performing-timeline-reconstruction-with-plaso

Run log2timeline.py against a disk image to produce a .plaso storage file, then use psort.py to filter and export events to CSV or JSON Lines. You can restrict parsing with --parsers or --filter-file to focus on relevant artifacts.

Plaso processes forensic images in raw (dd), E01, and VMDK formats. It parses over 100 artifact types including MFT, USN Journal, Windows event logs, Prefetch, registry hives, and browser history.

Use a --filter-file during log2timeline to limit collection to key paths, or apply psort date-range and source-type filters during export. Pivot from known anchor events like malware execution rather than reading the timeline top to bottom.

Yes, Timesketch accepts .plaso storage files directly via the timesketch_importer CLI or web upload, and also ingests JSON Lines exports from psort. Once imported you can search, tag events, and run Sigma analyzers.

Timestamp errors usually come from incorrect timezone handling or parser inference; always pass the correct --timezone and verify the image's TimeZoneInformation registry value. Also compare $STANDARD_INFORMATION versus $FILE_NAME MFT times to detect timestomping.

Timelines only show artifacts covered by the parsers and sources actually processed, so deleted or rotated logs create coverage gaps. Single-artifact timestamps can be misleading, so confirm pivotal events with at least two independent artifact types.