajax' it builds it once. Then unless I tag something new, when i hit download, it will download the previously generated timeline.

Ran into this issue because I was editing Timeline Views and adding new ones. When I wanted to test my new Timeline Views, I realized Kuiper was not checking for my new Timeline Views because a new one wasnt being generated.

Can there be an option or something to have Kuiper generate a new timeline sheet each time? instead of checking for existing timelines?

tldr: how to generate brand new timeline each time i export tagged items in Timeline page?

salehmuhaysin commented 2 years ago

hi,

from the interface you can't remove the previous timelines or change the timeline.xlsx, however, from the commandline (ssh) remove all timelines from the case folder in kuiper/kuiper/files/timeline/ then when you generate the timeline it will use the original timeline.xlsx

nyrm-f commented 2 years ago

Hi,

I have tried deleting the Case folder in /files/timeline/ and it is still not working. There are no .xlsx files in that folder at all, but if i download a new timeline it still spits out the previously configured one.

Would the xlsx be stored in any other location? cache? memory? I've done full reboot of Kuiper and VM and it still spits out the old timeline.

Screen Shot 2022-08-07 at 19 00 24
salehmuhaysin commented 2 years ago

ensure that there is not conflict on the Views, one record can match one view, if you added view that match specific record that already match another view it will take the old one also could you share the View