Timesketch

Free plan APILinuxSelf-hostedWeb

What Timesketch is

Timesketch is a free, open-source tool for collaborative forensic timeline analysis. A case is represented as a sketch, where teams can organize timelines, comments, saved views, and stories. Users can search and filter timeline data, explore it in charts, and preserve discoveries as views. Sketches can be private or shared with individuals, groups, or all system users. Data can be imported from Plaso storage files and CSV or JSON files; Python analyzers run in background workers to enrich timelines by tagging events or creating views. The web interface is accompanied by a REST API and command-line client for searching, filtering, uploading timelines, and running analyzers. Docker is the only installation approach described as tested and actively maintained, and the guide calls for Ubuntu 22.04 and at least 8 GB of RAM. Index size depends on available disk space, and searches across a sketch can fail when a timeline exceeds 150 indices. Optional TLS setup is documented for the web server.

Who it suits

Timesketch suits forensic teams that need to organize and collaboratively examine timeline data in a self-hosted tool. It assumes users can provide the documented Ubuntu environment and at least 8 GB of RAM.

What it does well

Free and open source
Supports case collaboration and private sketches
Imports Plaso, CSV, and JSON data
Offers a web interface, REST API, and CLI
Python analyzers can tag events

What to know first

Docker is the only tested, maintained installation method
Installation guide calls for Ubuntu 22.04 and 8 GB RAM
Searches can fail above 150 indices in a timeline
Index size depends on available disk space

Limits

The free plan is self-hosted. Index size is bounded by physical disk space, and searches across a sketch can fail when a timeline has more than 150 indices.

Plans

Plan	Billed and limits	Price
Timesketch	Open-source tool · self-hosted installation	Free

As timesketch.org lists them, read 9 Oct 2026. The maker's own page has the final word.

Getting started

Open the Timesketch website.
Prepare an Ubuntu 22.04 system with at least 8 GB of RAM.
Install with Docker, the preferred and actively maintained method.
Import Plaso storage files or CSV or JSON data.
Create a sketch and organize timelines, views, comments, and stories.
Invite users or groups, or keep the sketch private.

Verdict

Timesketch brings search, chart exploration, saved findings, and shared case work into a free, self-hosted tool. Plan for its stated deployment requirements and the documented search limitation on large timelines.

Questions

How much does Timesketch cost?

The listed Timesketch plan costs nothing. It is an open-source tool for self-hosted installation.

Is there a free plan or trial?

The plan is free, and a free plan is listed. No free trial is listed.

Which platforms does Timesketch support?

The listed platforms are API, Linux, self-hosted, and web. The installation guide calls for Ubuntu 22.04, and Docker is the only tested and actively maintained installation method.

What files can I import and export?

The quickstart describes Plaso storage files and CSV and JSON imports. Listed evidence sources also include JSONL, Pandas DataFrame, Python dict, XLS, and XLSX; export formats are CSV, JSONL, ZIP, and Markdown.

Is Timesketch open source, and who owns it?

Yes. The site says it is not an official Google product, though the code is owned by Google.

What integrations are documented?

Analyzer integrations include Sigma, Google Safe Browsing, BigQuery, Yeti, and HashR. Sigma support is described as alpha functionality with known performance and functionality issues.

Facts from Timesketch's own pages

Analyzers: Python analyzers run in background workers to enrich timeline data and can tag events or create saved views. · timesketch.org, 9 Oct 2026
API and CLI: Timesketch provides a web interface and REST API, plus a command-line client for searching, filtering, uploading timelines, and running analyzers. · timesketch.org, 9 Oct 2026
Cases: A sketch usually represents one case and can organize multiple timelines, views, comments, and stories. · timesketch.org, 9 Oct 2026
Collaboration: Sketches can be shared with individual users, groups, all system users, or kept private. · timesketch.org, 9 Oct 2026
Data import: The quickstart says Timesketch supports Plaso storage files and CSV and JSON formatted files. · timesketch.org, 9 Oct 2026
Deployment: The preferred installation method is Docker, and the documentation says it is the only tested and actively maintained installation method. · timesketch.org, 9 Oct 2026
Google status: The site says Timesketch is not an official Google product, though the code is owned by Google. · timesketch.org, 9 Oct 2026
Integrations: Documented analyzer integrations include Sigma, Google Safe Browsing, BigQuery, Yeti, and HashR. · timesketch.org, 9 Oct 2026
Purpose: Timesketch is an open-source tool for collaborative forensic timeline analysis. · timesketch.org, 9 Oct 2026
Search and exploration: Users can search timelines, apply filters, view timeline data in charts, and save discoveries as views. · timesketch.org, 9 Oct 2026
Security: The installation guide documents optional TLS setup for the web server. · timesketch.org, 9 Oct 2026
Sigma limitation: The Sigma documentation describes Timesketch support as alpha functionality with known performance and functionality issues. · timesketch.org, 9 Oct 2026
Storage limit: The documentation says index size is limited by physical disk space and warns that searches across a sketch can fail when a timeline has more than 150 indices. · timesketch.org, 9 Oct 2026
Support: The project lists user and developer mailing lists and a Timesketch Slack community as resources. · timesketch.org, 9 Oct 2026
System requirements: The installation guide calls for Ubuntu 22.04 and at least 8 GB of RAM. · timesketch.org, 9 Oct 2026

Where Timesketch stands on Freedom251

Digital Forensics Software#12 of 30