DFIRHub

MiniTimelineCollection

MFT, Registry and Event Logs to generate a mini timeline

  • Compound
  • 70 paths from 10 artifacts
  • Per-user data
  • Version 1
  • Mari DeGrazia

Paths on disk

70 paths from 10 targets

Paths use Windows environment variable syntax

Includes 3 targets

Each one is collected with this target