plaso

here is the plaso logo
Welcome to the plaso project site. This site is dedicated to all things plaso and plaso related, like super timelines and log2timeline.

Plaso (plaso langar að safna öllu) is the Python based back-end engine used by tools such as log2timeline for automatic creation of a super timelines. The goal of log2timeline (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers and related systems, such as network equipment to produce a single correlated timeline. This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system.

Auxiliary goal of plaso is to provide forensic analysts and tool makers powerful libraries that they can use to access, find, read and parse various files within disk images to create their own tools, or to adjust log2timeline to their own workflow, instead of relying on the workflow provided by log2timeline.py.

The original version of log2timeline was written in Perl mainly for Linux, but has been known to work on both Mac OS X and Windows. Due to various issues the old Perl back-end engine log2timeline has been deprecated in favor of a Python based one, named plaso.

The original SANS Gold paper describing the log2timeline framework can be read here [although the current version does not share much with that original concept].

The plaso source code along with all of the tools that utilize plaso (such as log2timeline, pinfo, plasm, pprof, pshell and psort) can be found at: https://github.com/log2timeline/plaso

The Perl version of log2timeline can be found at: https://code.google.com/p/log2timeline.

This site serves as a documentation portal, to both potential developers of the tool and to users. The site is split up in three main sections:

  • Releases and roadmap: an overview of the types of plaso release and the roadmap.
  • Users Guide: largely intended for the end user, this sections explains the purpose of each of the provided tools and how to use them.
  • Analysis Techniques: focused on the post-processing of data. Life after collection so to speak, this section's goal is to provide the analyst with some techniques and tools to help them find the needles in the enormous haystack by utilizing various tools.
  • Developers Guide: intended for people that want to build the tool from source and those that want to develop with and for it.
If you find something missing in these sections feel free to leave a comment on either of the mailing lists (as discussed below or on the G+ community).

There is also a blog that is dedicated to plaso development, usage and other timeline analysis related, http://blog.kiddaland.net

And also two mailing groups that discuss plaso and log2timeline:
  • log2timeline-discuss: A generic announcement and discussion mailing group about all things plaso and log2timeline.
  • log2timeline-dev: A mailing list geared towards those that want to either follow the development of the tool or contribute to the tool.
Finally there is a Google+ community dedicated to plaso and log2timeline.

Build status of the tool: Build Status

Code coverage for unit tests: Coverage Status


The regular disclaimer applies:
  • We make no guarantee of the correctness of the tool. Please verify the results of the tool either manually or with other tools.
  • The current version of the tool is an alpha release. That means that the tool has some rough edges and may not necessarily work on all images (as in there may still be several bugs in the tool that we haven't discovered).
  • Please make sure to try to keep the tool as much up-to-date as possible and read up on known issue lists, and open bug reports.
  • Despite the tool correlating several different sources of information designed to provide the practitioner as broad of a picture of all activities that have occurred on a computer system it does NOT nor will it ever contain ALL possible sources of timestamped data. Please be aware of that fact, one way of improving that is to find these sources that you believe are essential and either contribute a parser or ask us to add one.
Subpages (1): Releases and roadmap