About Andrew Hay

Andrew Hay is an information security industry veteran with close to 20 years of experience as a security practitioner, industry analyst, and executive. As the Chief Information Security Officer (CISO) at DataGravity, Inc., he advocates for the company’s total information security needs and is responsible for the development and delivery of the company’s comprehensive information security strategy.

Andrew has served in various roles and responsibilities at a number of companies including OpenDNS (now a Cisco company), CloudPassage, Inc., 451 Research, the University of Lethbridge, Capital G Bank Ltd. (now Clarien Bank Bermuda), Q1 Labs (now IBM), Nokia (now Check Point), Nortel Networks, Magma Communications (now Primus Canada), and Taima Corp (now Convergys).

Andrew is frequently approached to provide expert commentary on security-industry developments, and has been featured in such publications as Forbes, Bloomberg, Wired, USA Today, International Business Times, Sacramento Bee, Delhi Daily News, Austin Business Journal, Ars Technica, RT, VentureBeat, LeMondeInformatique, eWeek, TechRepublic, Infosecurity Magazine, The Data Center Journal, TechTarget, Network World, Computerworld, PCWorld, and CSO Magazine.

Installing log2timeline on SIFT – Updated Instructions for Ease of Use

If you use the SANS Investigative Forensic Toolkit (SIFT) Workstation for your forensic analysis you can easily add log2timeline to your VMware guest image. In order to get these files using the wget, yum, and cpan methods you must ensure that your SIFT workstation has its interface set to ‘bridged’ or ‘NAT’ mode so that it can get out to the Internet.

Steps to Install log2timeline on SIFT

1. Download the log2timeline archive to your SIFT workstation
[root@SIFTWorkstation ~]# wget http://log2timeline.net/files/log2timeline_0.33b.tgz

2. Extract the archive
[root@SIFTWorkstation ~]# tar zxvf log2timeline_0.33b.tgz

3. Change to the log2timeline directory
[root@SIFTWorkstation ~]# cd log2timeline

4. Install some of the dependancies using yum
[root@SIFTWorkstation ~]# yum install perl-DateTime perl-Net-Pcap perl-Archive-Zip perl-HTML-Scrubber perl-Image-ExifTool perl-Glib

5. Install the NetPacket::Ethernet module
[root@SIFTWorkstation ~]# perl -MCAPNPLUS -e 'install NetPacket::Ethernet'

6. Install the ExtUtils::Depends and ExtUtils::PkgConfig modules
[root@SIFTWorkstation ~]# perl -MCPANPLUS -e 'install ExtUtils::Depends'
[root@SIFTWorkstation ~]# perl -MCPANPLUS -e 'install ExtUtils::PkgConfig'

7. Install the Glib, Cairo, Pango, and Gtk2 modules
[root@SIFTWorkstation ~]# perl -MCPANPLUS -e 'install Glib'
[root@SIFTWorkstation ~]# perl -MCPANPLUS -e 'install Cairo'
[root@SIFTWorkstation ~]# perl -MCPANPLUS -e 'install Pango'
[root@SIFTWorkstation ~]# perl -MCPANPLUS -e 'install Gtk2'

8. Compile log2timeline
[root@SIFTWorkstation log2timeline]# perl Makefile.PL && make && make install

9. Execute the log2timeline script using the ‘-f list’ flag to test the installation
[root@SIFTWorkstation log2timeline]# log2timeline -f list

That’s it. If the log2timeline -f list command displayed all available log file formats you should be good to go. In my experience, if a particular module is missing you will receive an error when running this file (in a different place depending on what is missing).

Now you should probably take a snapshot of your SIFT image so that you don’t revert back and lose your log2timeline application. If you would like more information on log2timeline there is a great article here: http://blogs.sans.org/computer-forensics/2009/08/13/artifact-timeline-creation-and-analysis-tool-release-log2timeline/ and the log2timeline project page can be found here: http://log2timeline.net/.

Andrew Hay