09 · Timeline Analysis
Building a Linux Super Timeline with Plaso and mactime
Build a Linux forensic super timeline with TSK mactime and Plaso: log2timeline, psort and pinfo, Linux parsers, time slicing, UTC and Timesketch.
timelineplasolog2timeline
Area 09
Timeline Analysis
A timeline turns scattered artifacts into a story. This area covers body files and mactime, Plaso's log2timeline and psort with the Linux parsers that matter, normalising everything to UTC, and pivoting from a known-bad anchor event.
Key artifacts
- mactime
- log2timeline
- Timesketch
Guides in this area
Artifact cheat sheets
Where each artifact lives, what it proves, its timestamps and the tools to parse it.
- ext4 Timestamps, crtime and Deleted Filesext4 inode timestamps (atime, mtime, ctime, crtime, dtime) with nanoseconds, relatime, the jbd2 journal and what deleted-file recovery can still do.
- systemd Journal: Linux Binary System LogThe systemd-journald binary log: structured entries with trusted process fields and microsecond UTC timestamps, often the only system log on modern Linux hosts.
- auth.log, secure and syslog: Linux Text Logsrsyslog text logs on Linux: auth.log and syslog on Debian/Ubuntu, secure and messages on RHEL, with rotation and timestamp format pitfalls.
- auditd audit.log: Linux Kernel Audit TrailThe Linux audit log written by auditd: PAM logins, syscalls, execve arguments and watched file access, each tied to the original login user (auid).
- Linux Thumbnail Cache: ~/.cache/thumbnails ForensicsThe freedesktop thumbnail cache on Linux: PNG previews named by the MD5 of the file URI, holding path and mtime, that outlive deleted files.
- Linux Trash: freedesktop .trashinfo Files and Deleted ItemsThe freedesktop.org Trash on Linux desktops: .trashinfo records with original path and deletion time, the trashed files themselves and per-volume trash folders.