NAME

timescanner - A recursive scanner to produce timeline data extracted from file artifacts


DESCRIPTION

timscanner recursively scans through a directory (such as a mounted filesystem) and extracts timestamp data gathered from the files that the tool log2timeline supports. This tool is written as a separate tool from log2timeline but will be integrated in the tool soon.


SYNOPSIS

timescanner [OPTIONS] -d|-dir DIRECTORY


OPTIONS

-d|-dir DIRECTORY

This option is mandatory for the tool to operate. This option defines the starting directory which the tools recursively searches for supported artifacts.

-s|-skew TIME

Time skew of original machine. The format of the variable TIME is: X | Xs | Xm | Xh, where X is a integer and s represents seconds, m minutes and h hours (default behaviour is sec onds)

-m TEXT

Prepend the output line with TEXT, for instance by using -m HOSTNAME to include a hostname in the output

-o|-output FORMAT

Use the following output format. By default log2timeline uses the mactime output. To see a list of all available output formats, use -o list

-w|-write FILENAME

Specify a file to write output to (otherwise STDOUT will be chosen).

-log FILENAME

Specify a file to write error and information messages from the log2timeline to a file, otherwise STDERR will be used.

-V|-Version

Display the version number

-h|-help|-?

Display this help message


AUTHOR

Kristinn Gudjonsson <kristinn (a t) log2timeline ( d o t ) net> is the original author of the program.


COPYRIGHT

The tool is released under GPL so anyone can contribute to the tool. Some parts of the code have been copied from other GPL'ed programs, such as RegRipper written by H. Carvey.


SEE ALSO

log2timeline