Index: trunk/doc/Makefile
===================================================================
--- trunk/doc/Makefile	(revision 63)
+++ trunk/doc/Makefile	(revision 64)
@@ -1,5 +1,5 @@
 # $Id$
 
-BUILD_FILES=$(BUILD_DOC)/man/man1/reglookup.1.gz
+BUILD_FILES=$(BUILD_DOC)/man/man1/reglookup.1.gz $(BUILD_DOC)/man/man1/reglookup-timeline.1.gz
 
 default: $(BUILD_FILES)
@@ -9,4 +9,8 @@
 	cp man/man1/reglookup.1.gz $@
 
+$(BUILD_DOC)/man/man1/reglookup-timeline.1.gz: man/man1/reglookup-timeline.1.gz
+	mkdir -p $(BUILD_DOC)/man/man1
+	cp man/man1/reglookup-timeline.1.gz $@
+
 install:
 	cp -r $(BUILD_DOC)/* $(DOC_PREFIX)
@@ -15,9 +19,7 @@
 
 #XXX: Used during release only
-#release:
-#	txt2tags --mask-email -t man -o man/man1/reglookup.1 reglookup.1.t2t
-#	cd man/man1 && gzip -9 reglookup.1
-
 release:
 	docbook2x-man --to-stdout reglookup.1.docbook > man/man1/reglookup.1
+	docbook2x-man --to-stdout reglookup-timeline.1.docbook > man/man1/reglookup-timeline.1
 	cd man/man1 && gzip -9 -f reglookup.1
+	cd man/man1 && gzip -9 -f reglookup-timeline.1
Index: trunk/doc/devel/references.txt
===================================================================
--- trunk/doc/devel/references.txt	(revision 63)
+++ trunk/doc/devel/references.txt	(revision 64)
@@ -3,2 +3,8 @@
   (The file 'winntreg.txt' included in this distribution is derived from this.)
   http://home.eunet.no/~pnordahl/ntpasswd/WinReg.txt
+
+- Some useful information on how Windows reads from and writes to registry
+  hives:
+  http://www.microsoft.com/technet/archive/winntas/tips/winntmag/inreg.mspx
+
+- 
Index: trunk/doc/reglookup-timeline.1.docbook
===================================================================
--- trunk/doc/reglookup-timeline.1.docbook	(revision 64)
+++ trunk/doc/reglookup-timeline.1.docbook	(revision 64)
@@ -0,0 +1,113 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<refentry id='reglookup-timeline.1'>
+  <!--  $Id$ -->
+  <refmeta>
+    <refentrytitle>reglookup-timeline</refentrytitle>
+    <manvolnum>1</manvolnum>
+    <refmiscinfo class="sectdesc">File Conversion Utilities</refmiscinfo>
+  </refmeta>
+  <refnamediv id='name'>
+    <refname>reglookup-timeline</refname>
+    <refpurpose>windows NT+ registry MTIME timeline generator</refpurpose>
+  </refnamediv>
+
+  <refsect1 id='synopsis'>
+    <title>SYNOPSIS</title>
+    <para>
+      <command>
+	reglookup-timeline <replaceable>registry-file</replaceable>
+                           [<replaceable>registry-file</replaceable> ...]
+      </command>
+    </para>
+  </refsect1>
+
+  <refsect1 id='description'>
+    <title>DESCRIPTION</title>
+    <para>
+      This script is a wrapper for <command>reglookup(1)</command>, and reads
+      one or more registry
+      files to produce an MTIME sorted output.  This is helpful when building
+      timelines for forensic investigations.
+    </para>
+  </refsect1>
+
+  <refsect1 id='parameters'>
+    <title>PARAMETERS</title>
+    <para>
+      <command>reglookup-timeline</command> accepts one or more registry file
+      names.  All of the provided registries will be parsed using 
+      <command>reglookup(1)</command>.
+    </para>
+  </refsect1>
+
+  <refsect1 id='output'>
+    <title>OUTPUT</title>
+    <para>
+      <command>reglookup-timeline</command> generates a comma-separated 
+      values (CSV) compatible format to stdout.  While the output of 
+      <command>reglookup-timeline</command> and <command>reglookup(1)</command>
+      differ in the columns returned, the base format is the same.  
+    </para>
+    <para>
+      Currently, <command>reglookup-timeline</command> returns three columns:
+      MTIME, FILE, and PATH.  Only rows representing registry keys are returned,
+      since MTIMEs are not stored for values.  The FILE column indicates which
+      registry file (provided as an argument) the key came from.  Finally, the
+      PATH field contains the full registry path to the key.  Records are 
+      returned sorted in ascending order based on the MTIME column.
+    </para>
+  </refsect1>
+
+  <refsect1 id='bugs'>
+    <title>BUGS</title>
+    <para>
+      This script is new, and as such it's interface may change significantly 
+      over the next few revisions.  In particular, additional command line 
+      options will likely be added, and the output of the script may be altered
+      in minor ways.
+    </para>
+    <para>
+      It is very difficult to find documentation on what precise operations 
+      cause the MTIMEs to be updated.  Basic experimentation indicates that 
+      a key's stamp is updated anytime an immediate sub-value or sub-key is 
+      created, renamed, deleted, or it's value is modified.  If this MTIME 
+      data is critical to an investigation, any conclusions should be 
+      validated through experimentation in a lab environment.
+    </para>
+    <para>
+      This software should be considered unstable at this time.
+    </para>
+  </refsect1>
+
+  <refsect1 id='credits'>
+    <title>CREDITS</title>
+    <para>
+      This script was written by Timothy D. Morgan based on suggestions
+      from Uwe Danz.
+    </para>
+    <para>
+      Please see source code for a full list of copyrights.
+    </para>
+  </refsect1>
+
+  <refsect1 id='license'>
+    <title>LICENSE</title>
+    <para>
+      Please see the file "LICENSE" included with this software
+      distribution.
+    </para>
+    <para>      
+      This program is distributed in the hope that it will be useful,
+      but WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+      GNU General Public License version 2 for more details.
+    </para>
+  </refsect1>
+
+  <refsect1 id='seealso'>
+    <title>SEE ALSO</title>
+    <para>
+      reglookup(1)
+    </para>
+  </refsect1>
+</refentry>
Index: trunk/doc/reglookup.1.docbook
===================================================================
--- trunk/doc/reglookup.1.docbook	(revision 63)
+++ trunk/doc/reglookup.1.docbook	(revision 64)
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <refentry id='reglookup.1'>
-  <!--  $Id: $ -->
+  <!--  $Id$ -->
   <refmeta>
     <refentrytitle>reglookup</refentrytitle>
@@ -12,8 +12,10 @@
   </refnamediv>
 
-  <refsect1 id='syntax'>
+  <refsect1 id='synopsis'>
     <title>SYNOPSIS</title>
     <para>
-      <command>reglookup [options]</command> <replaceable>registry-file</replaceable>
+      <command>
+	reglookup [options] <replaceable>registry-file</replaceable>
+      </command> 
     </para>
   </refsect1>
@@ -30,5 +32,5 @@
   </refsect1>
 
-  <refsect1 id='caveats'>
+  <refsect1 id='options'>
     <title>OPTIONS</title>
     <para>
@@ -222,5 +224,12 @@
     </para>
     <para>
-      MTIME and SID conversions haven't been checked for accuracy.
+      The SID conversions haven't been carefully checked for accuracy.
+    </para>
+    <para>
+      The MTIME conversions appear correctly produce the stored UTC timestamp.
+      However, due to the periodicity of registry writes, and the complexity
+      of the conversion, a small amount of error (on the order of seconds) may
+      be possible.  The documentation available online from Microsoft on 
+      this field is very poor.
     </para>
     <para>
@@ -231,6 +240,6 @@
     <para>
       You'll notice that registry paths aren't all the same as the
-      ones the equivalents you see in the windows registry editor.
-      Don't ask me why that is.  I just work here.
+      equivalents you see in the windows registry editor.  Don't ask me why 
+      that is.  I just work here.
     </para>
     <para>
@@ -266,3 +275,10 @@
     </para>
   </refsect1>
+
+  <refsect1 id='seealso'>
+    <title>SEE ALSO</title>
+    <para>
+      reglookup-timeline(1)
+    </para>
+  </refsect1>
 </refentry>
