Native macOS forensic timeline analysis. Import, search, and investigate EVTX, CSV, XLSX, Plaso, $MFT, $J, and local AI assistant artifacts — with AI Secret Hunt and the analytics DFIR professionals actually need. Built on Electron + SQLite to handle millions of rows without breaking a sweat.
Inspired by Eric Zimmerman's Timeline Explorer for Windows.
- AI Artifacts — Collect local AI history from Claude Code, Codex, Grok Build, ChatGPT Desktop, Gemini CLI, Cursor, Copilot, Windsurf, and Continue into one timeline tab; ChatGPT Computer History for macOS interaction telemetry; AI Secret Hunt for exposed keys, tokens, and credentials
- Raw NTFS Artifact Import — Direct ingestion of
$MFTand$UsnJrnl($J) with full path reconstruction, SI/FN timestamps, and change reason mapping - Ransomware Analytics — Automated impact analysis from
$MFTdata: bulk rename detection, entropy-based extension analysis, ransom note identification, and temporal clustering - VirusTotal Enrichment — IOC matching with bulk VT lookups, malware family extraction, verdict badges, relationship pivoting, and local caching
- Process Inspector — Parent-child process tree analysis with 340+ MITRE ATT&CK detection rules
- Lateral Movement Tracker — Network logon and RDP session visualization as interactive force-directed graphs
- RDP Bitmap Cache Recovery — Recover
bcache*.bmcandcache????.binartifacts with bundled bmc-tools, preview images, and export evidence packages - Persistence Analyzer — 30+ persistence techniques with account chain detection, cross-technique correlation, and PowerShell 4104 script block reassembly
- IOC Matching — 17+ indicator categories with auto-defanging, inline highlighting, CSV/HTML export with VT enrichment data
For the full feature list and documentation, visit the IRFlow Timeline Docs.
Prerequisites (for developers only):
- Node.js 22.14+:
brew install node - Xcode CLI tools:
xcode-select --install(for native module compilation) - macOS 12+ (Monterey or later)
git clone https://github.com/r3nzsec/irflow-timeline.git
cd irflow-timeline
npm install
npx electron-rebuild -f -w better-sqlite3
# Development (hot-reload)
npm run dev
# Build + launch
npm run start
# Package as universal DMG
npm run dist:universalOutput in release/.
Inspired by Eric Zimmerman's Timeline Explorer.
| Project | Usage | Link |
|---|---|---|
| Electron | Application framework | electron/electron |
| better-sqlite3 | High-performance SQLite engine with WAL mode, FTS5 | WiseLibs/better-sqlite3 |
| @ts-evtx/core | Native Windows EVTX event log parsing | NickSmet/ts-evtx |
| Plaso (log2timeline) | Forensic timeline generation (we import Plaso SQLite output) | log2timeline/plaso |
| ExcelJS | XLSX streaming reader | exceljs/exceljs |
| SheetJS (xlsx) | XLSX parsing | SheetJS/sheetjs |
| csv-parser | CSV/TSV streaming parser | mafintosh/csv-parser |
| React | UI rendering | facebook/react |
| Vite | Build tooling and hot-reload | vitejs/vite |
| VitePress | Documentation site | vuejs/vitepress |
| electron-builder | macOS DMG packaging | electron-userland/electron-builder |
| bmc-tools | RDP Bitmap Cache recovery | ANSSI-FR/bmc-tools |
- Eric Zimmerman -- Timeline Explorer for Windows, the original inspiration for this project
- log2timeline/Plaso -- Super timeline generation framework by Kristinn Gudjonsson and contributors
- SANS DFIR -- DFIR training and community resources
- The DFIR Report -- Real-world intrusion analysis reports that informed threat detection patterns
- CyberCX -- NTFS $UsnJrnl research that informed $J parsing implementation
Thanks to the following people for testing and providing feedback:
Apache-2.0