.\" Automatically generated by Pod::Man 2.16 (Pod::Simple 3.05) .\" .\" Standard preamble: .\" ======================================================================== .de Sh \" Subsection heading .br .if t .Sp .ne 5 .PP \fB\\$1\fR .PP .. .de Sp \" Vertical space (when we can't use .PP) .if t .sp .5v .if n .sp .. .de Vb \" Begin verbatim text .ft CW .nf .ne \\$1 .. .de Ve \" End verbatim text .ft R .fi .. .\" Set up some character translations and predefined strings. \*(-- will .\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left .\" double quote, and \*(R" will give a right double quote. \*(C+ will .\" give a nicer C++. Capital omega is used to do unbreakable dashes and .\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff, .\" nothing in troff, for use with C<>. .tr \(*W- .ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p' .ie n \{\ . ds -- \(*W- . ds PI pi . if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch . if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch . ds L" "" . ds R" "" . ds C` "" . ds C' "" 'br\} .el\{\ . ds -- \|\(em\| . ds PI \(*p . ds L" `` . ds R" '' 'br\} .\" .\" Escape single quotes in literal strings from groff's Unicode transform. .ie \n(.g .ds Aq \(aq .el .ds Aq ' .\" .\" If the F register is turned on, we'll generate index entries on stderr for .\" titles (.TH), headers (.SH), subsections (.Sh), items (.Ip), and index .\" entries marked with X<> in POD. Of course, you'll have to process the .\" output yourself in some meaningful fashion. .ie \nF \{\ . de IX . tm Index:\\$1\t\\n%\t"\\$2" .. . nr % 0 . rr F .\} .el \{\ . de IX .. .\} .\" .\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2). .\" Fear. Run. Save yourself. No user-serviceable parts. . \" fudge factors for nroff and troff .if n \{\ . ds #H 0 . ds #V .8m . ds #F .3m . ds #[ \f1 . ds #] \fP .\} .if t \{\ . ds #H ((1u-(\\\\n(.fu%2u))*.13m) . ds #V .6m . ds #F 0 . ds #[ \& . ds #] \& .\} . \" simple accents for nroff and troff .if n \{\ . ds ' \& . ds ` \& . ds ^ \& . ds , \& . ds ~ ~ . ds / .\} .if t \{\ . ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u" . ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u' . ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u' . ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u' . ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u' . ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u' .\} . \" troff and (daisy-wheel) nroff accents .ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V' .ds 8 \h'\*(#H'\(*b\h'-\*(#H' .ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#] .ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H' .ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u' .ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#] .ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#] .ds ae a\h'-(\w'a'u*4/10)'e .ds Ae A\h'-(\w'A'u*4/10)'E . \" corrections for vroff .if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u' .if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u' . \" for low resolution devices (crt and lpr) .if \n(.H>23 .if \n(.V>19 \ \{\ . ds : e . ds 8 ss . ds o a . ds d- d\h'-1'\(ga . ds D- D\h'-1'\(hy . ds th \o'bp' . ds Th \o'LP' . ds ae ae . ds Ae AE .\} .rm #[ #] #H #V #F C .\" ======================================================================== .\" .IX Title "TIMESCANNER 1" .TH TIMESCANNER 1 "2011-05-14" "perl v5.10.0" "User Contributed Perl Documentation" .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .if n .ad l .nh .SH "NAME" \&\fBtimescanner\fR \- A recursive scanner to produce timeline data extracted from file artifacts .SH "DESCRIPTION" .IX Header "DESCRIPTION" \&\fBtimscanner\fR recursively scans through a directory (such as a mounted filesystem) and extracts timestamp data gathered from the files that the tool log2timeline supports. This tool is written as a separate tool from \fBlog2timeline\fR but will be integrated in the tool soon. .SH "SYNOPSIS" .IX Header "SYNOPSIS" \&\fBtimescanner\fR [\s-1OPTIONS\s0] \-z \s-1TIMEZONE\s0 [\-f \s-1INPUT\s0 \s-1MODULE\s0] [\-o \s-1OUTPUT\s0 \s-1MODULE\s0] [\-w \s-1BODYFILE\s0] [\-v] \-d|\-dir \s-1DIRECTORY\s0 .PP See man timescanner for full details of options to use. .SH "OPTIONS" .IX Header "OPTIONS" .IP "\fB\-d|\-dir \s-1DIRECTORY\s0\fR" 8 .IX Item "-d|-dir DIRECTORY" This option is mandatory for the tool to operate. This option defines the starting directory which the tools recursively searches for supported artifacts. .IP "\fB\-s|\-skew \s-1TIME\s0\fR" 8 .IX Item "-s|-skew TIME" Time skew of original machine. The format of the variable \s-1TIME\s0 is: X | Xs | Xm | Xh, where X is a integer and s represents seconds, m minutes and h hours (default behaviour is sec onds) .IP "\fB\-m \s-1TEXT\s0\fR" 8 .IX Item "-m TEXT" Prepend the output line with \s-1TEXT\s0, for instance by using \-m \s-1HOSTNAME\s0 to include a hostname in the output .IP "\fB\-o|\-output \s-1FORMAT\s0\fR" 8 .IX Item "-o|-output FORMAT" Use the following output format. By default \fBlog2timeline\fR uses the csv output. To see a list of all available output formats, use \-o list .IP "\fB\-w|\-write \s-1FILENAME\s0\fR" 8 .IX Item "-w|-write FILENAME" Specify a file to write output to (otherwise \s-1STDOUT\s0 will be chosen). .IP "\fB\-z|\-zone \s-1TIMEZONE\s0\fR" 8 .IX Item "-z|-zone TIMEZONE" This option defines the timezone that was used on the computer that the log files belonged to. The default value for this variable is the local timezone of the computer timescanner is run on. .IP "\fB\-log \s-1FILENAME\s0\fR" 8 .IX Item "-log FILENAME" Specify a file to write error and information messages from the \fBlog2timeline\fR to a file, otherwise \s-1STDERR\s0 will be used. .IP "\fB\-name \s-1HOST\s0\fR" 8 .IX Item "-name HOST" Define the host name that the information is extracted from. .IP "\fB\-c|\-calculate\fR" 8 .IX Item "-c|-calculate" If this option is used then a \s-1MD5\s0 sum for each file that passes verification is calculated and included in the timestamp object .IP "\fB\-x\fR" 8 .IX Item "-x" Make \fBtimescanner\fR skip the default minimalist test to see if a file can be parsed by the supplied input module. .IP "\fB\-V|\-Version\fR" 8 .IX Item "-V|-Version" Display the version number .IP "\fB\-v|\-verbose\fR" 8 .IX Item "-v|-verbose" Add the verbose level of output, or debug level. This option can be provided twice to get an extra level of verbosity (two levels available) .IP "\fB\-h|\-help|\-?\fR" 8 .IX Item "-h|-help|-?" Display this help message .IP "\fB\-f|\-\-format\fR \s-1MODULE\s0" 8 .IX Item "-f|--format MODULE" The option of \-f can be used to select which modules are used in timescanner when recursively searching through the directory supplied to the tool. The option \s-1MODULE\s0 can be any of the four listed here: .RS 8 .IP "\fB\-f list\fR" 8 .IX Item "-f list" Print a list of all available modules the tool supports, alongside a print-out of the available lists (preselected modules that can be chosen) .IP "\fB\-f \s-1NAME\s0 \s-1OF\s0 A \s-1MODULE\s0\fR" 8 .IX Item "-f NAME OF A MODULE" If a list of available modules is presented, only those modules will be used by the tool. One module can be supplied, or a list separated with a comma (,). An example .RS 8 .IP "timescanner \-z local \-f evtx,oxml,pdf \-d ." 8 .IX Item "timescanner -z local -f evtx,oxml,pdf -d ." .RE .RS 8 .Sp This will run timescanner on the current directory and only use the modules evtx, oxml and pdf in the process. .RE .ie n .IP "\fB\-f=""\-NAME \s-1OF\s0 A \s-1MODULE\s0""\fR" 8 .el .IP "\fB\-f=``\-NAME \s-1OF\s0 A \s-1MODULE\s0''\fR" 8 .IX Item "-f=-NAME OF A MODULE" This option can be used to exclude a given module from being run (either a single one or a list, separated with a comma), an example: .RS 8 .ie n .IP "timescanner \-z local \-f=""\-evtx,exif"" \-d ." 8 .el .IP "timescanner \-z local \-f=``\-evtx,exif'' \-d ." 8 .IX Item "timescanner -z local -f=-evtx,exif -d ." .RE .RS 8 .Sp This will run the tool against the current directory and use all of the modules available \s-1EXCEPT\s0 the evtx and exif ones. .RE .IP "\fB\-f \s-1NAME\s0 \s-1OF\s0 A \s-1LIST\s0\fR" 8 .IX Item "-f NAME OF A LIST" There exist few available presets, or lists of available modules that can be used. See the available lists by issuing \fBtimescanner \-f list\fR. An example .RS 8 .IP "timescanner \-z local \-f winxp \-d /mnt/xpimage" 8 .IX Item "timescanner -z local -f winxp -d /mnt/xpimage" .RE .RS 8 .Sp This will run the tool against the directory /mnt/xpimage, and only use the modules that are associated to a Windows \s-1XP\s0 system, according to the winxp list file. .RE .RE .RS 8 .RE .IP "\fB\-e|\-\-exclude \s-1STRING\s0\fR" 8 .IX Item "-e|--exclude STRING" A comma separated list of files to exclude from the scan. If a particular file has caused the tool to crash or not work, or you simply want to exclude some documents from the scan it is possible to exclude some .Sp Example: .RS 8 .Sp .RS 8 \&\fItimescanner \-f winvista \-z local \-d /mnt/windows \-e 'Windows\-Diagnosis,secret[0\-3]'\fR .Sp This would scan all the directory /mnt/windows recursively, using only modules associated to a Windows Vista or later operating system, and excluding all filenames that have \*(L"Windows-Diagnosis\*(R" in them or contain the word secret0/secret1/secret2 or secret3 in it. .RE .RE .RS 8 .RE .SH "AUTHOR" .IX Header "AUTHOR" Kristinn Gudjonsson is the original author of the program. .SH "COPYRIGHT" .IX Header "COPYRIGHT" The tool is released under \s-1GPL\s0 so anyone can contribute to the tool. Some parts of the code have been copied from other \s-1GPL\s0'ed programs, such as RegRipper written by H. Carvey. .SH "SEE ALSO" .IX Header "SEE ALSO" log2timeline