Friday, December 14, 2012

4n6time Release Notice

After what feels like a year of “not having a life”… I am happy to announce 4n6time :-)

4n6time, formally "l2t_Review", is a free, cross-platform forensic tool for timeline creation and review. Since 4n6time is powered by Kristinn Gudjonsson’s amazing plaso engine, formally log2timeline, users can now create, with a mouse, a raw timeline storage file from a disk image. Once a timeline has been created, it can be outputted to a 4n6time database (sqlite). Using 4n6time, you can then start review with the ability to filter, highlight, sort, tag, bookmark, and search on common data fields. Also included are basic reporting features as well as the ability to export subsets of data back into the CSV and timeline storage files.

Here are some highlights of 4n6time:

  • Timeline creation wizard
  • Robust filtering
  • Event tagging, bookmarking, and (auto)highlighting like eDiscovery tools
  • Interactive graphical representation of events
  • File viewing, hashing, and exporting via data source (i.e. linking timeline to disk image or mount point)
  • Basic reporting and charting
  • Appending timelines from multiple data sources (cross-host timeline analysis)
  • Ability to save work product back into timeline storage files

For more information check out the work in progress UserGuide, my blog, or go download an OSX or Windows binary from the Google Code page. Binaries for Linux an SIFT will also be released soon.


  1. While "formally" works in your sentence, I believe you are looking for "formerly" there. Otherwise, great post Dav!

  2. Davnads thank you for your great job. Do you know when are going to be available the Linux version? Thank you.

  3. thanks for sharing ...

  4. Thank you for presenting a wide variety of information that is very interesting to see in this artikle

    wisata karimunjawa
    and jual furniture
    or jepara furniture
    and toko tenun