Timesketch
Timesketch is a free, open-source tool for collaborative forensic timeline analysis.
What Timesketch is
Timesketch is a free, open-source tool for collaborative forensic timeline analysis. A sketch usually represents a case and can hold multiple timelines, views, comments, and stories. Users can search and filter timeline data, explore it in charts, and save discoveries as views. Sketches can be shared with individuals, groups, or all system users, or kept private. Timesketch accepts Plaso storage files and CSV and JSON files. Python analyzers run in background workers to enrich timeline data, tag events, or create saved views; documented integrations include Sigma, Google Safe Browsing, BigQuery, Yeti, and HashR. Sigma support is marked alpha, with known performance and functionality issues. The tool provides a web interface, REST API, and command-line client for searching, filtering, uploading timelines, and running analyzers. Docker is the only installation method documented as tested and actively maintained. The installation guide calls for Ubuntu 22.04 and at least 8 GB of RAM. Index size depends on physical disk space, and searches across a sketch can fail when a timeline has more than 150 indices.
Good
- Organizes multiple timelines within a case sketch.
- Sketches can be shared or kept private.
- Python analyzers can tag events or save views.
- Provides a web interface, REST API, and command-line client.
- Free and open source.
Watch out
- Docker is the only tested, actively maintained installation method.
- Installation guide calls for Ubuntu 22.04 and at least 8 GB RAM.
- Sigma support has known performance and functionality issues.
- Searches can fail above 150 indices in a timeline.
Who it suits
Timesketch suits forensic teams that need to organize and collaboratively explore timeline data. It is a fit for users prepared to deploy it with Docker on Ubuntu 22.04 and provide at least 8 GB of RAM.
Verdict
Timesketch combines case-based timeline exploration with sharing, analyzers, and multiple ways to access the system. Plan for its documented Docker and Ubuntu requirements, and note the stated limits around Sigma and large timelines.
Plans and prices
From Timesketch's own pricing page, checked 9 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Timesketch | Free | Open-source tool · self-hosted installation |
The facts
Each one read from Timesketch's own pages, with the date it was checked.
What it does
- Analyzers
- Python analyzers run in background workers to enrich timeline data and can tag events or create saved views.checked 9 Oct 2026
- API and CLI
- Timesketch provides a web interface and REST API, plus a command-line client for searching, filtering, uploading timelines, and running analyzers.checked 9 Oct 2026
- Cases
- A sketch usually represents one case and can organize multiple timelines, views, comments, and stories.checked 9 Oct 2026
- Collaboration
- Sketches can be shared with individual users, groups, all system users, or kept private.checked 9 Oct 2026
- Data import
- The quickstart says Timesketch supports Plaso storage files and CSV and JSON formatted files.checked 9 Oct 2026
- Deployment
- The preferred installation method is Docker, and the documentation says it is the only tested and actively maintained installation method.checked 9 Oct 2026
- Google status
- The site says Timesketch is not an official Google product, though the code is owned by Google.checked 9 Oct 2026
- Integrations
- Documented analyzer integrations include Sigma, Google Safe Browsing, BigQuery, Yeti, and HashR.checked 9 Oct 2026
- Purpose
- Timesketch is an open-source tool for collaborative forensic timeline analysis.checked 9 Oct 2026
- Search and exploration
- Users can search timelines, apply filters, view timeline data in charts, and save discoveries as views.checked 9 Oct 2026
- Security
- The installation guide documents optional TLS setup for the web server.checked 9 Oct 2026
- Sigma limitation
- The Sigma documentation describes Timesketch support as alpha functionality with known performance and functionality issues.checked 9 Oct 2026
- Storage limit
- The documentation says index size is limited by physical disk space and warns that searches across a sketch can fail when a timeline has more than 150 indices.checked 9 Oct 2026
- Support
- The project lists user and developer mailing lists and a Timesketch Slack community as resources.checked 9 Oct 2026
- System requirements
- The installation guide calls for Ubuntu 22.04 and at least 8 GB of RAM.checked 9 Oct 2026
Alternatives to Timesketch
- 1
Arkime
Free planOpen sourceWebAPILinuxSelf-hosted7.3Free plan - 2
Plaso
Free planOpen sourceAPILinuxmacOSSelf-hosted7.3Free plan - 3
CAINE
Free planOpen sourceLinuxSelf-hostedWindows7.1Free plan - 4
Paraben E3 Forensic Platform
AndroidiOSLinuxmacOS7.1From $699 a year - 5
OSForensics
Free planAndroidSelf-hostedWindows7.0From $945 a year - 6
NetworkMiner
Free planLinuxmacOSWindows6.9$1,300 one-time