IRFlow Timeline
Native macOS forensic timeline analysis. Import, search, and investigate EVTX, CSV, XLSX, Plaso, $MFT, $J, and local AI assistant artifacts — with AI Secret Hunt and the analytics DFIR professionals actually need. Built on Electron + SQLite to handle millions of rows without breaking a sweat.
Inspired by Eric Zimmerman’s Timeline Explorer for Windows.
Key Features
- AI Artifacts — Collect local AI history from Claude Code, Codex, Grok Build, ChatGPT Desktop, Gemini CLI, Cursor, Copilot, Windsurf, and Continue into one timeline tab; ChatGPT Computer History for macOS interaction telemetry; AI Secret Hunt for exposed keys, tokens, and credentials
- Raw NTFS Artifact Import — Direct ingestion of
$MFT and $UsnJrnl ($J) with full path reconstruction, SI/FN timestamps, and change reason mapping
- Ransomware Analytics — Automated impact analysis from
$MFT data: bulk rename detection, entropy-based extension analysis, ransom note identification, and temporal clustering
- VirusTotal Enrichment — IOC matching with bulk VT lookups, malware family extraction, verdict badges, relationship pivoting, and local caching
- Process Inspector — Parent-child process tree analysis with 340+ MITRE ATT&CK detection rules
- Lateral Movement Tracker — Network logon and RDP session visualization as interactive force-directed graphs
- RDP Bitmap Cache Recovery — Recover
bcache*.bmc and cache????.bin artifacts with bundled bmc-tools, preview images, and export evidence packages
- Persistence Analyzer — 30+ persistence techniques with account chain detection, cross-technique correlation, and PowerShell 4104 script block reassembly
- IOC Matching — 17+ indicator categories with auto-defanging, inline highlighting, CSV/HTML export with VT enrichment data
For the full feature list and documentation, visit the IRFlow Timeline Docs.
Building from Source
Prerequisites (for developers only):
- Node.js 22.14+:
brew install node
- Xcode CLI tools:
xcode-select --install (for native module compilation)
- macOS 12+ (Monterey or later)
git clone https://github.com/r3nzsec/irflow-timeline.git
cd irflow-timeline
npm install
npx electron-rebuild -f -w better-sqlite3
# Development (hot-reload)
npm run dev
# Build + launch
npm run start
# Package as universal DMG
npm run dist:universal
Output in release/.
Credits & Acknowledgments
Inspired by Eric Zimmerman’s Timeline Explorer.
Open Source Projects
- Eric Zimmerman – Timeline Explorer for Windows, the original inspiration for this project
- log2timeline/Plaso – Super timeline generation framework by Kristinn Gudjonsson and contributors
- SANS DFIR – DFIR training and community resources
- The DFIR Report – Real-world intrusion analysis reports that informed threat detection patterns
- CyberCX – NTFS $UsnJrnl research that informed $J parsing implementation
Beta Testers
Thanks to the following people for testing and providing feedback:
License
Apache-2.0
评论