<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>IR and forensic talk &#187; Timeline analysis</title>
	<atom:link href="http://blog.kiddaland.net/tag/timeline-analysis/feed/" rel="self" type="application/rss+xml" />
	<link>http://blog.kiddaland.net</link>
	<description>Some useless talk mixed with hopefully interesting points every now and then</description>
	<lastBuildDate>Sat, 01 Oct 2011 01:06:05 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.2.1</generator>
		<item>
		<title>SANS summit and gold paper</title>
		<link>http://blog.kiddaland.net/2010/08/sans-summit-and-gold-paper/</link>
		<comments>http://blog.kiddaland.net/2010/08/sans-summit-and-gold-paper/#comments</comments>
		<pubDate>Fri, 27 Aug 2010 09:49:44 +0000</pubDate>
		<dc:creator>kiddi</dc:creator>
				<category><![CDATA[Forensics]]></category>
		<category><![CDATA[gcfa]]></category>
		<category><![CDATA[gold paper]]></category>
		<category><![CDATA[log2timeline]]></category>
		<category><![CDATA[sans eu forensics summit]]></category>
		<category><![CDATA[summit]]></category>
		<category><![CDATA[Timeline analysis]]></category>

		<guid isPermaLink="false">http://blog.kiddaland.net/?p=290</guid>
		<description><![CDATA[Well, its been quite a while since my last post, summer vacation coupled with paternity leave gave me a pleasant absence from the computer screen. But I&#8217;m back now, and surprisingly my gold paper got finally been published.  The title of the paper is &#8220;Mastering the Super Timeline With log2timeline&#8221;, and for those that carefully [...]]]></description>
		<wfw:commentRss>http://blog.kiddaland.net/2010/08/sans-summit-and-gold-paper/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>Timeline Analysis 101</title>
		<link>http://blog.kiddaland.net/2010/05/timeline-analysis-101/</link>
		<comments>http://blog.kiddaland.net/2010/05/timeline-analysis-101/#comments</comments>
		<pubDate>Fri, 28 May 2010 15:12:48 +0000</pubDate>
		<dc:creator>kiddi</dc:creator>
				<category><![CDATA[Forensics]]></category>
		<category><![CDATA[Timeline analysis]]></category>
		<category><![CDATA[guide]]></category>
		<category><![CDATA[howto]]></category>
		<category><![CDATA[log2timeline]]></category>
		<category><![CDATA[sleuthkit]]></category>
		<category><![CDATA[super timeline]]></category>
		<category><![CDATA[timescanner]]></category>

		<guid isPermaLink="false">http://blog.kiddaland.net/?p=251</guid>
		<description><![CDATA[I recently got the question of how to start with your timeline analysis.  And usually when someone finally asks you the question, you know that there are quite a lot of others that have absolutely no idea how to go about such analysis yet somehow don&#8217;t have the guts to ask.  Therefore for those that [...]]]></description>
		<wfw:commentRss>http://blog.kiddaland.net/2010/05/timeline-analysis-101/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Timelines, again</title>
		<link>http://blog.kiddaland.net/2010/03/timelines-again/</link>
		<comments>http://blog.kiddaland.net/2010/03/timelines-again/#comments</comments>
		<pubDate>Tue, 23 Mar 2010 09:45:31 +0000</pubDate>
		<dc:creator>kiddi</dc:creator>
				<category><![CDATA[Forensics]]></category>
		<category><![CDATA[Timeline analysis]]></category>
		<category><![CDATA[aftertime]]></category>
		<category><![CDATA[log2timeline]]></category>

		<guid isPermaLink="false">http://blog.kiddaland.net/?p=233</guid>
		<description><![CDATA[I forgot to mention Aftertime in my last blog post, which is a new tool to create and analyse timelines.  Rob pointed this tool to me the other day, and I&#8217;ve done some limited testing on it.  It is very easy to create the timeline, just add the image file and let it crunch through [...]]]></description>
		<wfw:commentRss>http://blog.kiddaland.net/2010/03/timelines-again/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Timeline analysis, links and discussion</title>
		<link>http://blog.kiddaland.net/2010/03/timeline-analysis-links-and-discussion/</link>
		<comments>http://blog.kiddaland.net/2010/03/timeline-analysis-links-and-discussion/#comments</comments>
		<pubDate>Mon, 22 Mar 2010 23:04:38 +0000</pubDate>
		<dc:creator>kiddi</dc:creator>
				<category><![CDATA[Forensics]]></category>
		<category><![CDATA[Timeline analysis]]></category>
		<category><![CDATA[log2timeline]]></category>
		<category><![CDATA[super timeline]]></category>
		<category><![CDATA[timeline]]></category>

		<guid isPermaLink="false">http://blog.kiddaland.net/?p=230</guid>
		<description><![CDATA[Timeline analysis has been getting a lot of press lately.  Harlan discussed some of the sources and usability of timeline analysis in a recent blog post. And then you&#8217;ve got few posts that describe how to create timelines, both from a live Windows machine, and from registry files. Rob Lee also posted a blog about [...]]]></description>
		<wfw:commentRss>http://blog.kiddaland.net/2010/03/timeline-analysis-links-and-discussion/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>log2timeline updated</title>
		<link>http://blog.kiddaland.net/2010/03/log2timeline-updated-2/</link>
		<comments>http://blog.kiddaland.net/2010/03/log2timeline-updated-2/#comments</comments>
		<pubDate>Sat, 06 Mar 2010 16:19:34 +0000</pubDate>
		<dc:creator>kiddi</dc:creator>
				<category><![CDATA[Forensics]]></category>
		<category><![CDATA[Timeline analysis]]></category>
		<category><![CDATA[log2timeline]]></category>
		<category><![CDATA[sans eu forensics summit]]></category>
		<category><![CDATA[sift]]></category>
		<category><![CDATA[summit]]></category>
		<category><![CDATA[update to log2timeline]]></category>

		<guid isPermaLink="false">http://blog.kiddaland.net/?p=226</guid>
		<description><![CDATA[I&#8217;ve just released a new version of log2timeline, version 0.42.  The new version includes two new input modules, one for extracting timestamps from PDF metadata and another one from McAfee anti-virus log files.  The new version also includes several bug fixes, the full changelog can be read here. The development focus will be to move [...]]]></description>
		<wfw:commentRss>http://blog.kiddaland.net/2010/03/log2timeline-updated-2/feed/</wfw:commentRss>
		<slash:comments>5</slash:comments>
		</item>
		<item>
		<title>Small updates</title>
		<link>http://blog.kiddaland.net/2010/02/small-updates/</link>
		<comments>http://blog.kiddaland.net/2010/02/small-updates/#comments</comments>
		<pubDate>Wed, 17 Feb 2010 14:23:48 +0000</pubDate>
		<dc:creator>kiddi</dc:creator>
				<category><![CDATA[Forensics]]></category>
		<category><![CDATA[Timeline analysis]]></category>
		<category><![CDATA[flash cookies]]></category>
		<category><![CDATA[local shared object]]></category>
		<category><![CDATA[log2timeline]]></category>
		<category><![CDATA[lso]]></category>
		<category><![CDATA[mactime]]></category>
		<category><![CDATA[private browsing]]></category>
		<category><![CDATA[standard for timeline analysis]]></category>
		<category><![CDATA[tln]]></category>

		<guid isPermaLink="false">http://blog.kiddaland.net/?p=223</guid>
		<description><![CDATA[Just recently saw a post at Slashdot about Adobe implementing private browsing in their Flash Player.  That means that when the user starts private browsing mode in their web browsers LSO files will not be stored on disk.  This is implemented in the way that during the private browser session all Flash cookies are stored [...]]]></description>
		<wfw:commentRss>http://blog.kiddaland.net/2010/02/small-updates/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>

