.\" Automatically generated by Pod::Man 2.16 (Pod::Simple 3.05) .\" .\" Standard preamble: .\" ======================================================================== .de Sh \" Subsection heading .br .if t .Sp .ne 5 .PP \fB\\$1\fR .PP .. .de Sp \" Vertical space (when we can't use .PP) .if t .sp .5v .if n .sp .. .de Vb \" Begin verbatim text .ft CW .nf .ne \\$1 .. .de Ve \" End verbatim text .ft R .fi .. .\" Set up some character translations and predefined strings. \*(-- will .\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left .\" double quote, and \*(R" will give a right double quote. \*(C+ will .\" give a nicer C++. Capital omega is used to do unbreakable dashes and .\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff, .\" nothing in troff, for use with C<>. .tr \(*W- .ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p' .ie n \{\ . ds -- \(*W- . ds PI pi . if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch . if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch . ds L" "" . ds R" "" . ds C` "" . ds C' "" 'br\} .el\{\ . ds -- \|\(em\| . ds PI \(*p . ds L" `` . ds R" '' 'br\} .\" .\" Escape single quotes in literal strings from groff's Unicode transform. .ie \n(.g .ds Aq \(aq .el .ds Aq ' .\" .\" If the F register is turned on, we'll generate index entries on stderr for .\" titles (.TH), headers (.SH), subsections (.Sh), items (.Ip), and index .\" entries marked with X<> in POD. Of course, you'll have to process the .\" output yourself in some meaningful fashion. .ie \nF \{\ . de IX . tm Index:\\$1\t\\n%\t"\\$2" .. . nr % 0 . rr F .\} .el \{\ . de IX .. .\} .\" .\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2). .\" Fear. Run. Save yourself. No user-serviceable parts. . \" fudge factors for nroff and troff .if n \{\ . ds #H 0 . ds #V .8m . ds #F .3m . ds #[ \f1 . ds #] \fP .\} .if t \{\ . ds #H ((1u-(\\\\n(.fu%2u))*.13m) . ds #V .6m . ds #F 0 . ds #[ \& . ds #] \& .\} . \" simple accents for nroff and troff .if n \{\ . ds ' \& . ds ` \& . ds ^ \& . ds , \& . ds ~ ~ . ds / .\} .if t \{\ . ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u" . ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u' . ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u' . ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u' . ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u' . ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u' .\} . \" troff and (daisy-wheel) nroff accents .ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V' .ds 8 \h'\*(#H'\(*b\h'-\*(#H' .ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#] .ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H' .ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u' .ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#] .ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#] .ds ae a\h'-(\w'a'u*4/10)'e .ds Ae A\h'-(\w'A'u*4/10)'E . \" corrections for vroff .if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u' .if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u' . \" for low resolution devices (crt and lpr) .if \n(.H>23 .if \n(.V>19 \ \{\ . ds : e . ds 8 ss . ds o a . ds d- d\h'-1'\(ga . ds D- D\h'-1'\(hy . ds th \o'bp' . ds Th \o'LP' . ds ae ae . ds Ae AE .\} .rm #[ #] #H #V #F C .\" ======================================================================== .\" .IX Title "LOG2TIMELINE 1" .TH LOG2TIMELINE 1 "2011-05-29" "perl v5.10.0" "User Contributed Perl Documentation" .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .if n .ad l .nh .SH "NAME" \&\fBlog2timeline\fR \- a log file parser that produces a body file used to create timelines (for forensic investigations). .SH "SYNOPSIS" .IX Header "SYNOPSIS" \&\fBlog2timeline\fR [\s-1OPTIONS\s0] [\-f \s-1FORMAT\s0] [\-z \s-1TIMEZONE\s0] [\-o \s-1OUTPUT\s0 \s-1MODULE\s0] [\-w \s-1BODYFILE\s0] \s-1LOG_FILE/LOG_DIR\s0 [\-\-] [\s-1FORMAT\s0 \s-1FILE\s0 \s-1OPTIONS\s0] .SH "OPTIONS" .IX Header "OPTIONS" .IP "\fB\-s|\-skew \s-1TIME\s0\fR" 8 .IX Item "-s|-skew TIME" Time skew of original machine. The format of the variable \s-1TIME\s0 is: X | Xs | Xm | Xh, where X is a integer and s represents seconds, m minutes and h hours (default behaviour is seconds) .IP "\fB\-m \s-1TEXT\s0\fR" 8 .IX Item "-m TEXT" Prepend the filename with the \fB\s-1TEXT\s0\fR. That is \fB\s-1TEXT\s0\fR is a string that is prepended in front of the file name to provide a path. Examples are \-m C: to prepend the C:/ in front of each file name to indicate the partition the file came from. .IP "\fB\-f|\-format \s-1FORMAT\s0\fR" 8 .IX Item "-f|-format FORMAT" Use the following log file format to parse the content of the file. Use \-f list to see the list of supported log files. Omitting this options make \fBlog2timeline\fR attempt to guess the format. .IP "\fB\-u|\-upgrade\fR" 8 .IX Item "-u|-upgrade" Check the latest available version of \fBlog2timeline\fR and compare it to current version (use to check if there is an available update) .IP "\fB\-name \s-1HOST\s0\fR" 8 .IX Item "-name HOST" Define the host name that the information is extracted from. .IP "\fB\-o|\-output \s-1FORMAT\s0\fR" 8 .IX Item "-o|-output FORMAT" Use the following output format. By default \fBlog2timeline\fR uses the \s-1CSV\s0 output. To see a list of all available output formats, use \-o list .IP "\fB\-w|\-write \s-1FILENAME\s0\fR" 8 .IX Item "-w|-write FILENAME" Specify a file to write output to (otherwise \s-1STDOUT\s0 will be chosen). .IP "\fB\-z|\-zone \s-1TIMEZONE\s0\fR" 8 .IX Item "-z|-zone TIMEZONE" This option defines the timezone that was used on the computer that the log files belonged to. The default value for this variable is the local timezone of the computer \fBlog2timeline\fR is run on. There is an option to define \-z list to get a list of all available timezones. .IP "\fB\-log \s-1FILENAME\s0\fR" 8 .IX Item "-log FILENAME" Specify a file to write error and information messages from the \fBlog2timeline\fR to a file, otherwise \s-1STDERR\s0 will be used. .IP "\fB\-c|\-calculate\fR" 8 .IX Item "-c|-calculate" If this option is used then a \s-1MD5\s0 sum is calculated for the file and stored in the timestamp object .IP "\fB\-x\fR" 8 .IX Item "-x" Make \fBlog2timeline\fR skip some more detailed tests to see if a file truly is in the correct input module. The tool should work faster with this option, however it might miss some files. .IP "\fB\-e|\-exclude \s-1LIST\s0\fR" 8 .IX Item "-e|-exclude LIST" A comma separated list of files to exclude from the scan. If a particular file has caused the tool to crash or not work, or you simply want to exclude some documents from the scan it is possible to exclude some .IP "\fB\-r|\-recursive\fR" 8 .IX Item "-r|-recursive" This option makes \fBlog2timeline\fR work in a recursive way, the same behaviour as timescanner. .IP "\fB\-p|\-preprocess\fR" 8 .IX Item "-p|-preprocess" If \fBlog2timeline\fR is working in recursive mode (\-r) it is possible to use the \-p option to run a set of pre-processors agains the image file. Preprocessors are modules that search through the suspect drive and extract needed information that can be used in other modules, such as hostname, etc. .IP "\fB\-v|\-verbose\fR" 8 .IX Item "-v|-verbose" Add debugging information. Possible to use with \-v \-v to increase some error messages. .IP "\fB\-V|\-Version\fR" 8 .IX Item "-V|-Version" Display the version number .IP "\fB\-h|\-help|\-?\fR" 8 .IX Item "-h|-help|-?" Display this help message .PP Better description can be read in the man page of the program (man \fBlog2timeline\fR). .SH "DESCRIPTION" .IX Header "DESCRIPTION" \&\fBlog2timeline\fR takes a log file (or a directory) and parses it to produce a body file that can be imported into other tools for timeline analysis. The tool has both a modular based approach to the input file as well as the output file. The current version supports exporting the timeline in a several different body formats. \fBlog2timeline\fR is build as a series of scripts, this one being the front-end, which uses other scripts to actually parse the log files (called format files). The tool is build to be easily extended for anyone that wants to create a new format or an output file. .PP As noted above the default output mechanism is in a \s-1CSV\s0 file format, which can be easily imported into spreadsheet applications, and parsed by the tool \fBl2t_process\fR. The output format can be easily changed with the \-o parameter. The output module can be set to output in a body format that needs to be imported into another tool for human readable format, or it can be implemented to print the timeline directly in a human readable format. .PP The tool is build using multiple so called input modules. Each of those input modules provide a single format that can be parsed, whether that is a log file or a directory containing some files that need to be parsed. .PP The purpose of the tool is to provide a single tool to parse various artifacts that are either produced by the suspsect operating system or other systems that might have some logs retaining to the investigation. .SH "OVERVIEW" .IX Header "OVERVIEW" Furhter description of the parameters .IP "\fB\-s|\-skew \s-1TIME\s0\fR" 8 .IX Item "-s|-skew TIME" Time skew of original machine. It is added (or subtracted) from each time (ctime,atime,mtime,crtime) in the bodyfile to compensate for different time in some log files from the \*(L"correct\*(R" time. The format of the variable \fB\s-1TIME\s0\fR is: .RS 8 .IP "\fIX | Xs | Xm | Xh\fR" 4 .IX Item "X | Xs | Xm | Xh" Where X is a integer and s represents seconds, m minutes and h hours (default behaviour is seconds) It is possible to prepend \fB\s-1TIME\s0\fR with a minus sign (\-) to indicate that the time skew is a negative number. .Sp Example of this usage is: \fBlog2timeline\fR \-t 1243 (a time skew of +1243 seconds is added to each time) .RE .RS 8 .RE .IP "\fB\-m \s-1TEXT\s0\fR" 8 .IX Item "-m TEXT" Prepend the filename with the \fB\s-1TEXT\s0\fR. That is \fB\s-1TEXT\s0\fR is a string that is prepended in front of the file name to provide a path. Examples are \-m C: to prepend the C:/ in front of each file name to indicate the partition the file came from. .IP "\fB\-u|\-upgrade\fR" 8 .IX Item "-u|-upgrade" Check the latest available version of \fBlog2timeline\fR and compare it to current version (use to check if there is an available update). What this option does is to fetch a file http://log2timeline.net/VERSION, which contains a single number, which reflects the latest released version of the tool. This version number is then compared to the tools version number to find out if there is a new version available on the official site. .IP "\fB\-f|\-format \s-1FORMAT\s0\fR" 8 .IX Item "-f|-format FORMAT" \&\fBlog2timeline\fR has the capability to automatically detect the format of the log file. If this option is omitted log2timeline will attempt to guess the source file format. However the behaviour can be overwritten with this option. So if the \-f parameter is set the tool will only use that input module to test against the log file. .Sp It is possible to either define a single input module, list of them or a name of a list file that contains a list of input modules to use. .Sp To get a list of all available input modules use the option of \-f list. .IP "\fB\-name \s-1HOST\s0\fR" 8 .IX Item "-name HOST" Define the host name that the information is extracted from. .IP "\fB\-o|\-output \s-1FORMAT\s0\fR" 8 .IX Item "-o|-output FORMAT" Use the following output format. By default \fBlog2timeline\fR uses the \s-1CSV\s0 output. To see a list of all available output formats, use \-o list .Sp This option works the same way as the format file option does (\-f) in the way that it searches the output folder for a file called \s-1FORMAT\s0.pl and uses that to print the output that has been generated previously by the format file. The tool dies if the script \s-1FORMAT\s0.pl does not exist or is of the wrong format (with an exit code of 13). .IP "\fB\-w|\-write \s-1FILENAME\s0\fR" 8 .IX Item "-w|-write FILENAME" The standard way to output the bodyfile or timeline is by using standard output (\s-1STDOUT\s0). That can be overwritten using this option to redirect the output to a file. .IP "\fB\-v|\-verbose\fR" 8 .IX Item "-v|-verbose" Add debugging information .IP "\fB\-z|\-zone \s-1TIMEZONE\s0\fR" 8 .IX Item "-z|-zone TIMEZONE" This option defines the timezone that was used on the computer that the log files belonged to. The default value for this variable is the local timezone of the computer \fBlog2timeline\fR is run on. Depending on the supplied artifact it may be written using the timestamps from the original computer's timezone or it may be written in predefined timezone, such as \s-1UTC\s0. .Sp If the \*(L"\-z local\*(R" timezone is chosen the tool will print the found local timezone. .Sp The option \-z list prints out a list of all available timezones that can be chosen. .IP "\fB\-log \s-1FILENAME\s0\fR" 8 .IX Item "-log FILENAME" Specify a file to write error and information messages from the \fBlog2timeline\fR to a file, otherwise \s-1STDERR\s0 will be used. .IP "\fB\-c|\-calculate\fR" 8 .IX Item "-c|-calculate" If this option is used then a \s-1MD5\s0 sum is calculated for the file and stored in the timestamp object .IP "\fB\-x\fR" 8 .IX Item "-x" \&\fBlog2timeline\fR will by default try to run a minimized test on the input file to determine if it is of the correct structure. For instance only to test the first byte to see if it matches. This could lead to some files not being detected by log2timeline. Therefore the \-x option is provided to skip this pre-test and move directly to a more comprehensive test that is otherwise done after the pre-test is successful. This might lead to fewer false positives, but in turn makes the tool a bit slower. .IP "\fB\-V|\-Version\fR" 8 .IX Item "-V|-Version" Display the version number of the tool \fBlog2timeline\fR and exit with the exit code 0. .IP "\fB\-h|\-help|\-?\fR" 8 .IX Item "-h|-help|-?" Display a help message explaining the available options to the tool (a simple version of this man page). .IP "\fB\-e|\-exclude \s-1LIST\s0\fR" 8 .IX Item "-e|-exclude LIST" A comma separated list of files to exclude from the scan. If a particular file has caused the tool to crash or not work, or you simply want to exclude some documents from the scan it is possible to exclude some .Sp Example: .RS 8 .Sp .RS 8 \&\fIlog2timeline \-f winvista \-r \-z local \-e 'Windows\-Diagnosis,secret[0\-3]' /mnt/windows\fR .Sp This would scan all the directory /mnt/windows recursively, using only modules associated to a Windows Vista or later operating system, and excluding all filenames that have \*(L"Windows-Diagnosis\*(R" in them or contain the word secret0/secret1/secret2 or secret3 in it. .RE .RE .RS 8 .RE .IP "\fB\-r|\-recursive\fR" 8 .IX Item "-r|-recursive" This option makes \fBlog2timeline\fR work in a recursive way, the same behaviour as timescanner. .IP "\fB\-p|\-preprocess\fR" 8 .IX Item "-p|-preprocess" If \fBlog2timeline\fR is working in recursive mode (\-r) it is possible to use the \-p option to run a set of pre-processors agains the image file. Preprocessors are modules that search through the suspect drive and extract needed information that can be used in other modules, such as hostname, etc. .SH "EXAMPLES" .IX Header "EXAMPLES" .IP "\fBlog2timeline\fR \-f list" 8 .IX Item "log2timeline -f list" Print a list of all available format files. .IP "\fBlog2timeline\fR \-f firefox3 \-z \s-1EST5EDT\s0 \-w /tmp/bodyfile places.sqlite \*(-- \-u \s-1JOE\s0 2> /tmp/body.log" 8 .IX Item "log2timeline -f firefox3 -z EST5EDT -w /tmp/bodyfile places.sqlite -u JOE 2> /tmp/body.log" Use the Firefox 3 history parser to parse a places.sqlite file that contains history information. Prepened the output with information about the user that owned the file, in this case the user \s-1JOE\s0 owned this history file. The output, which is in the \s-1TLN\s0 format will be written to the file body, while all log messages are written to the file body.log (\s-1STDERR\s0 is redirected to a file) .IP "\fBlog2timeline\fR \-z local \-f squid \-s 2h access.log > squid.body" 8 .IX Item "log2timeline -z local -f squid -s 2h access.log > squid.body" Parses an access log file from Squid to produce a body file that is output into the file squid.body. Two hours are added to each time in the timeline to correct the time settings of the log file that is parsed. .IP "\fBlog2timeline\fR \-z \s-1GMT\s0 \-f prefetch WINDOWS/Prefetch >> case.body" 8 .IX Item "log2timeline -z GMT -f prefetch WINDOWS/Prefetch >> case.body" Parses the content of the Windows Prefetch directory and adds the timeline to the already available case.body timeline. .IP "\fBlog2timeline\fR \-f recycler \-z local \-o sqlite \-w /tmp/rec.sql \s-1RECYCLER/S\-1\-5\-21\-\s0..../" 8 .IX Item "log2timeline -f recycler -z local -o sqlite -w /tmp/rec.sql RECYCLER/S-1-5-21-..../" Parses the content of the \s-1INFO2\s0 file, found inside each recycle bin and prints out information into a SQLite database (/tmp/rec.sql). .IP "\fBlog2timeline\fR \-z local \-f winxp \-r \-p /mnt/analyze" 8 .IX Item "log2timeline -z local -f winxp -r -p /mnt/analyze" Make \fBlog2timeline\fR recursively go through the mount point /mnt/analyze using the available input modules that are stored inside the winxp list file (those that are relevant to a Windows \s-1XP\s0 machine). Before running the recursive scan the pre-processing modules are ran against the image to gather information from it. .SH "RETURN VALUE" .IX Header "RETURN VALUE" .IP "\fB0\fR" 8 .IX Item "0" Successful program execution .IP "\fB1\fR" 8 .IX Item "1" Wrong usage of the \fBlog2timeline\fR program. Possibly omitting the \-f parameter or a file name to parse. .IP "\fB12\fR" 8 .IX Item "12" Problem loading the format file. Format file not found, not correctly formed or otherwise unable to parse the format file. .IP "\fB13\fR" 8 .IX Item "13" Problem loading the output file. Output file not found, not correctly formed or otherwise unable to parse the content of the output file. .IP "\fB14\fR" 8 .IX Item "14" Unable to verify the log file. That is the format file is unable to verify that the log file is of the correct format. .IP "\fB15\fR" 8 .IX Item "15" Unable to open the log file. Perhaps because you don't have permission to read the content of the log file. .IP "\fB20\fR" 8 .IX Item "20" Problem writing to output file. .IP "\fB45\fR" 8 .IX Item "45" The supplied timezone does not exist. .SH "BUGS" .IX Header "BUGS" As of now there are no known bugs, and when bugs are either discovered or reported they are fixed as soon as possible and made available in the nightly builds. .PP If you find a bug in the tool, please start by downloading the latest build (nightly builds) available at http://log2timeline.net/files/log2timeline_nightly.tgz to verify that the bug hasn't already been fixed and if it hasn't please report the problem to Kristinn Gudjonsson (bugs ( a t ) log2timeline ( d o t ) net. .PP There are few known limitations though: .PP + The \s-1LSO\s0 (.sol) input module isn't able to properly parse every .sol file it finds. The payload of a .sol file is encoded using Action Message Format from Adobe. There are two versions of \s-1AMF\s0, \s-1AMF0\s0 and \s-1AMF3\s0. The vast majority of \&.sol files is encoded using the \s-1AMF0\s0, however there are some that use \s-1AMF3\s0. The current version of the sol parser only works against \s-1AMF0\s0, however a version that supports \s-1AMF3\s0 should be released in not so distant future. .PP + There have also been reports about \fBlog2timeline\fR not properly clean temporary files after completing it's run. This behaviour involves the input modules for Chrome and Firefox history. If the input module detects a database that is being locked, it copies the database to a temporary location to be able to connect and properly parse the file. After it has completed the parsing it will try to delete the temporary file using the Perl function unlink. If you do have this problem please notify the author to see if we can figure this out together and fix the problem. .SH "HISTORY" .IX Header "HISTORY" For a full history of releases please refer to the changelog. .IP "v0.1b Initial release." 8 .IX Item "v0.1b Initial release." .PD 0 .IP "v0.11b (20/07/2009) Mostly few bug fixes." 8 .IX Item "v0.11b (20/07/2009) Mostly few bug fixes." .IP "v0.12b (31.07.2009) New features implemented, refining of code." 8 .IX Item "v0.12b (31.07.2009) New features implemented, refining of code." .IP "v0.20b (04.08.2009) Bug fixes, changes in the structure and new input modules introduced." 8 .IX Item "v0.20b (04.08.2009) Bug fixes, changes in the structure and new input modules introduced." .IP "v0.21b (07.08.2009) Bug fixes, changes in the structure and new input modules introduced." 8 .IX Item "v0.21b (07.08.2009) Bug fixes, changes in the structure and new input modules introduced." .IP "v0.22b (10.08.2009) New input modules." 8 .IX Item "v0.22b (10.08.2009) New input modules." .IP "v0.30b (02/09/09) Changes to the structure, first release of a \s-1GUI\s0, bug fixes and common libraries used." 8 .IX Item "v0.30b (02/09/09) Changes to the structure, first release of a GUI, bug fixes and common libraries used." .IP "v0.31b (07/09/09) New modules, new front-end timescanner introduced. Small bug fixes." 8 .IX Item "v0.31b (07/09/09) New modules, new front-end timescanner introduced. Small bug fixes." .IP "v0.32b (10/09/09) Bug fixes, new input modules as well as libraries. Version checking implemented." 8 .IX Item "v0.32b (10/09/09) Bug fixes, new input modules as well as libraries. Version checking implemented." .IP "v0.33b (15/09/09) Bug fixes." 8 .IX Item "v0.33b (15/09/09) Bug fixes." .IP "v0.40 (25/11/09) Changes in the structure, timestamps normalized to \s-1UTC\s0. Bug fixes, improvements in modules, new input modules." 8 .IX Item "v0.40 (25/11/09) Changes in the structure, timestamps normalized to UTC. Bug fixes, improvements in modules, new input modules." .IP "v0.41 (15/01/10) New input modules, bug fixes, improvements of older modules, new update mechansim introduced." 8 .IX Item "v0.41 (15/01/10) New input modules, bug fixes, improvements of older modules, new update mechansim introduced." .IP "0.42 (05/03/10) New input modules (pdf,mcafee), bug fixes, improvements of older modules and the main tool" 8 .IX Item "0.42 (05/03/10) New input modules (pdf,mcafee), bug fixes, improvements of older modules and the main tool" .IP "0.50 (30/06/10) New timestamp object introduced, every module updated along with front-ends, bug fixes and improvements" 8 .IX Item "0.50 (30/06/10) New timestamp object introduced, every module updated along with front-ends, bug fixes and improvements" .IP "0.51 (14/12/2010) New input modules alongside several bug fixes." 8 .IX Item "0.51 (14/12/2010) New input modules alongside several bug fixes." .IP "0.52 (05/04/2011) New input modules alongside several bug fixes." 8 .IX Item "0.52 (05/04/2011) New input modules alongside several bug fixes." .IP "0.60 () Core redesign of the tool, moving the engine to a separate library and several other changes." 8 .IX Item "0.60 () Core redesign of the tool, moving the engine to a separate library and several other changes." .PD .SH "AUTHOR" .IX Header "AUTHOR" Kristinn Gudjonsson is the original author of the program. .PP The tool is released under \s-1GPL\s0 so anyone can contribute to the tool. Some parts of the code have been copied from other \s-1GPL\s0'ed programs, such as the Parse::Evtx library by Andreas Schuster, and parts of RegRipper written by H. Carvey. .SH "COPYRIGHT AND LICENSE" .IX Header "COPYRIGHT AND LICENSE" Copyright 2009\-2011 by Kristinn Gudjonsson (kristinn ( a t ) log2timeline ( d o t ) net ) .PP \&\fBlog2timeline\fR is free software: you can redistribute it and/or modify it under the terms of the \s-1GNU\s0 General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. .PP \&\fBlog2timeline\fR is distributed in the hope that it will be useful, but \s-1WITHOUT\s0 \s-1ANY\s0 \s-1WARRANTY\s0; without even the implied warranty of \s-1MERCHANTABILITY\s0 or \s-1FITNESS\s0 \s-1FOR\s0 A \s-1PARTICULAR\s0 \s-1PURPOSE\s0. See the \s-1GNU\s0 General Public License for more details. .PP You should have received a copy of the \s-1GNU\s0 General Public License along with \fBlog2timeline\fR. If not, see .