AutoTimeliner Automagically extract forensic timeline from volatile memory dump Requirements Python Volatility mactime (from SleuthKit)