FAERSLUSKRA2TIMALINA(1)

NAME
faersluskra2timaline - a log file parser that produces a body file used to create timelines (for forensic investigations).

SYNOPSIS
faersluskrar2timaline [OPTIONS] [-f FORMAT] [-z TIMEZONE] [-o OUTPUT MODULE] [-w BODYFILE] LOG_FILE/LOG_DIR [--] [FORMAT FILE OPTIONS]

OPTIONS

-timamismunur TIME
    Time skew of original machine. The format of the variable TIME is: X | Xs | Xm | Xh, where X is a integer and s represents seconds, m minutes and h hours (default behaviour is seconds)

-texti TEXT
    Prepend the filename with the TEXT. That is TEXT is a string that is prepended in front of the file name to provide a path. Examples are -m C: to prepend the C:/ in front of each file name to indicate the partition the file came from.

-s|-snid MODULE(s)/LIST
    Use the following log file format to parse the content of the file. Use -s list to see the list of supported log files. Omitting this options make faersluskra2timaline attempt to guess the format.

-uppfaera
    Check the latest available version of faersluskra2timalina and compare it to current version (use to check if there is an available update)

-nafn HOST
    Define the host name that the information is extracted from.

-utgangur FORMAT
    Use the following output format. By default faersluskra2timalina uses the CSV output. To see a list of all available output formats, use -o list

-smaatridi
    Some input modules have the capability to include very detailed amount of information (such as MFT, setupapi and prefetch). This switch will instruct modules to include those details in the timeline, so for instance to tell the MFT module to include the $FN timestamps, or the prefetch one to include loaded DLLs.

-skrifa FILENAME
    Specify a file to write output to (otherwise STDOUT will be chosen).

-timabelti TIMEZONE
    This option defines the timezone that was used on the computer that the log files belonged to. The default value for this variable is the local timezone of the computer faersluskra2timalina is run on. There is an option to define -z list to get a list of all available timezones.

-Timabelti TIMEZONE
    This option defines the timezone that is used in the output module of the tool. The default value for this variable is the same value that is defined in the -z option or the timezone of the host. This option is used so that output modules can output in a different timezone than the host is in, for instance to output in UTC even though the timezone of the host is in another timezone.

-b|-bradabirgda DIR
    This option defines the temporary directory the tool uses. By default the front-end does not set the temporary directory, but allows the engine to automatically detect it. This option therefore overwrites the default temporary directory location.

    The engine checks the operating system in question, if it is Windows, it will try to determine the temporary path based on the Win32::API (so this might fail on 64-bit systems, perhaps better to use this option to set it manually on those systems). Otherwise it will use /tmp/ as the temporary directory (should work on *NIX systems).

-faersluskra FILENAME
    Specify a file to write error and information messages from the faersluskra2timalina to a file, otherwise STDERR will be used.

-utreikingur
    If this option is used then a MD5 sum is calculated for the file and stored in the timestamp object

-x  Make faersluskra2timalina skip some more detailed tests to see if a file truly is in the correct input module. The tool should work faster with this option, however it might miss some files.

-undanskilja LIST
    A comma separated list of files to exclude from the scan. If a particular file has caused the tool to crash or not work, or you simply want to exclude some documents from the scan it is possible to exclude some

-endurkvaema
    This option makes faersluskra2timalina work in a recursive way, the same behaviour as timescanner.

-forvinnsla
    If faersluskra2timalina is working in recursive mode (-r) it is possible to use the -p option to run a set of pre-processors agains the image file. Preprocessors are modules that search through the suspect drive and extract needed information that can be used in other modules, such as hostname, etc.

-smaatridi
    Add debugging information. Possible to use with -smaatridi -smaatridi to increase some error messages.

-Utgafa
    Display the version number

-h|-hjalp|-?
    Display this help message

Better description can be read in the man page of the program (man faersluskra2timalina).

DESCRIPTION
faersluskra2timalina takes a log file (or a directory) and parses it to produce a body file that can be imported into other tools for timeline analysis. The tool has both a modular based approach to the input file as well as the output file. The current version supports exporting the timeline in a several different body formats. faersluskra2timalina is build as a series of scripts, this one being the front-end, which uses other scripts to actually parse the log files (called format files). The tool is build to be easily extended for anyone that wants to create a new format or an output file.

As noted above the default output mechanism is in a CSV file format, which can be easily imported into spreadsheet applications, and parsed by the tool l2t_process. The output format can be easily changed with the -o parameter. The output module can be set to output in a body format that needs to be imported into another tool for human readable format, or it can be implemented to print the timeline directly in a human readable format.

The tool is build using multiple so called input modules. Each of those input modules provide a single format that can be parsed, whether that is a log file or a directory containing some files that need to be parsed.

The purpose of the tool is to provide a single tool to parse various artifacts that are either produced by the suspsect operating system or other systems that might have some logs retaining to the investigation.

EXAMPLES

faersluskra2timalina -f list
    Print a list of all available format files.

faersluskra2timalina -f firefox3 -z EST5EDT -w /tmp/bodyfile places.sqlite -- -u JOE 2> /tmp/body.log
    Use the Firefox 3 history parser to parse a places.sqlite file that contains history information. Prepened the output with information about the user that owned the file, in this case the user JOE owned this history file. The output, which is in the TLN format will be written to the file body, while all log messages are written to the file body.log (STDERR is redirected to a file)

faersluskra2timalina -z local -f squid -s 2h access.log > squid.body
    Parses an access log file from Squid to produce a body file that is output into the file squid.body. Two hours are added to each time in the timeline to correct the time settings of the log file that is parsed.

faersluskra2timalina -z GMT -f prefetch WINDOWS/Prefetch >> case.body
    Parses the content of the Windows Prefetch directory and adds the timeline to the already available case.body timeline.

faersluskra2timalina -f recycler -z local -o sqlite -w /tmp/rec.sql RECYCLER/S-1-5-21-..../
    Parses the content of the INFO2 file, found inside each recycle bin and prints out information into a SQLite database (/tmp/rec.sql).

faersluskra2timalina -z local -f winxp -r -p /mnt/analyze
    Make faersluskra2timalina recursively go through the mount point /mnt/analyze using the available input modules that are stored inside the winxp list file (those that are relevant to a Windows XP machine). Before running the recursive scan the pre-processing modules are ran against the image to gather information from it.

RETURN VALUE

0   Successful program execution

1   Wrong usage of the faersluskra2timalina program. Possibly omitting the -f parameter or a file name to parse.

12  Problem loading the format file. Format file not found, not correctly formed or otherwise unable to parse the format file.

13  Problem loading the output file. Output file not found, not correctly formed or otherwise unable to parse the content of the output file.

14  Unable to verify the log file. That is the format file is unable to verify that the log file is of the correct format.

15  Unable to open the log file. Perhaps because you don't have permission to read the content of the log file.

20  Problem writing to output file.

45  The supplied timezone does not exist.

BUGS
As of now there are no known bugs, and when bugs are either discovered or reported they are fixed as soon as possible and made available in the nightly builds.

If you find a bug in the tool, please start by downloading the latest build (nightly builds) available at the Google code site: https://code.google.com/p/log2timeline (use git to get the latest build). If the bug hasn't been fixed please report the problem to Kristinn Gudjonsson (bugs ( a t ) log2timeline ( d o t ) net.

There are few known limitations though:

+ The LSO (.sol) input module isn't able to properly parse every .sol file it finds. The payload of a .sol file is encoded using Action Message Format from Adobe. There are two versions of AMF, AMF0 and AMF3. The vast majority of .sol files is encoded using the AMF0, however there are some that use AMF3. The current version of the sol parser only works against AMF0, however a version that supports AMF3 should be released in not so distant future.

+ There have also been reports about faersluskra2timalina not properly clean temporary files after completing it's run. This behaviour involves the input modules for Chrome and Firefox history. If the input module detects a database that is being locked, it copies the database to a temporary location to be able to connect and properly parse the file. After it has completed the parsing it will try to delete the temporary file using the Perl function unlink. If you do have this problem please notify the author to see if we can figure this out together and fix the problem.

HISTORY
For a full history of releases please refer to the changelog. This list only provides a brief high level overview of the first few releases, it is no longer maintained. Full changelog can be found on the tool's code site (https://code.google.com/p/log2timeline) and in the CHANGELOG that comes with the source.

v0.1b Initial release.
v0.11b (20/07/2009) Mostly few bug fixes.
v0.12b (31.07.2009) New features implemented, refining of code.
v0.20b (04.08.2009) Bug fixes, changes in the structure and new input modules introduced.
v0.21b (07.08.2009) Bug fixes, changes in the structure and new input modules introduced.
v0.22b (10.08.2009) New input modules.
v0.30b (02/09/09) Changes to the structure, first release of a GUI, bug fixes and common libraries used.
v0.31b (07/09/09) New modules, new front-end timescanner introduced.  Small bug fixes.
v0.32b (10/09/09) Bug fixes, new input modules as well as libraries. Version checking implemented.
v0.33b (15/09/09) Bug fixes.
v0.40 (25/11/09) Changes in the structure, timestamps normalized to UTC.  Bug fixes, improvements in modules, new input modules.
v0.41 (15/01/10) New input modules, bug fixes, improvements of older modules, new update mechansim introduced.
0.42 (05/03/10) New input modules (pdf,mcafee), bug fixes, improvements of older modules and the main tool
0.50 (30/06/10) New timestamp object introduced, every module updated along with front-ends, bug fixes and improvements
0.51 (14/12/2010) New input modules alongside several bug fixes.
0.52 (05/04/2011) New input modules alongside several bug fixes.
0.60 (05/06/2011) Core redesign of the tool, moving the engine to a separate library and several other changes.
0.60+ not described here any more... list kept for legacy reasons.

AUTHOR
Kristinn Gudjonsson <kristinn (a t) log2timeline ( d o t ) net> is the original author of the program.

The tool is released under GPL so anyone can contribute to the tool. Some parts of the code have been copied from other GPL'ed programs, such as the Parse::Evtx library by Andreas Schuster, and parts of RegRipper written by H. Carvey.

COPYRIGHT AND LICENSE
Copyright 2009-2012 by Kristinn Gudjonsson (kristinn ( a t ) log2timeline ( d o t ) net )

faersluskra2timalina is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

faersluskra2timalina is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with faersluskra2timalina. If not, see <http://www.gnu.org/licenses/>.

SEE ALSO
Log2Timeline