Finding date of backup from log2timeline csv file
I was given a log2timeline .csv output and asked when the laptop was reimaged. Uhhhhhh. What do to? A coworker suggested graphing the dates from the log2timeline entries. Sure enough there was a clear delineation of when the dates stopped jumping and became a sloped line of steady entries. I would have never thought to graph the dates!