NBTempoW V. 2.1 is a forensic tool for making timelines from block devices image files (raw, ewf,physicaldrive, etc.). It uses TSK (The Sleuthkit) and it has been developed with Lazarus V. 1.6.2 ( Delphi compatible cross-platform IDE for Rapid Application Development). It runs only in Windows. If the device image file is splitted, you can select…
Pascal
Switch branches/tags
Nothing to show
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Failed to load latest commit information.
bin
lib
licenses
LICENSE
README.md
nbtempo1.lfm
nbtempo1.lrs
nbtempo1.pas
nbtempow.exe
nbtempow.ico
nbtempow.lpi
nbtempow.lpr
nbtempow.lps
nbtempow.res

README.md

NBTEMPOW V. 2.1

NBTempoW is a forensic tool for making timelines from block devices image files (raw, ewf or \.\physicaldriveX). It uses TSK (The Sleuthkit https://www.sleuthkit.org/) and it has been developed with Lazarus V. 1.6.2 (Delphi compatible cross-platform IDE for Rapid Application Development). It runs only in Windows. If the device image file is splitted, you can select just the first chunk.

For listing physicaldrives in Windows, open CMD and write:

wmic diskdrive list brief /format:list

then you can use the physical drive ad input for NBTempoW: \.\physicaldrive0

Author: Nanni Bassetti - http://www.nannibassetti.com