In the world of digital forensics, raw data can often feel like a mountain of “scattered artifacts”. Without structure, a disk image is just a collection of files and metadata. To truly understand what happened during a security incident, you need to turn those artifacts into a story you can follow minute by minute. This is where timeline reconstruction becomes your most powerful investigative tool.

Using The Sleuth Kit (TSK), a suite of free, open-source tools, investigators can build a comprehensive chronology of every event on a system, providing what the sources describe as “court-grade results”.

The Goal: From Chaos to Chronology

The primary objective of this process is to take a static disk image and identify the attacker’s footprints. By sorting file system activity by time, you can witness the progression of an exploit—from the initial entry and privilege escalation to data exfiltration—in the exact order it occurred.

Step 1: Generating the Body File with fls

The first step in the reconstruction process is to extract timestamp data from the disk image. This is done using a tool called fls.

• The Process: You run the fls command with the -m flag.
• The Output: This produces what is known as a “body file”. A body file is essentially an intermediate text file that lists every file on the disk along with its associated timestamps (MAC times: Modified, Accessed, and Changed).

Example Scenario: Imagine you are investigating a suspected malware infection. You would point fls at your disk image (e.g., suspect_drive.img). By using the -m flag, the tool crawls the entire file system and creates a master list of when every single file was last touched.

Step 2: Making Data Readable with mactime

A raw body file is difficult for a human to read. To make the data useful for an investigation, you must use a second tool called mactime.

• The Process: mactime takes the body file generated in Step 1 as its input.
• The Output: It converts that raw data into a readable timeline sorted chronologically.

Example Scenario: Once you have your readable timeline, you can narrow it down to the specific window of the incident. If a server went down at 2:15 PM, you can filter your mactime output to show only the activity between 2:00 PM and 2:30 PM. This allows you to see exactly which system files were modified or which scripts were executed immediately leading up to the crash.

Conclusion: Professional Results for Free

Timeline reconstruction is the backbone of digital forensics because it provides context to the data. By using free tooling like The Sleuth Kit, investigators can achieve high-level, court-grade results that allow them to watch an attacker’s actions unfold in real-time. Whether you are a hobbyist or a professional investigator, mastering fls and mactime is essential for turning digital evidence into a coherent narrative.