skills.rest
rjonhaas
rjonhaasCOMMUNITY
Explore all skills by this author →
GitHub

Timeline Generation (Plaso / log2timeline)

Generate correlated super-timelines from digital evidence using log2timeline and Plaso.

1|Updated Apr 25, 2026
Search Tags:#timeline#dfir#artifact parsing#plaso#log2timeline#forensic triage#windows evtx
One-click install
npx skills add https://github.com/rjonhaas/SIFTics --skill timeline-generation-plaso-log2timeline
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: Timeline Generation (Plaso / log2timeline)
Source: https://github.com/rjonhaas/SIFTics/tree/main/skills/plaso-timeline
Command: npx skills add https://github.com/rjonhaas/SIFTics --skill timeline-generation-plaso-log2timeline

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It solves the problem of correlating large volumes of digital evidence into a single, chronological timeline without manual searching across many artifact sources.

Core Features & Use Cases

  • Super-timeline creation from diverse evidence: Ingest disk images, mounted filesystems, and individual files into a unified Plaso storage file for Windows, Linux, web history, and Android artifacts.
  • Filtering, sorting, and exporting for pivoting: Export timelines to CSV/JSON/dynamic formats and filter by time ranges, keywords, or specific parser sources for rapid investigation.
  • Focused ingest and extraction to reduce processing time: Run targeted parser sets or extract files from images to generate timelines when full ingestion is too slow or too broad.

Use Case: After mounting a Windows EWF/RAW image, generate a UTC super-timeline including VSS-preserved artifacts, then export a filtered CSV focused on PowerShell-related events within the suspected attack window.

Quick Start

Use the Timeline Generation skill to ingest a mounted Windows filesystem into a Plaso storage file and export a CSV timeline for analysis, then open the CSV in Timeline Explorer.

Frequently Asked Questions about Timeline Generation (Plaso / log2timeline)

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I build a super-timeline from Windows EVTX and registry artifacts for forensic triage?▼

To build a super-timeline for forensic triage, ingest Windows EVTX, registry hives, and browser history into a unified Plaso storage file. This correlates diverse digital evidence chronologically without manual searching across artifact sources.

What's the best way to speed up Plaso log2timeline ingestion for large disk images?▼

Speed up log2timeline ingestion by running targeted parser sets or extracting specific files from disk images. This focused ingest approach reduces processing time when full ingestion of large evidence sets is too slow or broad.

How does VSS-aware timeline generation work with Plaso?▼

VSS-aware timeline generation preserves Volume Shadow Copy artifacts by ingesting them into Plaso storage. This ensures timeline analysis captures deleted or overwritten files from restore points during the forensic investigation.

Can I filter and export a Plaso super-timeline to CSV or JSON for specific time ranges?▼

You can export and filter Plaso super-timelines to l2tcsv, dynamic, or JSON formats using psort.py. Apply time range, keyword, or parser source filters to pivot on specific events like PowerShell activity during an attack window.

Does Plaso support UTC normalization and deterministic parser selection across Linux and Android evidence?▼

Plaso enforces deterministic parser selection and UTC normalization across Linux, Windows, and Android evidence sources. Validate your storage file creation and parser mappings using pinfo.py before exporting the final timeline.

Why does my log2timeline super-timeline export need validation with pinfo.py before analysis?▼

Validate your log2timeline super-timeline with pinfo.py to confirm parser selection, UTC normalization, and storage integrity. This ensures the exported timeline accurately reflects ingested artifacts before pivoting in Timeline Explorer.

Related Skills

Explore More Data & Analytics Skills→
SherifEldeebSherifEldeeb
5

timeline-forensics

Aggregate disk, memory, log, PCAP, and registry artifacts into forensic timelines.

Community
Advanced
bpnrockstarbpnrockstar

forensics

Analyze disk images, memory dumps, and packet captures for incident response.

Community
Advanced
ro9er117911ro9er117911
1

via-export

Export filtered MATSim simulation results into Via-ready visualization files.

Community
Advanced
LeoWSY-hashblueLeoWSY-hashblue
3

dfir

Correlates EVTX, PCAP, memory, and MFT artifacts to reconstruct Windows incident timelines.

Community
Advanced