Question 1

I generated a "timeline report" and the report only contains one item or very few items.

Why is that?

 

Answer 1

The "timeline report" will include all records that have been added to the timeline. To add a record to the timeline, edit the timeline data for that record's item. This is done from within the timeline bookmark properties.

It is a common misunderstanding that editing the timeline for one timeline-bookmarked item affects other members of that timeline bookmark. Instead, one must edit the timeline information for each record that is to be included in the timeline report.

 

Question 2

Why is it that the "generate" button will not light up as I try to create a "timeline" report?

Answer 2

The timeline report "generate" button lights up if all the selected bookmarks are "timeline" bookmarks. Deselect any bookmarks that are not "timeline" bookmarks.

 

Applies To:

AD Enterprise

AD Lab

Forensic Toolkit (FTK)