timescanner - A recursive scanner to produce timeline data extracted from file artifacts
timscanner recursively scans through a directory (such as a mounted filesystem) and extracts timestamp data gathered from the files that the tool log2timeline supports. This tool is written as a separate tool from log2timeline but will be integrated in the tool soon.
timescanner [OPTIONS] -d|-dir DIRECTORY
This option is mandatory for the tool to operate. This option defines the starting directory which the tools recursively searches for supported artifacts.
Time skew of original machine. The format of the variable TIME is: X | Xs | Xm | Xh, where X is a integer and s represents seconds, m minutes and h hours (default behaviour is sec onds)
Prepend the output line with TEXT, for instance by using -m HOSTNAME to include a hostname in the output
Use the following output format. By default log2timeline uses the mactime output. To see a list of all available output formats, use -o list
Specify a file to write output to (otherwise STDOUT will be chosen).
Specify a file to write error and information messages from the log2timeline to a file, otherwise STDERR will be used.
Display the version number
Display this help message
Kristinn Gudjonsson <kristinn (a t) log2timeline ( d o t ) net> is the original author of the program.
The tool is released under GPL so anyone can contribute to the tool. Some parts of the code have been copied from other GPL'ed programs, such as RegRipper written by H. Carvey.
log2timeline