Plaso 超级时间线分析

---
name: plaso-timeline
description: Build, inspect, filter, merge, and export forensic super-timelines with Plaso on SANS SIFT using log2timeline.py, psort.py, pinfo.py, psteal.py, and image_export.py, with UTC-oriented and evidence-preserving workflows.
---

# Plaso Timeline Analysis

Use this skill for forensic super-timeline generation and analysis with the Plaso tool suite on SANS SIFT. Keep source evidence read-only, use UTC unless the case explicitly requires another timezone, and preserve the original `.plaso` storage file when it is created.

## Tools

- `log2timeline.py` — parse evidence into a Plaso storage file.
- `psort.py` — filter, sort and export stored events.
- `pinfo.py` — inspect storage metadata and parser statistics.
- `psteal.py` — parse and export directly without retaining an intermediate storage file.
- `image_export.py` — extract targeted files from supported images.

The Protocol SIFT environment expects a Plaso build from the GIFT stable repository rather than the incompatible Ubuntu package combination commonly encountered on SIFT.

## Workflow

### 1. Inspect the source

Before ingestion, confirm the image, mount or source directory and document its hash or acquisition metadata.

```bash
file <source>
pinfo.py <existing.plaso>
```

### 2. Create a persistent super-timeline

For modern Windows evidence:

```bash
log2timeline.py \
  --storage-file ./analysis/<CASE_ID>.plaso \
  --parsers win10 \
  --hashers md5,sha256 \
  --timezone UTC \
  <source>
```

If Volume Shadow Copies are relevant and supported by the source:

```bash
log2timeline.py \
  --storage-file ./analysis/<CASE_ID>.plaso \
  --parsers win10 \
  --vss-stores all \
  --timezone UTC \
  <source>
```

Common parser families include modern Windows, legacy Windows, generic Windows, Linux, browser history and Android. Verify available names on the installed version instead of assuming a parser exists:

```bash
log2timeline.py --parsers list
```

### 3. Use targeted ingest when a full image is unnecessary

Examples:

```bash
log2timeline.py --storage-file ./analysis/<CASE_ID>_evtx.plaso --parsers winevtx --timezone UTC ./exports/evtx/
log2timeline.py --storage-file ./analysis/<CASE_ID>_reg.plaso  --parsers winreg  --timezone UTC ./exports/registry/
log2timeline.py --storage-file ./analysis/<CASE_ID>_fls.plaso  --parsers mactime --timezone UTC ./analysis/bodyfile.txt
```

Use targeted ingestion to reduce runtime and noise when the investigative question is narrow.

### 4. Validate parser results

Always inspect a newly created storage file:

```bash
pinfo.py ./analysis/<CASE_ID>.plaso
pinfo.py -v ./analysis/<CASE_ID>.plaso
```

Expected artifacts with zero parser hits usually indicate a source, parser-set or mount problem. Do not proceed as if the absence of events proves absence of activity.

### 5. Export the timeline

```bash
psort.py -o l2tcsv -w ./exports/<CASE_ID>_timeline.csv ./analysis/<CASE_ID>.plaso
psort.py -o dynamic -w ./exports/<CASE_ID>_dynamic.csv ./analysis/<CASE_ID>.plaso
psort.py -o json -w ./exports/<CASE_ID>_timeline.json ./analysis/<CASE_ID>.plaso
```

### 6. Filter around the investigative question

Filter by date, parser or content rather than reviewing a huge timeline blindly.

```bash
psort.py -o l2tcsv -w ./exports/<CASE_ID>_window.csv ./analysis/<CASE_ID>.plaso \
  "date > '2026-01-01 00:00:00' AND date < '2026-01-02 00:00:00'"

psort.py -o l2tcsv -w ./exports/<CASE_ID>_powershell.csv ./analysis/<CASE_ID>.plaso \
  "message contains 'powershell'"

psort.py -o l2tcsv -w ./exports/<CASE_ID>_slice.csv --slice '2026-01-01 12:00:00' ./analysis/<CASE_ID>.plaso
```

When using free-form filters, confirm syntax against the installed `psort.py` version and preserve the filter expression in case notes.

### 7. Merge related timeline sources

If disk, EVTX, registry or bodyfile ingestion was performed separately, merge them into one chronological export:

```bash
psort.py -o l2tcsv -w ./exports/<CASE_ID>_merged.csv \
  ./analysis/<CASE_ID>_disk.plaso \
  ./analysis/<CASE_ID>_evtx.plaso \
  ./analysis/<CASE_ID>_fls.plaso
```

### 8. Fast path with psteal

Use `psteal.py` when a quick export is needed and keeping the intermediate `.plaso` file is unnecessary:

```bash
psteal.py --source <source> --output-format l2tcsv --write ./exports/<CASE_ID>_timeline.csv --parsers win10 --timezone UTC
```

For major cases, prefer a persistent `.plaso` file because it supports repeatable filtering without re-ingesting the evidence.

### 9. Targeted extraction

Use `image_export.py` for specific evidence classes when supported by the installed version, for example event logs, registry hives, prefetch or browser databases. Record the selection criteria so the extraction can be repeated.

## Analysis guidance

- Normalize timestamps before comparing sources.
- Pivot around known-good anchor events such as logons, process creation, file creation or network artifacts.
- Correlate high-value events across independent parsers instead of trusting one source.
- Separate source time, recorded event time and analyst export time.
- Preserve raw exports and create filtered analyst views as separate files.
- A missing event can result from parser coverage, log retention or artifact cleanup; document the gap.

## Output layout

Recommended paths:

- `./analysis/*.plaso` — persistent storage files.
- `./exports/*_timeline.csv` — chronological exports.
- `./exports/*_filtered.csv` — scoped analyst views.
- `./reports/` — final narrative or findings derived from the timeline.