stefan/plaso-rubanetra
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
1 Commit 1 Branch 0 Tags 75 MiB
Python 59.7%
VHDL 39.9%
Shell 0.4%
master
Go to file
Stefan 0da6783a45 Import from old repository
2020-04-06 18:48:34 +02:00
config Import from old repository 2020-04-06 18:48:34 +02:00
extra Import from old repository 2020-04-06 18:48:34 +02:00
plaso Import from old repository 2020-04-06 18:48:34 +02:00
test_data Import from old repository 2020-04-06 18:48:34 +02:00
tools Import from old repository 2020-04-06 18:48:34 +02:00
utils Import from old repository 2020-04-06 18:48:34 +02:00
.gitignore Import from old repository 2020-04-06 18:48:34 +02:00
.travis.yml Import from old repository 2020-04-06 18:48:34 +02:00
ACKNOWLEDGEMENTS Import from old repository 2020-04-06 18:48:34 +02:00
AUTHORS Import from old repository 2020-04-06 18:48:34 +02:00
LICENSE Import from old repository 2020-04-06 18:48:34 +02:00
MANIFEST.in Import from old repository 2020-04-06 18:48:34 +02:00
plasov1.2.0-rubanetra0.0.6-distribution.zip Import from old repository 2020-04-06 18:48:34 +02:00
README Import from old repository 2020-04-06 18:48:34 +02:00
README.md Import from old repository 2020-04-06 18:48:34 +02:00
run_tests.py Import from old repository 2020-04-06 18:48:34 +02:00
setup.cfg Import from old repository 2020-04-06 18:48:34 +02:00
setup.py Import from old repository 2020-04-06 18:48:34 +02:00

README.md

plaso (Plaso Langar Að Safna Öllu)

super timeline all the things

Various statistics for the tool:

Code Coverage: Coverage Status

Build Status: Build Status

In short, plaso is a Python-based backend engine for the tool [log2timeline] (http://plaso.kiddaland.net "Plaso home of the super timeline").

A longer version

log2timeline is a tool designed to extract timestamps from various files found on a typical computer system(s) and aggregate them.

The initial purpose of plaso was to collect all timestamped events of interest on a computer system and have them aggregated in a single place for computer forensic analysis (aka Super Timeline).

However plaso has become a framework that supports:

  • adding new parsers or parsing plug-ins;
  • adding new analysis plug-ins;
  • writing one-off scripts to automate repetitive tasks in computer forensic analysis or equivalent.

And is moving to support:

  • adding new general purpose parses/plugins that may not have timestamps associated to them;
  • adding more analysis context;
  • tagging events;
  • allowing more targeted approach to the collection/parsing.

Also see: