irflow-timeline v1.0.8
DFIR Timeline Analysis for macOS — SQLite-backed viewer for CSV, TSV, XLSX, EVTX, Plaso, $MFT, and $J files with AI Artifacts, AI Secret Hunt, process inspection, lateral movement tracking, persistence detection, and VirusTotal enrichment.
IRFlow Timeline
Native macOS forensic timeline analysis. Import, search, and investigate EVTX, CSV, XLSX, Plaso, $MFT, $J, and local AI assistant artifacts — with AI Secret Hunt and the analytics DFIR professionals actually need. Built on Electron + SQLite to handle millions of rows without breaking a sweat.
Inspired by Eric Zimmerman's Timeline Explorer for Windows.
Key Features
- AI Artifacts — Collect local AI history from Claude Code, Codex, ChatGPT Desktop, Gemini CLI, Cursor, Copilot, Windsurf, and Continue into one timeline tab; AI Secret Hunt for exposed keys, tokens, and credentials
- Raw NTFS Artifact Import — Direct ingestion of
$MFTand$UsnJrnl($J) with full path reconstruction, SI/FN timestamps, and change reason mapping - Ransomware Analytics — Automated impact analysis from
$MFTdata: bulk rename detection, entropy-based extension analysis, ransom note identification, and temporal clustering - VirusTotal Enrichment — IOC matching with bulk VT lookups, malware family extraction, verdict badges, relationship pivoting, and local caching
- Process Inspector — Parent-child process tree analysis with 340+ MITRE ATT&CK detection rules
- Lateral Movement Tracker — Network logon and RDP session visualization as interactive force-directed graphs
- RDP Bitmap Cache Recovery — Recover
bcache*.bmcandcache????.binartifacts with bundled bmc-tools, preview images, and export evidence packages - Persistence Analyzer — 30+ persistence techniques with account chain detection, cross-technique correlation, and PowerShell 4104 script block reassembly
- IOC Matching — 17+ indicator categories with auto-defanging, inline highlighting, CSV/HTML export with VT enrichment data
For the full feature list and documentation, visit the IRFlow Timeline Docs.
Building from Source
Prerequisites (for developers only):
- Node.js 18+:
brew install node - Xcode CLI tools:
xcode-select --install(for native module compilation) - macOS 12+ (Monterey or later)
git clone https://github.com/r3nzsec/irflow-timeline.git
cd irflow-timeline
npm install
npx electron-rebuild -f -w better-sqlite3
# Development (hot-reload)
npm run dev
# Build + launch
npm run start
# Package as universal DMG
npm run dist:universal
Output in release/.
Credits & Acknowledgments
Inspired by Eric Zimmerman's Timeline Explorer.
Open Source Projects
| Project | Usage | Link |
|---|---|---|
| Electron | Application framework | electron/electron |
| better-sqlite3 | High-performance SQLite engine with WAL mode, FTS5 | WiseLibs/better-sqlite3 |
| @ts-evtx/core | Native Windows EVTX event log parsing | NickSmet/ts-evtx |
| Plaso (log2timeline) | Forensic timeline generation (we import Plaso SQLite output) | log2timeline/plaso |
| ExcelJS | XLSX streaming reader | exceljs/exceljs |
| SheetJS (xlsx) | XLSX parsing | SheetJS/sheetjs |
| csv-parser | CSV/TSV streaming parser | mafintosh/csv-parser |
| React | UI rendering | facebook/react |
| Vite | Build tooling and hot-reload | vitejs/vite |
| VitePress | Documentation site | vuejs/vitepress |
| electron-builder | macOS DMG packaging | electron-userland/electron-builder |
| bmc-tools | RDP Bitmap Cache recovery | ANSSI-FR/bmc-tools |
DFIR Community
- Eric Zimmerman -- Timeline Explorer for Windows, the original inspiration for this project
- log2timeline/Plaso -- Super timeline generation framework by Kristinn Gudjonsson and contributors
- SANS DFIR -- DFIR training and community resources
- The DFIR Report -- Real-world intrusion analysis reports that informed threat detection patterns
- CyberCX -- NTFS $UsnJrnl research that informed $J parsing implementation
Beta Testers
Thanks to the following people for testing and providing feedback:
License
Apache-2.0