Plaso
Plaso (log2timeline)
Plaso is an open-source tool that automatically creates a comprehensive timeline from a multitude of forensic artefacts — a so-called super timeline. It collects timestamps from file systems, logs, browser traces, the registry and much more and merges them. It is the backbone of many timeline analyses.
History & facts. Plaso is the further development of the log2timeline project and automates what was previously laborious manual work: the collection and unification of timestamps from dozens of sources on a system. The result is a consolidated, searchable timeline that makes the course of an incident traceable. Plaso provides the data that is evaluated and visualised in tools such as Timesketch.
Outlook & recommendation. The strength of Plaso — to capture everything — is at the same time its challenge: the timelines generated are enormous and must be filtered specifically to be meaningful. Combined with an analysis interface, it becomes a powerful instrument of Digital Forensics and Incident Response (DFIR) work. For robust results, attention must be paid to consistent time zones and the plausibility of the time data, since manipulated timestamps (timestomping) can distort the picture.