User documentation

• How to get started
  • How to get started
  • Installing the packaged release
  • Before we start
    • I know the good old Perl version
  • The tools
    • image_export
    • log2timeline
    • pinfo
    • psort
    • psteal
• Creating a timeline
  • Using psteal
• Troubleshooting
  • Quick list
  • Isolating errors
  • Producing debug logs
  • Import errors
  • Crashes, hangs and tracebacks
    • A worker segfault-ing
    • A worker gives a killed status
    • Which processes are running
    • Analyzing crashes with single process and debug mode
    • Analyzing crashes with gdb
  • High memory usage
  • Also see
• Using collection Filters
  • Using Forensic Artifacts definitions
  • Using filter files
    • Text-based filter file format
    • YAML-based filter file format
  • References
• Event filters
  • How do event filters work
  • Example event filter expressions
  • References
• Analysis plugins
• Tips and Tricks
  • analyzeMFT and plaso
  • Split the output of psort
• Log2Timeline Perl (Legacy)
  • Old method
  • New method