<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>IR and forensic talk &#187; mactime</title>
	<atom:link href="http://blog.kiddaland.net/tag/mactime/feed/" rel="self" type="application/rss+xml" />
	<link>http://blog.kiddaland.net</link>
	<description>Some useless talk mixed with hopefully interesting points every now and then</description>
	<lastBuildDate>Fri, 27 Aug 2010 09:49:44 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.0.1</generator>
		<item>
		<title>Small updates</title>
		<link>http://blog.kiddaland.net/2010/02/small-updates/</link>
		<comments>http://blog.kiddaland.net/2010/02/small-updates/#comments</comments>
		<pubDate>Wed, 17 Feb 2010 14:23:48 +0000</pubDate>
		<dc:creator>kiddi</dc:creator>
				<category><![CDATA[Forensics]]></category>
		<category><![CDATA[Timeline analysis]]></category>
		<category><![CDATA[flash cookies]]></category>
		<category><![CDATA[local shared object]]></category>
		<category><![CDATA[log2timeline]]></category>
		<category><![CDATA[lso]]></category>
		<category><![CDATA[mactime]]></category>
		<category><![CDATA[private browsing]]></category>
		<category><![CDATA[standard for timeline analysis]]></category>
		<category><![CDATA[tln]]></category>

		<guid isPermaLink="false">http://blog.kiddaland.net/?p=223</guid>
		<description><![CDATA[Just recently saw a post at Slashdot about Adobe implementing private browsing in their Flash Player.  That means that when the user starts private browsing mode in their web browsers LSO files will not be stored on disk.  This is implemented in the way that during the private browser session all Flash cookies are stored [...]]]></description>
		<wfw:commentRss>http://blog.kiddaland.net/2010/02/small-updates/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>log2timeline, artifact timeline analysis &#8211; Part I</title>
		<link>http://blog.kiddaland.net/2009/08/log2timeline-artifact-timeline-analysis-part-i/</link>
		<comments>http://blog.kiddaland.net/2009/08/log2timeline-artifact-timeline-analysis-part-i/#comments</comments>
		<pubDate>Sat, 01 Aug 2009 09:11:24 +0000</pubDate>
		<dc:creator>kiddi</dc:creator>
				<category><![CDATA[Forensics]]></category>
		<category><![CDATA[Network Analysis]]></category>
		<category><![CDATA[Timeline analysis]]></category>
		<category><![CDATA[Windows Analysis]]></category>
		<category><![CDATA[artifact analysis]]></category>
		<category><![CDATA[artifacts]]></category>
		<category><![CDATA[body file]]></category>
		<category><![CDATA[log2timeline]]></category>
		<category><![CDATA[mactime]]></category>
		<category><![CDATA[timeline]]></category>

		<guid isPermaLink="false">http://blog.kiddaland.net/?p=70</guid>
		<description><![CDATA[Update 1 Updated one command (according to a comment) and text regarding availability of comparable tools updated according to a post that I just posted on the SANS forensic blog &#160; Timeline analysis can be extremely useful during any investigation.  Although traditional file system timeline can be very helpful it sometimes misses important events that [...]]]></description>
		<wfw:commentRss>http://blog.kiddaland.net/2009/08/log2timeline-artifact-timeline-analysis-part-i/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
	</channel>
</rss>
