ForensicTimeline Class

Syntax

public class ForensicTimeline
{
    // Properties
    public readonly DateTime Date;
    public readonly string ActivityType;
    public readonly string Source;
    public readonly string User;
    public readonly string ComputerName;
    public readonly string FileName;
    public readonly uint Index;
    public readonly string Comment;

    // Static Methods
    public static ForensicTimeline Get(Amcache input)
    public static ForensicTimeline[] GetInstances(Amcache[] input)
    public static ForensicTimeline[] Get(Prefetch input)
    public static ForensicTimeline[] GetInstances(Prefetch[] input)
    public static ForensicTimeline Get(ScheduledJob input)
    public static ForensicTimeline[] GetInstances(ScheduledJob[] input)
    public static ForensicTimeline Get(UserAssist input)
    public static ForensicTimeline[] GetInstances(UserAssist[] input)
    public static ForensicTimeline[] Get(FileRecord input)
    public static ForensicTimeline[] GetInstances(FileRecord[] input)
    public static ForensicTimeline Get(UsnJrnl input)
    public static ForensicTimeline[] GetInstances(UsnJrnl[] input)
    public static ForensicTimeline Get(NamedKey input)
    public static ForensicTimeline[] GetInstances(NamedKey[] input)
    public static string ToFriendlyString(ACTIVITY_TYPE type)
}

Properties

Date - 
ActivityType - 
Source - 
User - 
ComputerName - 
FileName - 
Index - 
Comment - 

Methods

Name	Description
Get(Amcache)
GetInstances(Amcache[])
Get(Prefetch)
GetInstances(Prefetch[])
Get(ScheduledJob)
GetInstances(ScheduledJob[])
Get(UserAssist)
GetInstances(UserAssist[])
Get(FileRecord)
GetInstances(FileRecord[])
Get(UsnJrnl)
GetInstances(UsnJrnl[])
Get(NamedKey)
GetInstances(NamedKey[])
ToFriendlyString(ACTIVITY_TYPE)