| name | building-super-timelines-with-plaso |
| description | Generate forensic super-timelines with Plaso's log2timeline.py, pinfo.py, psort.py, and psteal.py CLI tools (fusing file-system MACB, registry, EVTX, browser history, prefetch, LNK, and more), then triage and filter the results in Timesketch. Use when reconstructing the full sequence of events on a compromised or forensically imaged host during a DFIR investigation. |
| domain | cybersecurity |
| subdomain | digital-forensics |
| tags | ["digital-forensics","plaso","log2timeline","super-timeline","timesketch","dfir","timeline-analysis","incident-response"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["RS.AN-03"] |
| mitre_attack | ["T1070"] |
Building Super Timelines with Plaso
Authorized Use Only: Build timelines only from evidence you are authorized to analyze. Work from forensic images/copies and preserve chain of custody.
Overview
Plaso (Plaso Langar Að Safna Öllu) is the open-source engine behind log2timeline, the standard for building forensic super timelines — a single chronological, normalized view fusing hundreds of artifact types (file-system MACB times, registry, EVTX, browser history, prefetch, LNK, $UsnJrnl, syslog, and more) into one timeline. Plaso has three core CLI tools:
- log2timeline.py — extracts events from a source (disk image, mount point, directory, or device) into a
.plaso storage file using its large parser/plugin set.
- pinfo.py — reports on the contents and processing metadata of a
.plaso file.
- psort.py — post-processes, filters, deduplicates, time-zones, and exports the storage file to an output format (CSV, JSON-line, Elasticsearch, Timesketch, etc.).
- psteal.py — convenience wrapper that runs extraction + export in one step.
The resulting timeline is enormous, so analysts triage it in Timesketch — a collaborative, web-based timeline analysis platform that ingests .plaso files (or CSV/JSONL) and supports filtering, tagging, starring, saved searches, and automated analyzers.
When to Use
- Reconstructing the full sequence of events on a compromised host during incident response.
- Correlating activity across many artifact sources on a single normalized timeline.
- Investigating anti-forensic behavior such as timestomping or log clearing (which stands out against MACB and journal evidence).
- Feeding a curated timeline into Timesketch for team triage.
Prerequisites
- Install Plaso (Docker is the supported, reproducible method):
docker pull log2timeline/plaso
docker run -v /cases:/data log2timeline/plaso log2timeline.py --version
Alternatively on Ubuntu via the GIFT PPA:
sudo add-apt-repository ppa:gift/stable
sudo apt-get update && sudo apt-get install -y plaso-tools
- A Timesketch instance (docker-compose deployment from https://github.com/google/timesketch) for triage.
