plaso

Plaso (plaso langar að safna öllu) provides a single toolset to parse diverse log files and forensic artifacts, producing a correlated super timeline. This speeds up investigations by consolidating vast amounts of data from average computer systems into an easily analyzable format. The metapackage 'plaso' depends on the Python 3 package, while 'python3-plaso' contains the core libraries and scripts.

Key use cases include digital forensics investigations where analysts need to timeline events across storage media images, directories, or devices. Tools like log2timeline extract events recursively, supporting archives, VSS stores, and various parsers. plaso-image_export exports files from images including VSS, plaso-pinfo shows storage file details, plaso-psort filters and processes output, and plaso-psteal builds timelines directly to CSV.

The ecosystem relies on extensive dependencies for parsing formats like EWF, NTFS, APFS, registry hives, event logs, and more, making it comprehensive for Windows, macOS, and Linux artifacts.

Plaso operates as a backend engine using Python libraries to parse forensic artifacts and logs via specialized parsers (e.g., libevtx for Windows Event Logs, libfsntfs for NTFS). log2timeline recursively processes sources like disk images or directories, extracting events into a storage file (default SQLite format). Events include timestamps, sources, and metadata, correlated into a super timeline. Storage files can be analyzed with psort for filtering/time-slicing, pinfo for metadata, or exported via image_export. Supports VSS, archives (tar/zip), YARA rules, hashers, and artifact filters for targeted collection.