Plaso

What it is

A Python engine, best known by its main command log2timeline, that parses a wide range of file and log formats and merges every dated entry into one super timeline. The project also supports narrower, targeted timelines when a full sweep is more than a case needs.

What it helps with

- Building a single timeline from a storage image, mounted volume, or folder of logs
- Filtering, sorting, and exporting events for review in other tools
- Tagging events of interest with analysis plugins
- Adding new parsers or scripting repetitive analysis steps

Who it's for

Forensic examiners and incident responders reconstructing activity on systems they are authorized to investigate.

Worth knowing

The project recommends a packaged release no older than six months over the development branch. Packaged releases come out several times a year, and the Docker image is the quickest supported setup.

Is Plaso the same as log2timeline?
log2timeline is Plaso's main command, and the older Perl tool of the same name is now legacy.

What does the name stand for?
It stands for Plaso Langar Að Safna Öllu, and the project sums it up as super timeline all the things.