Plaso
Plaso: A focused, free engine for turning diverse forensic evidence into searchable timelines. Ranked #20 of 30 in Digital Forensics Software by our editors (7.3/10); pricing: Free plan; best for timeline-focused forensic analysis.
At a glance
- Editor score7.3 / 10
- PricingFree plan
- Best forTimeline-focused forensic analysis
- Free planYes
- Paid fromFree
- Mobile forensicsYes
- Facts checked20 Sep 2026
Where it wins
- Processes images, devices, files, logs, databases, and mobile artifacts
- Supports targeted collection, filtering, sorting, hashing, and many exports
- Runs on Linux, macOS, Windows, and Docker with OpenSearch and Timesketch support
Where it doesn't
- Does not provide case collaboration features
- Lacks broader investigation-management capabilities
- Command-line tools may require technical forensic workflows
Our verdict on Plaso
Plaso is a Python-based, open-source digital-forensics engine for investigators and analysts who need to correlate timestamped evidence. Its central task is creating super timelines from individual files, directories, storage-media images, devices, logs, databases, operating-system artifacts, and mobile evidence. The toolset includes log2timeline for extraction, psort for filtering and analysis, psteal for combined extraction and processing, pinfo for inspecting Plaso storage files, and image_export for extracting files from forensic images.
Its strongest area is evidence processing depth. Plaso includes parsers and analysis plug-ins, filters and sorts extracted events, and supports targeted collection through forensic-artifact definitions and YAML filters. It can extract files from forensic images using path, extension, signature, and time filters, while hashing support covers MD5, SHA-1, and SHA-256. Export options include CSV, JSON, JSON Lines, KML, TLN, XLSX, OpenSearch, and Timesketch, giving teams several paths for review, sharing, and downstream analysis.
Plaso fits teams seeking a free, open-source timeline and artifact-processing engine across Linux, macOS, Windows, or Docker. OpenSearch and Timesketch integrations extend its output options, but the product's focus remains evidence extraction and timeline analysis rather than case collaboration or broader investigation management. The command-line orientation also suits technically capable forensic workflows more than teams seeking a guided case workspace. The supported-formats documentation is based on version 20221212, so deployment planning should account for the release in use. Choose Plaso when timeline construction and diverse artifact inputs are the priority; choose a broader investigation-management product when collaboration and case administration are central.
Your product? Our editors can test Plaso in depth and publish a review, labelled as paid · from $149/mo →
Plaso pricing
Plaso fact sheet
| Free plan | Yes |
|---|---|
| Paid from | Free |
| Evidence sources | Storage-media images, files, directories, devices, logs, databases, Windows Registry data, Android and iOS artifacts |
| Mobile forensics | Yes |
| Disk imaging | Yes |
| Memory forensics | Not verified |
| Case collaboration | Not verified |
| Supported platforms | Linux, macOS, Windows, Docker |
| Export formats | CSV, JSON, JSON Lines, KML, TLN, XLSX, OpenSearch, Timesketch |
| Deployment | Self-hosted |
| Platforms | Windows, macOS, Linux |
| Support | Community, Docs, Tickets |
| Built for | Solo, Small business, Mid-market, Enterprise (editorial estimate) |
| Integrations | 2 integrations: OpenSearch, Timesketch |
| Pricing | Free plan |
| Website | plaso.readthedocs.io |
| Facts checked | 20 Sep 2026 |
Plaso integrations
Plaso lists 2 integrations on its own site.
- OpenSearch
- Timesketch
Alternatives to Plaso
- AutopsyA free, cross-platform platform for broad, case-based digital investigations.9.4
- Paraben E3 Forensic PlatformA broad evidence-processing platform for teams handling varied digital investigations.9.3
- Magnet AXIOM CyberA broad investigation platform for collecting and analyzing endpoint, mobile, cloud, and memory evidence.9.2
Used Plaso? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used Plaso for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
Plaso is listed in our Digital Forensics Software directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/plaso/"><img src="https://www.itechguides.com/best/badge/plaso.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update