Plaso / log2timeline
The Plaso project · 2026
Access and status
Cost
Free
Free to read or download at source. No account, no purchase.
Status
Current
Current as at the verification date below. Standards and tools both move — confirm at source before you rely on it.
What it is
An open-source Python framework that extracts timestamps from hundreds of artefact types across a disk image or directory and writes them into a single normalised storage file. log2timeline is the extraction front end; psort and psteal filter, sort, and export the result.
Who it is for, and when
Plaso is the standard way to build a super timeline — every dated event from file system metadata, event logs, browser history, prefetch, registry, and application logs merged into one ordered sequence. It is where you go when the question is sequence and causation rather than the content of a single file, and it is the usual feeder for Timesketch. Running it over a whole image and then filtering is often faster than deciding in advance which artefacts matter.
What it does not cover
Plaso produces an enormous, noisy event set and does no interpretation — deciding which of several million events matter is entirely the examiner's job, and timestamp semantics (created, modified, accessed, and what each means on which file system) are not resolved for you. It is not an acquisition tool, not a reporting tool, and its output is not readable without psort or a front end such as Timesketch.
Go to the source
Open at plaso.readthedocs.io (opens in a new tab)https://plaso.readthedocs.io/
Details
- Type
- Tool
- Written for
- Working examinerAdvancedWorking examiner, Advanced
- Publisher
- The Plaso project
- Year
- 2026
- Topics
- timeline, log-analysis, windows, registry, browser-forensics, open-source, scripting
- Checked at source
Related entries
A large collection of free single-purpose Windows artefact parsers — among them MFTECmd, PECmd, LECmd, JLECmd, AmcacheParser, SBECmd, EvtxECmd, RECmd, and the Timeline Explorer and Registry Explorer GUIs. The tools are still distributed from ericzimmerman.github.io, with a Get-ZimmermanTools helper that pulls the current set.
David Cowen's daily-blog project, running to over 800 numbered posts plus the Sunday Funday challenges, Solution Saturday write-ups and the Forensic Lunch video series, covering Windows artifacts, NTFS internals, cloud logging and DFIR programming.
Two open-source Rust tools that apply Sigma and their own rules directly to Windows event log (EVTX) files and produce a prioritised, timeline-ordered set of hits. Hayabusa comes from Yamato Security; Chainsaw is published by WithSecure (the repository now lives under WithSecureOpenSource). Both are actively released.
RegRipper
FreeAn open-source Perl tool that runs a library of plugins against Windows registry hives and reports the values that matter forensically, with each plugin documenting the key it read. RegRipper 3.0 is the current line and the repository remains actively updated.
A download library of reference posters and cheat sheets, of which 37 are filed under Digital Forensics and Incident Response — artifact maps, timestamp reference tables, tool command references and filter syntax sheets. Download requires a free SANS account rather than payment.