tinyapps.org / blog

Playback Windows events and activities via timeline tools #

(Note: This post is not about Windows 10's new Timeline feature (but don't miss Windows 10 Timeline Forensic Artefacts and WxTCmd, a parser for the Windows 10 Timeline database.))

Replay / rewind Windows events and actions to:

Unlike the lengthy forensic and incident response tools listed below, Nir Sofer's LastActiviyView runs on a live system within seconds, reporting:

In 2014, Thomas Weller combined LastActiviyView with a host of additional Nirsoft utilities to create Live System Timeline Builder, which builds a super timeline of a running Windows machine in seconds. The unified view includes results from:

While Live System Timeline Builder comes packaged as an installer, the resulting folder (%PROGRAMFILES(X86)%\WelliSolutions\LiveSystemTimeLineBuilder\) is completely portable; you just need LiveSystemTimelineBuilder.exe, EPPlus.dll, and the Providers subdirectory.

You can even update the Nirsoft apps in Providers as well (the latest RegDllView, 1.60, does not appear compatible, so stick with the included 1.58).

If you have more time to dig, there are a number of exhaustive (and time-consuming) timeline tools focused on forensics and incident response:

* Unlikely that they erased all (if any) traces.

/windows | May 11, 2018

Subscribe or visit the archives