Skip to content

Plaso

Plaso (Plaso langar að safna öllu) is the Python based back-end engine used by tools such as log2timeline for automatic creation of a super timelines. The goal of log2timeline (and thus Plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers and related systems, such as network equipment to produce a single correlated timeline. This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system. Plaso is intended to be applied for creating super timelines but also supports creating targeted timelines.

Supported Formats

The information below is based of version 20221212. See Plaso documentation for the most up to date information.

Storage Media Image File Formats

Storage Media Image File Format support is provided by dfVFS.

Volume System Formats

Volume System Format support is provided by dfVFS.

File System Formats

File System Format support is provided by dfVFS.

File formats

Bencode file formats

  • Transmission BitTorrent activity file
  • uTorrent active torrent file
  • Google Analytics __utma cookie
  • Google Analytics __utmb cookie
  • Google Analytics __utmt cookie
  • Google Analytics __utmz cookie

Compound ZIP file formats

  • OpenXML (OXML) file

ESE database file formats

  • Internet Explorer WebCache ESE database (WebCacheV01.dat, WebCacheV24.dat) file
  • System Resource Usage Monitor (SRUM) ESE database file
  • Windows 8 File History ESE database file
  • Windows User Access Logging ESE database file

JSON-L log file formats

  • AWS CloudTrail logs
  • Azure Activity logs
  • Azure Application Gateway access log
  • Docker container configuration file
  • Docker container log file
  • Docker layer configuration file
  • Google Cloud (GCP) log
  • iOS Application Privacy report
  • Microsoft (Office) 365 audit log

OLE Compound File formats

  • Automatic destinations jump list OLE compound file or .automaticDestinations-ms file
  • Document summary information (\0x05DocumentSummaryInformation)
  • Summary information (\0x05SummaryInformation) (top-level only)

Property list (plist) formats

  • Airport plist file
  • Apple account information plist file
  • Apple iOS Car Play application plist file
  • iPod, iPad and iPhone plist file
  • Launchd plist file
  • MacOS Bluetooth plist file
  • MacOS installation history plist file
  • MacOS software update plist file
  • MacOS TimeMachine plist file
  • MacOS user plist file
  • Safari history plist file
  • Spotlight searched terms plist file
  • Spotlight volume configuration plist file

SQLite database file formats

  • Android call history SQLite database (contacts2.db) file
  • Android text messages (SMS) SQLite database (mmssms.dbs) file
  • Android WebViewCache SQLite database file
  • Android WebView SQLite database file
  • Dropbox sync history database (sync_history.db) file
  • Google Chrome browsing and downloads history
  • Google Chrome 17 - 65 cookies SQLite database file
  • Google Chrome 27 and later history SQLite database file
  • Google Chrome 66 and later cookies SQLite database file
  • Google Chrome 8 - 25 history SQLite database file
  • Google Chrome autofill SQLite database (Web Data) file
  • Google Chrome extension activity SQLite database file
  • Google Drive snapshot SQLite database (snapshot.db) file
  • Google Hangouts conversations SQLite database (babel.db) file
  • iOS Kik messenger SQLite database (kik.sqlite) file
  • iOS network usage SQLite database (netusage.sqlite) file
  • iOS powerlog SQLite database (CurrentPowerlog.PLSQL) file
  • iOS Screen Time SQLite database (RMAdminStore-Local.sqlite)
  • Kodi videos SQLite database (MyVideos.db) file
  • MacOS and iOS iMessage database (chat.db, sms.db) file
  • MacOS application usage SQLite database (application_usage.sqlite) file
  • MacOS document revisions SQLite database file
  • MacOS Duet/KnowledgeC SQLites database file
  • MacOS launch services quarantine events database SQLite database file
  • MacOS MacKeeper cache SQLite database file
  • MacOS Notes SQLite database (NotesV7.storedata) file
  • MacOS Notification Center SQLite database file
  • MacOS Transparency, Consent, Control (TCC) SQLite database (TCC.db) file
  • Mozilla Firefox cookies SQLite database file
  • Mozilla Firefox browsing and downloads history
  • Mozilla Firefox downloads SQLite database (downloads.sqlite) file
  • Mozilla Firefox history SQLite database (places.sqlite) file
  • Safari history SQLite database (History.db) file
  • Skype SQLite database (main.db) file
  • Tango on Android profile SQLite database file
  • Tango on Android TC SQLite database file
  • Twitter on Android SQLite database file
  • Twitter on iOS 8 and later SQLite database (twitter.db) file
  • Windows 10 Timeline SQLite database (ActivitiesCache.db) file
  • Windows diagnosis EventTranscript SQLite database (EventTranscript.db) file
  • Zeitgeist activity SQLite database file

Text-based log file formats

  • Advanced Packaging Tool (APT) History log file
  • Android logcat file
  • Apache access log (access.log) file
  • AWS ELB Access log file
  • Bash history file
  • Confluence access log (access.log) file
  • Debian package manager log (dpkg.log) file
  • Google Drive Sync log file
  • Google-formatted log file
  • iOS lockdown daemon log
  • iOS sysdiag log
  • iOS sysdiagnose logd file
  • MacOS Application firewall log (appfirewall.log) file
  • MacOS security daemon (securityd) log file
  • MacOS Wi-Fi log (wifi.log) file
  • Microsoft IIS log file
  • OneDrive (or SkyDrive) version 1 log file
  • OneDrive (or SkyDrive) version 2 log file
  • Popularity Contest log file
  • PostgreSQL application log file
  • Santa log (santa.log) file
  • SELinux audit log (audit.log) file
  • Snort3/Suricata fast-log alert log (fast.log) file
  • Sophos anti-virus log file (SAV.txt) file
  • System Center Configuration Manager (SCCM) client log file
  • System log (syslog) file
  • Viminfo file
  • vsftpd log file
  • Windows Firewall log file
  • Windows SetupAPI log file
  • XChat log file
  • XChat scrollback log file
  • ZSH extended history file

Windows Registry formats

  • AMCache (AMCache.hve)
  • Application Compatibility Cache or AppCompatCache Registry data
  • Background Activity Moderator (BAM) Registry data
  • BagMRU (or ShellBags) Registry data
  • Boot Execution Registry data
  • CCleaner Registry data
  • Microsoft Internet Explorer zone settings Registry data
  • Microsoft Office MRU Registry data
  • Microsoft Outlook search MRU Registry data
  • Most Recently Used (MRU) Registry data
  • Run and RunOnce Registry data
  • Security Accounts Manager (SAM) users Registry data
  • Terminal Server Client Connection Registry data
  • Terminal Server Client Most Recently Used (MRU) Registry data
  • User Assist Registry data
  • Windows boot verification Registry data
  • Windows drivers and services Registry data
  • Windows Explorer mount points Registry data
  • Windows Explorer Programs Cache Registry data
  • Windows Explorer typed URLs Registry data
  • Windows last shutdown Registry data
  • Windows log-on Registry data
  • Windows network drives Registry data
  • Windows networks (NetworkList) Registry data
  • Windows Task Scheduler cache Registry data
  • Windows time zone Registry data
  • Windows USB device Registry data
  • Windows USB Plug And Play Manager USBStor Registry data
  • Windows version (product) Registry data
  • WinRAR History Registry data

Analysis plugins

  • file_hashes: Lists all the hashes for all files processed
  • tagging: rule-based tagging
  • virustotal: Looks up PE files using the VirusTotal API
  • viper: Looks up PE files in a Viper instance

History

Plaso is a Python-based rewrite of the Perl-based log2timeline initially created by Kristinn Gudjonsson and extended by the contribution of various others.

Plaso builds upon the The Sleuth Kit, pytsk, libyal, dfVFS and various other projects.

This section contains several tools that can help in analyzing Plaso's timeline output:

  • 4n6time, formerly "l2t_Review", which is a cross-platform forensic tool for timeline creation and review. This tool appears to be abandoned.
  • Timesketch a collaborative forensic timeline analysis.

See Also