- Home
- Digital Forensics Software
- Timesketch
Timesketch
What it is
Timesketch is a free, open-source tool for collaborative forensic timeline analysis. A sketch generally represents one case and can contain multiple timelines, views, comments, and stories. Users can search and filter timeline data, inspect it in charts, and save findings as views. Sketches can be shared with individuals, groups, all system users, or kept private. Supported imports include Plaso storage files, CSV, and JSON, with additional evidence sources such as JSONL, Pandas DataFrame, Python dict, and XLS/XLSX. Python analyzers run in background workers to enrich data, tag events, or create saved views. Documented integrations include Sigma, Google Safe Browsing, BigQuery, Yeti, and HashR; Sigma support is marked alpha with known issues. Timesketch provides a web interface, REST API, and command-line client. Docker is the only tested and actively maintained installation method, with Ubuntu 22.04 and at least 8 GB of RAM required by the guide. Export formats include CSV, JSONL, ZIP, and Markdown.
For and against
For
- Free open-source software
- Collaborative case sketches
- Web interface, REST API, and CLI
- Multiple timeline import formats
- CSV, JSONL, ZIP, and Markdown exports
Against
- Docker is the only tested maintained installation method
- Requires Ubuntu 22.04 and 8 GB RAM
- Sigma integration is alpha
- Searches can fail beyond 150 indices
The verdict
Timesketch brings collaborative case organization, search, analyzers, and several interfaces to forensic timeline work. Its infrastructure requirements and documented index limitation should be considered before deployment.
Who it suits
Timesketch suits forensic teams analyzing timeline evidence collaboratively. It is intended for users comfortable with self-hosted Docker deployment and the listed Linux requirements.
Plans and prices
Timesketch
Open-source tool · self-hosted installation
Read 9 Oct 2026 · timesketch.org
On the record
- Analyzers
- Python analyzers run in background workers to enrich timeline data and can tag events or create saved views.timesketch.org · read 9 Oct 2026
- API and CLI
- Timesketch provides a web interface and REST API, plus a command-line client for searching, filtering, uploading timelines, and running analyzers.timesketch.org · read 9 Oct 2026
- Cases
- A sketch usually represents one case and can organize multiple timelines, views, comments, and stories.timesketch.org · read 9 Oct 2026
- Collaboration
- Sketches can be shared with individual users, groups, all system users, or kept private.timesketch.org · read 9 Oct 2026
- Data import
- The quickstart says Timesketch supports Plaso storage files and CSV and JSON formatted files.timesketch.org · read 9 Oct 2026
- Deployment
- The preferred installation method is Docker, and the documentation says it is the only tested and actively maintained installation method.timesketch.org · read 9 Oct 2026
- Google status
- The site says Timesketch is not an official Google product, though the code is owned by Google.timesketch.org · read 9 Oct 2026
- Integrations
- Documented analyzer integrations include Sigma, Google Safe Browsing, BigQuery, Yeti, and HashR.timesketch.org · read 9 Oct 2026
- Purpose
- Timesketch is an open-source tool for collaborative forensic timeline analysis.timesketch.org · read 9 Oct 2026
- Search and exploration
- Users can search timelines, apply filters, view timeline data in charts, and save discoveries as views.timesketch.org · read 9 Oct 2026
- Security
- The installation guide documents optional TLS setup for the web server.timesketch.org · read 9 Oct 2026
- Sigma limitation
- The Sigma documentation describes Timesketch support as alpha functionality with known performance and functionality issues.timesketch.org · read 9 Oct 2026
- Storage limit
- The documentation says index size is limited by physical disk space and warns that searches across a sketch can fail when a timeline has more than 150 indices.timesketch.org · read 9 Oct 2026
- Support
- The project lists user and developer mailing lists and a Timesketch Slack community as resources.timesketch.org · read 9 Oct 2026
- System requirements
- The installation guide calls for Ubuntu 22.04 and at least 8 GB of RAM.timesketch.org · read 9 Oct 2026
