Plaso (log2timeline)
Plaso (log2timeline) extracts timestamps from many artefacts in a disk image and merges them into one super-timeline.
Legal & ethical use. Use this tool only on systems, networks and data that you own or have explicit written permission to test. Unauthorised access or scanning can break computer-misuse laws (for example Pakistan's Prevention of Electronic Crimes Act, 2016, and equivalents elsewhere). Practise in your own lab or in authorised environments such as CTFs.
What it is used for
- Build a timeline of events from a forensic image
- Correlate file, browser and log activity
Key features
- Hundreds of parsers
- Super-timeline output
- Integration with Timesketch
Installation
See the documentation for packages or Docker use.
Beginner usage guide
Process an evidence image with log2timeline into a storage file, then filter and export with psort.
Example commands
Run these only against your own lab or authorised targets. Placeholder addresses such as 192.0.2.x are documentation ranges.
Create a timeline storage file
log2timeline.py --storage-file evidence.plaso disk.imgParses artefacts from the image and writes events into evidence.plaso.
References
Source verification
Last reviewed: 2026-10-27
Links checked over HTTP: 2026-10-27 07:51 UTC — official: 200, docs: 200, repo: 200
Commands were written from the official documentation and have not been executed on this site; test them in your lab.