Ingest The Sleuth Kit (fls) bodyfiles, Plaso super-timelines, and filesystem CSV exports in real time. Deconstruct 4-point MACB activity vectors (Modified, Accessed, Changed, Born), analyze temporal density spike histograms, and trace malware lateral movement with zero cloud uploads.
Hover or click any time bucket to filter events occurring within that cluster.
| Timestamp (UTC) | MACB | Target File / Evidence Path | Size | Inode | Artifact Type |
|---|
In digital forensics and incident response (DFIR), timeline analysis is the most decisive investigative methodology for reconstructing what occurred during a security breach. Whether investigating an advanced persistent threat (APT), a ransomware extortion event, or an insider IP theft, timestamp artifacts correlate disparate logs into a unified, chronological sequence of adversary actions.
Originally formulated for UNIX and formalised in The Sleuth Kit by Brian Carrier, the MACB model tracks the four discrete lifecycle operations a file undergoes:
Updated whenever a file's raw payload data is written or altered. In NTFS, this corresponds to writes within the $DATA stream.
Updated when a file or executable is opened, launched, or read. (Note: Modern Windows 10/11 disable NTFS last-access updates by default to boost SSD performance).
Records when a file's metadata, permissions (ACLs), file size, or MFT record itself is modified. Crucial for detecting file renaming and privilege escalation.
The birth time of the file on the volume. In NTFS, tracking discrepancies between $STANDARD_INFORMATION and $FILE_NAME exposes timestomping fraud.
| Filesystem | Timestamp Precision | Time Attributes Tracked | Forensic Nuances & Gotchas |
|---|---|---|---|
| NTFS (Windows) | 100 nanoseconds (10-7 sec) | $SI (MACB) + $FN (MACB) = 8 attributes | $SI is easily timestomped; $FN is kernel-protected and rarely forged. |
| EXT4 (Linux) | 1 nanosecond (10-9 sec) | mtime, atime, ctime, crtime (btime) | Inode ctime updates on every chmod, chown, or link alteration. |
| APFS (Apple macOS) | 1 nanosecond (10-9 sec) | Modified, Accessed, Changed, Created | Includes clone and snapshot delta tracking for point-in-time state. |
| FAT32 (Legacy / USB) | 2 seconds (Modify), 1 day (Access) | Created, Modified, Accessed | Low resolution makes micro-sequencing impossible; vulnerable to timezone skew. |
MD5|name|inode|mode_as_string|UID|GID|size|atime|mtime|ctime|crtime. It provides a lightweight, standardized representation of an entire storage volume that can be ingested into timeline tools like mactime and this visualizer.