Plaso
A Python-based engine for automatic creation of super timelines from computer system logs and files for digital forensic analysis.
What is Plaso?
Plaso is a Python-based engine that automatically creates super timelines from timestamped events found on computer systems. It aggregates logs and file metadata into comprehensive timelines that help digital forensic investigators correlate information during forensic examinations. The tool supports both broad super timelines and more targeted timeline approaches depending on investigation needs.
Digital forensic investigators, incident response analysts, and security professionals who need to analyze computer system artifacts and correlate events across multiple log sources and files.
Plaso provides an extensible framework that goes beyond simple timeline creation, allowing analysts to add custom parsers and analysis plug-ins while automating repetitive forensic tasks. Its evolution from a timeline tool to a comprehensive forensic framework makes it uniquely adaptable to changing investigation requirements.
Overview
Super timeline all the things
Use Cases
Best For
- Creating comprehensive super timelines from multiple system artifacts during forensic investigations
- Correlating events across different log files and system files in incident response scenarios
- Automating repetitive parsing and analysis tasks in digital forensic workflows
- Developing custom parsers for specialized or emerging forensic artifacts
- Building targeted timelines for specific investigation focuses rather than collecting everything
- Extending forensic analysis capabilities through plug-ins and scripting
Not Ideal For
- Real-time security monitoring systems that require immediate alerting and live event processing
- Simple log aggregation projects without the need for complex timeline correlation or forensic analysis
- Non-forensic data analysis tasks, such as business intelligence or general data processing that don't rely on timestamped events
Pros & Cons
Pros
Aggregates all timestamped events from a computer system into a single timeline for forensic analysis, as emphasized in the README for correlating large amounts of information.
Supports adding new parsers and plug-ins, allowing adaptation to evolving forensic requirements, which is highlighted in the features for future-proofing.
Enables writing one-off scripts to automate repetitive forensic tasks, improving workflow efficiency as noted in the key features.
Allows creation of focused timelines based on specific forensic needs, rather than collecting everything, as referenced in the README for more efficient investigations.
Cons
Requires expertise in digital forensics and Python to effectively use custom parsers and analysis plug-ins, making it less accessible for generalists.
As an extensible framework, initial setup and customization can be time-consuming and non-trivial, relying heavily on external documentation and community support.
Users must depend on external resources like Read the Docs and community channels, which may be incomplete or require active engagement for troubleshooting.
Frequently Asked Questions
Related Projects
TimesketchCollaborative forensic timeline analysis
Aurora Incident ResponseIncident Response Documentation made easy. Developed by Incident Responders for Incident Responders
Morguepost mortem tracker
HighlighterFree Tool available from Fire/Mandiant that will depict log/text file that can highlight areas on the graphic, that corresponded to a key word or phrase. Good for time lining an infection and what was done post compromise
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.