Timesketch

What it is

An open-source web platform for collaborative forensic timeline analysis, hosted in Google's GitHub organization. Analysts group timelines into "sketches" and work on them together in one place.

What it helps with

- Uploading and analyzing several timelines side by side
- Searching and filtering large event sets
- Adding annotations, comments, tags, and stars to events
- Running analysis in an optional notebook container

Who it's for

DFIR analysts and incident response teams who build and review timelines together.

Worth knowing

Timesketch runs as a self-hosted server, and users work in the browser. The repo is owned by Google, but its README states it is not an official Google product. Python API and import clients are published on PyPI.

Does it create timelines itself?
It is mainly for analysis; timelines are usually produced by tools such as Plaso and then uploaded.

How does it work with Plaso, Hayabusa, or Chainsaw?
In our view they complement it: Plaso, Hayabusa, and Chainsaw extract or hunt through event data, while Timesketch is where a team reviews the combined timeline.