Skip to content
SPECIFICTION
Get listed

Timesketch

timesketch.org

Free plan WebLinuxAPISelf-hosted
Visit timesketch.org
Spec score 7.6 #17 of 30 in Digital Forensics Software

What it is

Timesketch is a free, open-source tool for collaborative forensic timeline analysis. A sketch normally represents one case and can contain multiple timelines, views, comments and stories. Investigators can search and filter timelines, inspect data in charts and save discoveries as views. Sketches may be private or shared with individuals, groups or all system users. Supported imports include Plaso storage files, CSV, JSON, JSONL, Pandas DataFrames, Python dictionaries and spreadsheet files. Python analyzers run in background workers to enrich events, add tags or create saved views; documented integrations include Sigma, Google Safe Browsing, BigQuery, Yeti and HashR. Sigma support is marked alpha with known performance and functionality issues. Timesketch offers a web interface, REST API and command-line client. Docker is the only tested and actively maintained installation method; documentation calls for Ubuntu 22.04 and at least 8 GB of RAM. Indexes depend on physical disk space, and searches may fail above 150 indices in a timeline. The self-hosted plan is free.

Spec sheet

Purpose
Timesketch is an open-source tool for collaborative forensic timeline analysis.Read 9 Oct 2026 · timesketch.org
Deployment
The preferred installation method is Docker, and the documentation says it is the only tested and actively maintained installation method.Read 9 Oct 2026 · timesketch.org
Integrations
Documented analyzer integrations include Sigma, Google Safe Browsing, BigQuery, Yeti, and HashR.Read 9 Oct 2026 · timesketch.org
Security
The installation guide documents optional TLS setup for the web server.Read 9 Oct 2026 · timesketch.org
Support
The project lists user and developer mailing lists and a Timesketch Slack community as resources.Read 9 Oct 2026 · timesketch.org
Analyzers
Python analyzers run in background workers to enrich timeline data and can tag events or create saved views.Read 9 Oct 2026 · timesketch.org
API and CLI
Timesketch provides a web interface and REST API, plus a command-line client for searching, filtering, uploading timelines, and running analyzers.Read 9 Oct 2026 · timesketch.org
Cases
A sketch usually represents one case and can organize multiple timelines, views, comments, and stories.Read 9 Oct 2026 · timesketch.org
Collaboration
Sketches can be shared with individual users, groups, all system users, or kept private.Read 9 Oct 2026 · timesketch.org
Data import
The quickstart says Timesketch supports Plaso storage files and CSV and JSON formatted files.Read 9 Oct 2026 · timesketch.org
Google status
The site says Timesketch is not an official Google product, though the code is owned by Google.Read 9 Oct 2026 · timesketch.org
Search and exploration
Users can search timelines, apply filters, view timeline data in charts, and save discoveries as views.Read 9 Oct 2026 · timesketch.org
Sigma limitation
The Sigma documentation describes Timesketch support as alpha functionality with known performance and functionality issues.Read 9 Oct 2026 · timesketch.org
Storage limit
The documentation says index size is limited by physical disk space and warns that searches across a sketch can fail when a timeline has more than 150 indices.Read 9 Oct 2026 · timesketch.org
System requirements
The installation guide calls for Ubuntu 22.04 and at least 8 GB of RAM.Read 9 Oct 2026 · timesketch.org

Plans and prices

Timesketch Free Open-source tool · self-hosted installation Read 9 Oct 2026 · timesketch.org

Every Timesketch plan and price →

Strong points and limits

Strong points

  • Open-source and free
  • Collaborative case sketches
  • Multiple import formats
  • Web, REST API and CLI
  • Background Python analyzers

Limits

  • Docker is the only maintained installation method
  • Requires Ubuntu 22.04 and 8 GB RAM
  • Sigma support is alpha
  • Searches may fail above 150 indices

Who it suits

Timesketch suits forensic teams needing shared, searchable timelines and case collaboration. It is intended for Linux or Docker deployments that meet the documented system requirements.

Verdict

Timesketch provides collaborative timeline investigation with several interfaces, imports and analyzers. Deployment requirements and documented index and Sigma limitations should be checked before adoption.

Where Specifiction places it

Alternatives to TimesketchAll alternatives →