BSides talks featuring Timeliner

Volatility plugin that correlates and timestamps memory artifacts including network connections, process creation/exit times, registry key writes, and event logs into a unified timeline