Forensic-timeliner: A Windows Forensics Tool for DFIR Investigators

Forensic-Timeliner is a fast, open-source command-line tool designed to help digital forensics and incident response (DFIR) teams quickly build a unified timeline of Windows artifacts. By automatically collecting, filtering, and merging CSV output from popular triage tools, it creates a mini timeline ready for analysis in Timeline Explorer or Excel, as reported by Security Researchers.

It scans a base directory for CSV files from tools such as EZ Tools, Kape, Axiom, Chainsaw, Hayabusa, and Nirsoft, merging data from Amcache, Event Logs, MFT, Prefetch, JumpLists, shellbags, and browser histories into a single timeline. Outputs can be exported as CSV, JSON, or JSONL, with the CSV format remaining RFC-4180 compliant for compatibility with other tools.

The project supports default YAML settings, keyword tagging via a YAML file, and an interactive CLI with a preview of filters before processing, and it can create a .tle_sess Timeline Explorer session when tagging is enabled. The latest release is v2.2 or newer, and installation involves downloading ForensicTimeliner.exe from the GitHub releases page, then running commands such as ForensicTimeliner.exe --Interactive or --BaseDir with specified output paths, as of 29 September 2025.