Plaso
A Python-based engine for automatic creation of super timelines from computer system logs and files for digital forensic analysis.
What is Plaso?
Plaso is a Python-based engine that automatically creates super timelines from timestamped events found on computer systems. It aggregates logs and file metadata into comprehensive timelines that help digital forensic investigators correlate information during forensic examinations. The tool supports both broad super timelines and more targeted timeline approaches depending on investigation needs.
Digital forensic investigators, incident response analysts, and security professionals who need to analyze computer system artifacts and correlate events across multiple log sources and files.
Plaso provides an extensible framework that goes beyond simple timeline creation, allowing analysts to add custom parsers and analysis plug-ins while automating repetitive forensic tasks. Its evolution from a timeline tool to a comprehensive forensic framework makes it uniquely adaptable to changing investigation requirements.
Overview
Super timeline all the things
Use Cases
Best For
- Creating comprehensive super timelines from multiple system artifacts during forensic investigations
Related Projects
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
