139 lines
2.9 KiB
Plaintext
139 lines
2.9 KiB
Plaintext
|
Acknowledgements: plaso
|
||
|
|
|
||
|
|
Copyright 2012 The Plaso Project Authors.
|
||
|
|
Please see the AUTHORS file for details on individual authors.
|
||
|
|
|
||
|
|
Plaso is a Python rewrite of the log2timeline Perl version.
|
||
|
|
|
||
|
|
Plaso is developed and maintained by:
|
||
|
|
* Kristinn Gudjonsson
|
||
|
|
* Eric Mak
|
||
|
|
* Joachim Metz
|
||
|
|
|
||
|
|
Plaso depends on various other projects. So thanks to the authors
|
||
|
|
and others involved with these projects:
|
||
|
|
* Python and modules
|
||
|
|
* libyaml
|
||
|
|
* iPython
|
||
|
|
* PyInstaller
|
||
|
|
* the SleuthKit
|
||
|
|
* pytsk
|
||
|
|
* Hachoir (not included in binary release)
|
||
|
|
|
||
|
|
Thanks to contributors (alphabetically based on last name):
|
||
|
|
* Brian Baskin
|
||
|
|
* Parsers
|
||
|
|
* BEncode
|
||
|
|
* Java IDX parser
|
||
|
|
* Johan Berggren
|
||
|
|
* SQLite plugins
|
||
|
|
* Zeitgeist activity database
|
||
|
|
* Petter Bjelland
|
||
|
|
* Parsers
|
||
|
|
* Firefox Cache
|
||
|
|
* Ashley Holtz
|
||
|
|
* Parsers
|
||
|
|
* IIS
|
||
|
|
* Adobe ColdFusion
|
||
|
|
* Dominique Kilman
|
||
|
|
* Parsers
|
||
|
|
* PCAP
|
||
|
|
* Marc Leavitt
|
||
|
|
* Parsers
|
||
|
|
* PL-SQL recall (PLSRecall.dat)
|
||
|
|
* Preston Miller
|
||
|
|
*Windows Registry Plugins
|
||
|
|
* SAM Users
|
||
|
|
* Shutdown
|
||
|
|
* USB
|
||
|
|
* Joaquin Moreno Garijo
|
||
|
|
* Parsers
|
||
|
|
* ASL
|
||
|
|
* BSM
|
||
|
|
* Cups IPP
|
||
|
|
* Mac AppFirewall
|
||
|
|
* Mac KeyChain
|
||
|
|
* Mac Securityd
|
||
|
|
* mac_wifi.log
|
||
|
|
* utmp
|
||
|
|
* utmpx
|
||
|
|
* SQLite plugins
|
||
|
|
* Skype
|
||
|
|
* Plist plugins
|
||
|
|
* Airport
|
||
|
|
* Apple Account
|
||
|
|
* Install History
|
||
|
|
* Mac User
|
||
|
|
* Software Update
|
||
|
|
* Spotlight
|
||
|
|
* TimeMachine
|
||
|
|
* David Nides (@davnads)
|
||
|
|
* Output modules
|
||
|
|
* 4n6time SQLite, with thanks to Eric Wong for assistance
|
||
|
|
* 4n6time MySQL
|
||
|
|
* Parsers
|
||
|
|
* Hachoir (meta data)
|
||
|
|
* OLECF
|
||
|
|
* OMXL
|
||
|
|
* Symantec AV Log
|
||
|
|
* timelib StringToDatetime function
|
||
|
|
* SQLite plugins
|
||
|
|
* Google Drive
|
||
|
|
* Windows Registry plugins
|
||
|
|
* Office MRU
|
||
|
|
* Outlook
|
||
|
|
* Terminal Server Client (RDP)
|
||
|
|
* Typed Paths
|
||
|
|
* Typed URLs
|
||
|
|
* USBStor
|
||
|
|
* Win7 UserAssist
|
||
|
|
* WinRar
|
||
|
|
* Patrik Nisen
|
||
|
|
* For providing input for parsing the DestList stream for the automatic
|
||
|
|
destinations OLECF plugin
|
||
|
|
* Francesco Picasso
|
||
|
|
* Parsers
|
||
|
|
* PopContest
|
||
|
|
* SELinux
|
||
|
|
* SkyDriveLog
|
||
|
|
* SkyDriveLogErr
|
||
|
|
* XChatLog
|
||
|
|
* XChatScrollBack
|
||
|
|
* Jordi Sanchez
|
||
|
|
* For providing:
|
||
|
|
* binplist
|
||
|
|
* object filter
|
||
|
|
* Elizabeth Schweinsberg
|
||
|
|
* Parsers
|
||
|
|
* McAfee AV Access Protection Log
|
||
|
|
* Windows Registry plugins
|
||
|
|
* MSIE zones
|
||
|
|
* Marc Séguin
|
||
|
|
* Windows Registry plugins
|
||
|
|
* CCleaner
|
||
|
|
* Keith Wall
|
||
|
|
* SQLite plugins
|
||
|
|
* Android calls database
|
||
|
|
* Android sms database
|
||
|
|
* updates to the timezone transformation
|
||
|
|
|
||
|
|
Test data:
|
||
|
|
|
||
|
|
Copied with permission from the GRR project: https://github.com/google/grr
|
||
|
|
* History
|
||
|
|
* index.dat
|
||
|
|
* places.sqlite
|
||
|
|
|
||
|
|
Copied with permission granted by Jerome Marty.
|
||
|
|
* WUAUCLT.EXE-830BCC14.pf
|
||
|
|
|
||
|
|
Copied with permission granted by Rob Lee.
|
||
|
|
Copyright SANS Institute - Digital Forensics and Incident Response.
|
||
|
|
* 1b4dd67f29cb1962.automaticDestinations-ms
|
||
|
|
* 5afe4de1b92fc382.customDestinations-ms
|
||
|
|
* example.lnk
|
||
|
|
* SysEvent.Evt
|
||
|
|
* System.evtx
|
||
|
|
* Ntuser.dat (multiple instances)
|
||
|
|
* Windows.edb
|