Plaso is a Python-based engine used to generate ("super") timelines, based on a number of forensic artefacts.


Plaso database generation

The first step to generate a timeline through plaso is to create a plaso database using

# Generates a plaso database, parsing all artefacts available. --storage-file <OUTPUT_PLASO_DB> <EVIDENCE_FILE | EVIDENCE_FOLDER>

# Generates a plaso database through Docker, parsing all artefacts available.

# lists the available parsers. --parsers list

# Generates a plaso database, using all parsers except the filestat parser (useful for triaged data parsing). --parsers '!filestat' --storage-file <OUTPUT_PLASO_DB> <EVIDENCE_FILE | EVIDENCE_FOLDER>

The number of events parsed and errors that occurred during parsing can be reviewed with the pinfo script: <OUTPUT_PLASO_DB>

Timeline generation

Once a plaso database has been generated with log2timeline, the psort script can be used to transform the database in a human-readable timeline. Multiple output formats are supported, including json, csv, TLN, xlsx, opensearch database for ingestion with Timesketch, etc.

psort uses UTC as its default time zone when outputting events.

# Lists the supported output format. -o list

# Generates a timeline in the specified format based on the provided Plaso database. -o <json_line | FORMAT> -w <TIMELINE_OUTPUT> <PLASO_DB>

Last updated