I once had a similar task and I found Nirsoft Mega Report. It combines some of the NirSoft utilities. I didn't find it very useful, since you get a lot of single reports, but not a complete timeline.
End of 2014, I tried to achieve it myself by using the NirSoft tools, running them in unattended mode and exporting to XML. The tools I considered for that were
- AppCrashView (maybe someone tried to exploit a bug in an application)
- JumpListsView (see what was done last)
- RecentFilesView (which files were used last)
- UserAssistView
- BlueScreenView (maybe some kernel exploit caused a bluescreen)
- FirefoxDownloadsView (maybe some malware came from there)
- LastActivityView (see what was done last)
- ShellBagsView
- WinLogOnView (who logged on)
- BrowsingHistoryView
- FlashCookiesView
- MozillaCacheView
- SkypeLogView
- WinPrefetchView
- DevManView (were there devices connected)
- IECacheView
- MyEventViewer (like Windows Event Viewer)
- TurnedOnTimesView
- ImageCacheViewer
- myuninst
- USBDeview (were there devices connected)
From all these XMLs I tried to build a complete timeline. I say "tried", because
- I found that the XMLs were not always well-formed. I reported that as bugs, but I was never notified whether they were fixed.
- Not all tools provide XML export
Still, all those reports may be helpful.
If you do forensic stuff, consider the following basic rules:
- get an image in a forensically sound way
- only work on a copy of that image. Never work on the original and never work on the forensically sound image (of step one).