auditd-timeline A parser/timeline creator for auditd logs. random notes Every PATH entry has a (null) entry with it - this appears to be the end of the inode. Could be useful for carving files from disk