This page's audience our own tag's counts — open to see them

Period

–Visits

–Page views

–Clicks to vendors

–Time on page

–Reading now

Clicks to vendors, by tool

Top countries

Devices

– · visits, page views and clicks counted by our own tag, which counts more than our checked analytics; every figure rounded down · how we count

Timesketch

Free#21 of 30 in Digital Forensics Software

Timesketch: A focused workspace for organizing, searching, annotating, and sharing forensic timelines. Ranked #21 of 30 in Digital Forensics Software by our editors (7.2/10); pricing: Open source; best for collaborative forensic timeline investigations.

7.2/10Editor score

Visit Timesketch

Timesketch7.2 Visit Timesketch

At a glance

Editor score
7.2 / 10
Pricing
Open source
Best for
Collaborative forensic timeline investigations
Paid from
Free
Facts checked
20 Sep 2026

Where it wins
- Collaborative sketches organize cases and multiple timelines
- Advanced OpenSearch-based search with saved views and aggregations
- Stories, analyzers, annotations, and API or CLI imports support investigations
Where it doesn't
- Focused on timeline analysis rather than evidence acquisition
- Does not provide general evidence analysis
- Self-hosted deployment requires Linux or Docker

Our verdict on Timesketch

Timesketch is a web-based, open-source tool for collaborative forensic timeline analysis. Investigators organize evidence into sketches, typically representing cases, and combine multiple timelines for searching and analysis. It is suited to digital forensics and incident-response teams that need shared views of timeline evidence, with support for Linux, Docker, and API-based workflows. The product is focused: it helps investigators work with timeline data rather than providing acquisition or general evidence analysis.

Its strongest area is investigation-focused collaboration. A sketch can contain multiple timelines and saved search views, while event comments, tags, stars, and annotations help teams mark important findings. Investigation stories collect saved searches, views, aggregations, and Markdown into a structured narrative. Full-text and advanced OpenSearch-based search support timeline review, and the analyzer framework adds tagging, correlation, enrichment, and Sigma rules. These features give teams several ways to move from raw events to organized investigative findings.

Timesketch also supports imports through its web interface, API, importer library, and command-line client. Evidence sources include Plaso storage files, CSV, JSON, JSONL, Pandas DataFrame, Python dict, XLS, and XLSX. Sketches can be exported as CSV, JSONL, ZIP, or Markdown, with ZIP exports containing metadata, event data, mappings, and stories. The open-source, self-hosted model fits teams that want control over deployment and workflow integration. Choose Timesketch when collaborative timeline investigation is the priority; choose a broader forensic platform when acquisition or general evidence analysis is central.

Your product? Our editors can test Timesketch in depth and publish a review, labelled as paid · from $149/mo →

Timesketch pricing

Plans Open sourceFree Free to use — no paid tier required for the core job.

See plans on timesketch.org

Timesketch fact sheet

Free plan	Not verified
Paid from	Free
Evidence sources	Plaso storage files, CSV, JSON, JSONL, Pandas DataFrame, Python dict, XLS/XLSX
Mobile forensics	Not verified
Disk imaging	Not verified
Memory forensics	Not verified
Case collaboration	Yes
Supported platforms	Linux (Ubuntu 22.04), Docker
Export formats	CSV, JSONL, ZIP, Markdown
Deployment	Self-hosted
Platforms	Web, Linux
Support	Docs
Built for	Small business, Mid-market, Enterprise (editorial estimate)
Pricing	Open source
Website	timesketch.org
Facts checked	20 Sep 2026

Alternatives to Timesketch

See all Timesketch alternatives →

Used Timesketch? Be the first to review it

The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used Timesketch for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.

Write a reviewTwo minutes · verified accounts only · read by an editor before it appears

Reviews come only from verified accounts. Sign in or create an account first — your e-mail is never shown.

Title

Your review

0 characters · at least 80, up to 3,000

Pros (optional · one per line)

Cons (optional · one per line)

Your name (shown with your review)

Role (optional)

Company (optional)

How long have you used it?

I've used Timesketch myself and this is my honest opinion — nobody paid or asked me to write it.

Posted from your verified account. Reviews appear after an editor reads them, usually within two working days.

Featured on iTechGuides

Timesketch is listed in our Digital Forensics Software directory. Add the badge to your site — it links back to this page.

<a href="https://www.itechguides.com/products/timesketch/"><img src="https://www.itechguides.com/best/badge/timesketch.svg" alt="Featured on iTechGuides" width="230" height="46"></a>

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated 7 Oct 2026 · How we research and update