Question 1
I generated a "timeline report" and the report only contains one item or very few items.
Why is that?
Answer 1
The "timeline report" will include all records that have been added to the timeline. To add a record to the timeline, edit the timeline data for that record's item. This is done from within the timeline bookmark properties.
It is a common misunderstanding that editing the timeline for one timeline-bookmarked item affects other members of that timeline bookmark. Instead, one must edit the timeline information for each record that is to be included in the timeline report.
Question 2
Why is it that the "generate" button will not light up as I try to create a "timeline" report?
Answer 2
The timeline report "generate" button lights up if all the selected bookmarks are "timeline" bookmarks. Deselect any bookmarks that are not "timeline" bookmarks.
Applies To:
AD Enterprise
AD Lab
Forensic Toolkit (FTK)