Plaso (log2timeline)
Apache-2.0🔬 Digital Forensics · Python
Plaso (log2timeline) is a super timeline creation engine that extracts timestamps from multiple forensic artifact sources into a single timeline. It supports a wide range of log and artifact formats, facilitating comprehensive forensic analysis. Written in Python, Plaso is widely used in digital forensics for its ability to correlate events from diverse data sources, providing a unified view of system activities over time.
Installation
$ pip install plasoTags
Details
- Category
- 🔬 Digital Forensics
- Language
- Python
- Repository
- log2timeline/plaso
- License
- Apache-2.0
- Platforms
- 🐧linux🍎macos🪟windows
Links
More in Digital Forensics
Volatility 3
PythonAdvanced memory forensics framework. Extracts artifacts from RAM dumps — processes, network connections, registry.
Autopsy
JavaDigital forensics platform with GUI. Disk image analysis, timeline analysis, keyword search, hash filtering.
Ghidra
JavaNSA's reverse engineering framework. Disassembly, decompilation, graphing, and scripting for binary analysis.
Binwalk
PythonFirmware analysis tool. Searches binary images for embedded files, executables, and file systems.
YARA
CPattern matching swiss knife for malware researchers. Create rules to identify and classify malware samples.
Velociraptor
GoEndpoint visibility and collection tool. Hunt for artifacts across thousands of endpoints simultaneously.