search

forensicmatt / PancakeViewer

A DFVFS Backed Forensic Viewer
Apache License 2.0
38 stars 6 forks source link

Enhancement: Add to Timeline #18

Open randomaccess3 opened 8 years ago

randomaccess3 commented 8 years ago

It would be great if you could add items to a timeline. So you can select an item in the MFT and then select the fields you want to correlate to a time. ie selecting this Date Created

Date modified etc

Name Size Path

Would create: Date Created, Name, Size, Path Date Modified, Name, Size, Path

The expansion on that would allow you to do the same with other forensic artifacts into a variety of different timeline formats

forensicmatt commented 8 years ago

Not sure on how I want to scope this project yet. Right now main priority is to be a viewer type app that allows people to export from dfvfs supported containers, vss, and dfvfs supported encrypted volumes.