iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Plaso builds a forensic timeline by extracting timestamped events and metadata from an authorized file, directory, mounted volume, disk image, or device into a Plaso storage file. You then inspect that file with pinfo, filter and sort events with psort, or use psteal for a combined collection-and-post-processing workflow. The result helps correlate artifacts; it does not, by itself, prove a person’s intent or reconstruct every action.
What Plaso does in a forensic workflow
Plaso (Plaso Langar Að Safna Öllu) is a Python-based timeline engine used by several forensic tools. Its documented purpose is to create “super timelines” that help investigators correlate information from logs and other computer files. The project describes this role in its documentation landing page.
The log2timeline command is the collection stage. It reads a source, runs applicable parsers and plugins, and writes a Plaso storage file. That file contains extracted events and collection metadata; tags and analysis-plugin reports may also be present. pinfo reports what is inside the storage file, while psort post-processes its events. psteal combines the collection and post-processing stages.
Think of Plaso as an evidence-correlation aid, not an automated conclusion generator. A timestamp can show that an artifact records an event at a particular time, but interpreting who acted, what they intended, or whether the record is complete requires source validation, time-zone analysis, corroboration and other investigative work.
#1 Best Overall
Prepare the source and the case scope
Use an acquired or otherwise authorized source
Start with a working copy or an evidence source whose acquisition and handling are authorized by your case procedures. Plaso can process an individual file, a directory or mount point, a storage-media image, or a device. Record the source identifier, acquisition method, hash values, time zone assumptions and any access credentials separately from the timeline command. Plaso’s storage file records collection information, but it does not replace your chain-of-custody documentation.
Define the investigative question
Write down what the timeline must help answer before choosing collection scope. A broad scan is appropriate when you do not yet know which artifact contains the relevant event or when cross-artifact correlation is central. A targeted collection is sensible when the question names a small set of paths or when processing the complete source is impractical. Narrowing the input can reduce cost, but it can also omit the artifact that would explain an event.
Check your installed release
Run the commands supplied with the installed Plaso package and read their local help output. Parser names, command options and available output writers can change between releases. Keep the Plaso version, operating system, source type and selected options in your case notes so another examiner can reproduce the run.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Build the Plaso storage file
Basic invocation
The documented basic form specifies a destination storage file followed by the input source:
log2timeline.py --storage-file OUTPUT INPUTFor example, an examiner might substitute a case-specific destination and a mounted evidence directory:
Rank #2
log2timeline.py --storage-file case-042.plaso /evidence/case-042-mountThe same pattern applies when INPUT is an artifact file, a directory, an image, or a device. Use a destination on storage with enough capacity for the database and any intermediate processing, and avoid writing into the evidence mount itself.
Broad recursive collection
By default, Plaso performs recursive collection using a parser preset. Its virtual file-system layer, dfVFS, identifies source data and presents files from supported containers to the extraction stage. Recursive processing can reach nested directories, archives such as tar and zip, and compressed streams such as .log.gz, subject to the installed version’s support.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchFiltered collection
Collection filters limit processing to selected paths. Use them when the case question is tightly scoped, when a full image is too large for the available processing window, or when a documented triage plan calls for particular artifacts. Define the filter using the syntax accepted by your installed release and preserve that filter file or command line with the case notes. A filter is a deliberate coverage trade-off, not a performance setting with no evidentiary consequence: state which paths and artifact classes were excluded.
Parser selection
Plaso can select parsers explicitly, choose them based on a detected operating system, or fall back to all parsers. Letting the tool select parsers is convenient for a normal source, while explicit selection can make a narrowly defined examination easier to explain. Whichever mode you use, capture the parser choices and review warnings for unsupported or malformed files.
Handle disk images, partitions and encryption deliberately
An image may contain multiple partitions, encrypted volumes or Volume Shadow Copies. During processing, Plaso can ask which partition or snapshot to use and may request credentials to access encrypted data. Do not assume every image will run unattended. Confirm that the selected partition is the one relevant to the case, document why a snapshot was included or excluded, and record whether decryption succeeded.
Rank #3
If a source contains several operating-system installations or user profiles, decide whether to process all of them or apply filters. A timeline that silently excludes a profile can look complete while answering only part of the question. Conversely, processing every volume can produce large output with unrelated events, so explain the scope in the examination notes.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Inspect and post-process the storage file
Use pinfo for a structural check
After collection, use pinfo to inspect the storage file. Check that the file opens, note the number and types of stored records reported by your version, review collection metadata, and look for errors or warnings. This is the point to catch an empty input, an unselected partition, a failed encrypted-volume access or a parser exception before relying on downstream exports.
Use psort to make events reviewable
psort reads the storage file, applies event filters and sorting, and can run automatic analysis. Select a time range, event type, parser or tag only when that selection answers a defined question; retain an unfiltered master storage file so later questions can be answered without recollection. Export a focused view for review, but keep the filter and sort settings with it.
Use psteal when a combined workflow is preferable
psteal combines log2timeline collection and psort-style post-processing. It is useful for a repeatable one-command workflow or triage, while separate stages are easier to audit when you need to inspect the storage file between collection and export. The choice is procedural, not a change in what the underlying parsers can extract.
Do not confuse image_export with timeline creation
image_export is a separate command-line tool for exporting file content from a storage image or device under filter criteria. It can support evidence review, but it does not replace log2timeline’s event extraction and storage-file workflow.
Choose collection scope: broad scan or targeted filters
| Approach | When it fits | Benefit | Risk or cost | What to document |
|---|---|---|---|---|
| Full recursive scan | The relevant artifacts are unknown, or correlation across many sources matters | Widest chance of finding related events and hidden context | More processing, more output and more irrelevant records | Source volumes, parser mode, exclusions and processing warnings |
| Targeted filters | The question identifies paths, users or artifact families | Focused output and a manageable review set | Excluded data cannot contribute; a narrow filter can miss context | Exact filter syntax, included paths, exclusions and reason for scope |
Neither approach is universally superior. Start broad when the hypothesis is uncertain; use a filter when the hypothesis and evidence-handling plan justify it. If you begin with a targeted run, consider a later broad collection when an unexplained gap appears.
Understand parser coverage before treating a gap as evidence
The project lists parser families for Windows, macOS, Linux and Android, along with browser artifacts, registry data, SQLite databases and text logs. Examples in the catalog include Chrome and Firefox history, iMessage databases, Windows ActivitiesCache, Windows Registry artifacts, system logs and cloud audit logs. A listed family does not guarantee that every version, schema or vendor variation will parse successfully.
The Supported Formats page explicitly says its information is based on version 20221212. The documentation site identifies a 20260928 build, but that build date does not update the catalog’s stated basis version. Treat the catalog as an orientation list, not a current compatibility matrix. Verify the parser list and behavior in your installed release, and test the exact artifact format before concluding that an absent event means the activity did not occur.
The Parsers and plugins guide explains the parser model. Collection uses analyzers, such as integrity-hash calculation or YARA scanning, as well as parsers and plugins that extract events from supported formats. A parser error, an encrypted database, a damaged file or a schema change can all affect what appears in the timeline.
Free tools Windows power users keep installed
One-click scans. No signup required.
Select an output for the next job
| Output | Best use | Practical consideration |
|---|---|---|
| Dynamic delimited text | Quick review in a text editor or spreadsheet | Confirm delimiter and encoding choices before sharing |
| JSON | Structured exchange and scripted analysis | Preserves named fields for downstream processing |
| JSON Lines | Streaming and event-by-event ingestion | Convenient for pipelines that process one record per line |
| KML | Events with geographic information | Useful only when location fields are present and meaningful |
| Legacy log2timeline format | Compatibility with older workflows | Use only when a downstream tool requires it |
| XLSX | Human review and spreadsheet-based annotation | Large timelines can become unwieldy; retain the storage file as the authoritative working set |
| OpenSearch | Searchable timeline collaboration and a Timesketch-related workflow | Configure the receiving OpenSearch environment and preserve the export settings |
The Output and formatting guide documents these writers. Choose based on who will consume the data: an examiner may need a filtered spreadsheet, an automated pipeline may need JSON Lines, and a collaborative timeline may use OpenSearch. Exporting does not improve parser coverage or correct an inaccurate source clock.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Review events as evidence, not as a verdict
Normalize time carefully
Compare event timestamps with the source system’s time-zone configuration, daylight-saving changes and clock drift. Keep the original timestamp and the displayed, normalized value where your tooling provides both. A visually ordered timeline can still be misleading when systems used different offsets.
Corroborate high-impact conclusions
Use multiple artifact types when an event matters: for example, compare a browser record with operating-system logs, file-system metadata or an application database. Plaso puts records on a common timeline; it does not establish that two records describe the same person or action. Preserve the source artifact and parser context so another examiner can inspect the underlying record.
Explain missing and duplicate events
Duplicate timestamps may represent independent records, copies in different locations or parser-generated variants. Missing events may result from unsupported formats, filters, encryption, deleted data, clock issues or collection errors. Report these possibilities and the checks you performed instead of treating a blank interval as proof of inactivity.
Troubleshoot common failures
- No events or an unexpectedly small file: use
pinfo, verify the input path and mount state, check that the intended partition or snapshot was selected, and review parser warnings. - Encrypted content is absent: rerun with the authorized credentials, confirm that the correct encrypted volume was selected, and record any volume that remained inaccessible.
- A known artifact is not parsed: verify the installed Plaso version and parser list, confirm the artifact’s exact format and schema, and check whether a filter excluded its path.
- Processing is impractical: narrow the collection with documented filters, process relevant volumes separately, or use a staged triage run before a full examination.
- Exports are hard to review: return to the storage file, apply a narrower time or event filter in
psort, and select an output suited to the recipient rather than editing the only copy. - Results cannot be reproduced: retain the source identifier, Plaso version, parser mode, filters, image-selection decisions, credentials outcome, warnings and output settings.
A defensible Plaso checklist
- Confirm authorization, acquisition integrity and the source’s time-zone context.
- Define the question and decide whether broad recursive collection or a documented filter is justified.
- Check parser and output support in the installed release; do not rely on an older catalog alone.
- Run
log2timeline.py --storage-file OUTPUT INPUTagainst the selected file, directory, image or device. - Resolve partition, snapshot and encryption prompts explicitly and record the choices.
- Inspect the resulting storage file with
pinfobefore analysis. - Use
psortfor reproducible filtering, sorting and analysis, or usepstealwhen its combined workflow fits the case. - Export dynamic text, JSON, JSON Lines, KML, legacy, XLSX or OpenSearch according to the next review or integration step.
- Correlate important events with source artifacts and independent evidence, documenting parser limitations and unexplained gaps.
Following these stages keeps Plaso in its proper role: a repeatable event-extraction and timeline-correlation layer inside a larger forensic examination.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
