https://github.com/evild3ad/Get-MiniTimeline
Get-MiniTimeline - Triage Collection and Timeline Generation w/ KAPE
https://github.com/evild3ad/Get-MiniTimeline
dfir digital-forensics incident-response kape powershell timeline
Last synced: 10 months ago
JSON representation
Get-MiniTimeline - Triage Collection and Timeline Generation w/ KAPE
- Host: GitHub
- URL: https://github.com/evild3ad/Get-MiniTimeline
- Owner: evild3ad
- License: mit
- Created: 2019-11-23T13:54:36.000Z (about 6 years ago)
- Default Branch: master
- Last Pushed: 2024-05-25T07:18:54.000Z (over 1 year ago)
- Last Synced: 2025-04-01T15:25:32.090Z (10 months ago)
- Topics: dfir, digital-forensics, incident-response, kape, powershell, timeline
- Language: PowerShell
- Homepage: https://lethal-forensics.com
- Size: 32.5 MB
- Stars: 30
- Watchers: 3
- Forks: 3
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
- Awesome-KAPE - Get-MiniTimeline
README
 [](LICENSE) 
# Get-MiniTimeline
Get-MiniTimeline.ps1 is a PowerShell script utilized to collect several forensic artifacts from a mounted forensic disk image and auto-generate a beautified MiniTimeline from the data collected.
Forensic Artifacts:
* Master File Table ($MFT)
* Windows Event Logs
* Windows Registry
## Download
Download the latest version of **Get-MiniTimeline** from the [Releases](https://github.com/evild3ad/Get-MiniTimeline/releases) section.
## Usage
1. Mount your forensic disk image with e.g. drive letter `G:`
Note: When your forensic disk image has multiple partitions you may have to change the path to the Windows partition.
**Fig 1:** Arsenal Image Mounter (AIM)
2. Enter your drive letter in `Get-MiniTimeline.ps1`
`Input (Source)`
`$ROOT = "G:"`
Optional: You can also change the outpath path.
`$OUTPUT_FOLDER = "$env:USERPROFILE\Desktop\MiniTimeline\$ComputerName"`
3. Run Windows PowerShell console as Administrator.
```
PS > .\Get-MiniTimeline.ps1 dateRange:MM/DD/YYYY-MM/DD/YYYY
```
**Fig 2:** Running Get-MiniTimeline.ps1 (Example)
**Fig 3:** Message Box
**Fig 4:** Timeline_Slice.xlsx - The dateRange will be auto-beautified as colorized Excel sheet
**Fig 5:** Timeline.csv - Full Timeline Analysis w/ Timeline Explorer (TLE)
## Dependencies
KAPE v1.3.0.2 (2023-01-03)
https://ericzimmerman.github.io/
https://binaryforay.blogspot.com/search?q=KAPE
https://ericzimmerman.github.io/KapeDocs/
https://www.kroll.com/kape
EvtxECmd v1.5.0.0 (.NET 6)
https://ericzimmerman.github.io/
MFTECmd v1.2.2.0 (.NET 6)
https://ericzimmerman.github.io/
RegRipper v3.0 (2020-05-28)
https://github.com/keydet89/RegRipper3.0
TLN Tools
https://github.com/mdegrazia/KAPE_Tools
https://github.com/keydet89/Tools/tree/master/exe
ImportExcel v7.8.9 (2024-05-18)
https://github.com/dfinke/ImportExcel
## Links
[SANS Webcast: Triage Collection and Timeline Generation with KAPE](https://www.youtube.com/watch?v=iYyWZSNBNcw)
[SANS DFIR Blog: Triage Collection and Timeline Generation with KAPE](https://digital-forensics.sans.org/blog/2019/08/22/triage-collection-and-timeline-generation-with-kape)
[Kroll - Express Artifact Analysis and Timeline Development with KAPE (YouTube)](https://www.youtube.com/watch?v=O5VW0Yr7guQ)
[Kroll - Express Artifact Analysis and Timeline Development with KAPE (Slides)](https://www.kroll.com/-/media/kroll/pdfs/webinars/artifact-analysis-timelining-with-kape.pdf)