NAME

       reglookup-timeline - Windows NT+ registry MTIME timeline generator

SYNOPSIS

       reglookup-timeline [-H] registry-file [registry-file ...]

DESCRIPTION

       This script is a wrapper for reglookup(1), and reads one or more registry files to produce
       an  MTIME-sorted  output.  This  is  helpful  when   building   timelines   for   forensic
       investigations.

PARAMETERS

       reglookup-timeline accepts one or more registry file names. All of the provided registries
       will be parsed using reglookup(1). The -H option may be used to omit the header line.

OUTPUT

       reglookup-timeline generates a comma-separated values (CSV) compatible format  to  stdout.
       While  the  output  of reglookup-timeline and reglookup(1) differ in the columns returned,
       the base format is the same.

       Currently, reglookup-timeline returns three columns: MTIME,  FILE,  and  PATH.  Only  rows
       representing  registry keys are returned, since MTIMEs are not stored for values. The FILE
       column indicates which registry file (provided as an argument) the key came from. Finally,
       the  PATH field contains the full registry path to the key. Records are returned sorted in
       ascending order based on the MTIME column.

BUGS

       This script is new, and as such it's interface may change significantly over the next  few
       revisions.  In  particular,  additional command line options will likely be added, and the
       output of the script may be altered in minor ways.

       It is very difficult to find documentation on what precise operations cause the MTIMEs  to
       be  updated.  Basic  experimentation  indicates  that  a key's stamp is updated anytime an
       immediate sub-value or sub-key is created, renamed, deleted, or it's value is modified. If
       this  MTIME  data  is  critical  to  an investigation, any conclusions should be validated
       through experimentation in a controlled lab environment.

       This software should be considered unstable at this time.

CREDITS

       This script was written by Timothy D. Morgan based on suggestions from Uwe Danz.

       Please see source code for a full list of copyrights.

LICENSE

       Please see the file "LICENSE" included with this software distribution.

       This program is distributed in the hope that it will be useful, but WITHOUT ANY  WARRANTY;
       without  even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
       See the GNU General Public License version 3 for more details.

SEE ALSO

       reglookup(1) reglookup-recover(1)