Plaso review
A focused, free engine for turning diverse forensic evidence into searchable timelines.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Plaso is a Python-based, open-source digital-forensics engine for investigators and analysts who need to correlate timestamped evidence. Its central task is creating super timelines from individual files, directories, storage-media images, devices, logs, databases, operating-system artifacts, and mobile evidence. The toolset includes log2timeline for extraction, psort for filtering and analysis, psteal for combined extraction and processing, pinfo for inspecting Plaso storage files, and image_export for extracting files from forensic images.
Its strongest area is evidence processing depth. Plaso includes parsers and analysis plug-ins, filters and sorts extracted events, and supports targeted collection through forensic-artifact definitions and YAML filters. It can extract files from forensic images using path, extension, signature, and time filters, while hashing support covers MD5, SHA-1, and SHA-256. Export options include CSV, JSON, JSON Lines, KML, TLN, XLSX, OpenSearch, and Timesketch, giving teams several paths for review, sharing, and downstream analysis.
Plaso fits teams seeking a free, open-source timeline and artifact-processing engine across Linux, macOS, Windows, or Docker. OpenSearch and Timesketch integrations extend its output options, but the product's focus remains evidence extraction and timeline analysis rather than case collaboration or broader investigation management. The command-line orientation also suits technically capable forensic workflows more than teams seeking a guided case workspace. The supported-formats documentation is based on version 20221212, so deployment planning should account for the release in use. Choose Plaso when timeline construction and diverse artifact inputs are the priority; choose a broader investigation-management product when collaboration and case administration are central.
Plaso pros and cons
- Where it wins
- Processes images, devices, files, logs, databases, and mobile artifacts
- Supports targeted collection, filtering, sorting, hashing, and many exports
- Runs on Linux, macOS, Windows, and Docker with OpenSearch and Timesketch support
- Where it doesn't
- Does not provide case collaboration features
- Lacks broader investigation-management capabilities
- Command-line tools may require technical forensic workflows
Plaso fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update