One of my favorite features-- and I
did a keynote for Magnet a few years ago,
and I called this "Timeline on the fly."
And the woman who created it loved it.
She came up to me after and she's
like, it's actually called relative time filter.
But I call it timeline on the fly.
I want to show you what this looks like.
Now you're going to see you won't have it
for every single item of evidence or every single parse.
So here I'm an iOS Call Logs.
On the right-hand side, you see this tiny little clock
over here.
It's so hidden, but this is such a good feature.
And up here, we can see Set relative time.
What you can do is say, you know what?
I need to know what happened 15 minutes before this call and 5
minutes after.
And it will show you.
This is extremely powerful for malware investigations.
So that's one thing you can do with timeline on the fly.
The other timeline option is to go up to Date and Time.
Dates between-- and this is going
to make it very similar to what we had seen
in Physical Analyzer so far.
So you could go and say, this is what I want to search for
Additionally, you could say I want to search for that,
but I also want to search for--
maybe you're unsure, so you type health.
And you're like, oh, yeah, I want all these things.
So then you could keyword search.
You could timeline, keyword search, and specify filter
to the level of artifacts.
Just don't over-filter.
Be very, very careful with it.