Looking to streamline a defensible DFIR stack for small civil cases: right now I’m pairing Hunchly for web capture with Autopsy + Plaso (log2timeline) for timeline reconstruction, and pDNS/CT data to pivot from MX/TLS artifacts; last week a CT SHA256 match narrowed a suspect’s activity window to 14:32–15:10 CST… If you’ve got budget-friendly alternatives or training you trust, drop them — no silver bullets here, and obviously validate in your own environment.
And i keep your Hunchly+Plaso combo but swap Autopsy for Timesketch; pulling a Plaso dump into Timesketch has saved me hours when pinning windows like your 14:32–15:10 CST, and it’s free: https://timesketch.org. For budget pivots off MX/TLS, crt.sh + CertStream is usually enough, but watch for precert noise — — validate against the final leaf and issuer timestamps. Also worth a look: Eric Zimmerman’s KAPE with MFTECmd/Amcache for quick pre-triage before log2timeline — have you tried that yet?