Making a timeline in Autopsy

Autopsy is a popular piece of open source freeware with many advocates in the digital forensics community. The tool performs all the basic functions required for investigative work, and also makes it easy for technical users to extend it by creating compatible plugins.

The timeline feature is generally loaded within a case that is already running, and ideally needs to have several options enabled in order to be used efficiently, these being:

• Hash lookup with NSRL
• Recent activity
• EXIF data

Getting ready

First, load up your case in Autopsy and then click Timeline at the top of the page. A new window will now open, which will give you access to the Timeline feature.

Although Autopsy's Timeline...