For logical acquisition consider using a better tool than find+stat for the timeline

google / GiftStick

1-Click push forensics evidence to the cloud

Apache License 2.0

137 stars 21 forks source link

For logical acquisition consider using a better tool than find+stat for the timeline #127

Open rgayon opened 3 years ago

rgayon commented 3 years ago

find + stat is (somewhat) guaranteed to work on most UNIX environement, but it can be very slow to fork stat on every file. The code could detect wheter a better suited timeline tool, maybe FLS, or something smaller that would do that.

Maybe even write our own python code?