timeline
Walk a forensic disk image's file system to build a chronological view between start and end times, filtered by path regex and file kinds.
Instructions
File-system timeline (directory walk) between start/end (ISO, image timezone), optionally filtered by path regex. kinds: m a c b.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| end | No | ||
| part | No | ||
| image | Yes | ||
| kinds | No | mcb | |
| limit | No | ||
| start | No | ||
| path_regex | No | ||
| include_deleted | No |