IRFlow Timeline

Native macOS forensic timeline analysis. Import, search, and investigate EVTX, CSV, XLSX, Plaso, $MFT, $J, and local AI assistant artifacts — with AI Secret Hunt and the analytics DFIR professionals actually need. Built on Electron + SQLite to handle millions of rows without breaking a sweat.

Inspired by Eric Zimmerman's Timeline Explorer for Windows.

Key Features

• AI Artifacts — Collect local AI history from Claude Code, Codex, ChatGPT Desktop, Gemini CLI, Cursor, Copilot, Windsurf, and Continue into one timeline tab; AI Secret Hunt for exposed keys, tokens, and credentials
• Raw NTFS Artifact Import — Direct ingestion of $MFT and $UsnJrnl ($J) with full path reconstruction, SI/FN timestamps, and change reason mapping
• Ransomware Analytics — Automated impact analysis from $MFT data: bulk rename detection, entropy-based extension analysis, ransom note identification, and temporal clustering
• VirusTotal Enrichment — IOC matching with bulk VT lookups, malware family extraction, verdict badges, relationship pivoting, and local caching
• Process Inspector — Parent-child process tree analysis with 340+ MITRE ATT&CK detection rules
• Lateral Movement Tracker — Network logon and RDP session visualization as interactive force-directed graphs
• RDP Bitmap Cache Recovery — Recover bcache*.bmc and cache????.bin artifacts with bundled bmc-tools, preview images, and export evidence packages
• Persistence Analyzer — 30+ persistence techniques with account chain detection, cross-technique correlation, and PowerShell 4104 script block reassembly
• IOC Matching — 17+ indicator categories with auto-defanging, inline highlighting, CSV/HTML export with VT enrichment data

For the full feature list and documentation, visit the IRFlow Timeline Docs.

Building from Source

Prerequisites (for developers only):

• Node.js 18+: brew install node
• Xcode CLI tools: xcode-select --install (for native module compilation)
• macOS 12+ (Monterey or later)

git clone https://github.com/r3nzsec/irflow-timeline.git
cd irflow-timeline
npm install
npx electron-rebuild -f -w better-sqlite3

# Development (hot-reload)
npm run dev

# Build + launch
npm run start

# Package as universal DMG
npm run dist:universal

Output in release/.

Credits & Acknowledgments

Inspired by Eric Zimmerman's Timeline Explorer.

Open Source Projects

DFIR Community

• Eric Zimmerman -- Timeline Explorer for Windows, the original inspiration for this project
• log2timeline/Plaso -- Super timeline generation framework by Kristinn Gudjonsson and contributors
• SANS DFIR -- DFIR training and community resources
• The DFIR Report -- Real-world intrusion analysis reports that informed threat detection patterns
• CyberCX -- NTFS $UsnJrnl research that informed $J parsing implementation

Beta Testers

Thanks to the following people for testing and providing feedback:

• Maddy Keller
• Omar Jbari
• Nicolas Bareil
• Dominic Rathmann
• Chip Riley

License

Apache-2.0