Skip to content

NBTempoW V. 2.1 is a forensic tool for making timelines from block devices image files (raw, ewf,physicaldrive, etc.). It uses TSK (The Sleuthkit) and it has been developed with Lazarus V. 1.6.2 ( Delphi compatible cross-platform IDE for Rapid Application Development). It runs only in Windows. If the device image file is splitted, you can select…

master
Go to file
Code

Latest commit

 

Git stats

Files

Permalink
Failed to load latest commit information.
Type
Name
Latest commit message
Commit time
bin
 
 
lib
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

README.md

NBTEMPOW V. 2.1

NBTempoW is a forensic tool for making timelines from block devices image files (raw, ewf or \.\physicaldriveX). It uses TSK (The Sleuthkit https://www.sleuthkit.org/) and it has been developed with Lazarus V. 1.6.2 (Delphi compatible cross-platform IDE for Rapid Application Development). It runs only in Windows. If the device image file is splitted, you can select just the first chunk.

For listing physicaldrives in Windows, open CMD and write:

wmic diskdrive list brief /format:list

then you can use the physical drive ad input for NBTempoW: \.\physicaldrive0

Author: Nanni Bassetti - http://www.nannibassetti.com

About

NBTempoW V. 2.1 is a forensic tool for making timelines from block devices image files (raw, ewf,physicaldrive, etc.). It uses TSK (The Sleuthkit) and it has been developed with Lazarus V. 1.6.2 ( Delphi compatible cross-platform IDE for Rapid Application Development). It runs only in Windows. If the device image file is splitted, you can select…

Topics

Resources

License

Releases

No releases published

Languages

You can’t perform that action at this time.