fs_timeline
Generate a file system MAC timeline from a disk image and extract the most recent file activity for forensic analysis.
Instructions
Generate a file system MAC timeline body and parse the most recent activity (fls -m + mactime).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| image | Yes | ||
| offset | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |