Plaso (log2timeline) Release 20210606 unknown Jul 09, 2021 CONTENTS 1 User documentation 3 1.1 User’s Guide...............................................3 1.1.1 How to get started........................................3 1.1.2 Installing the packaged release.................................3 1.1.3 Before we start.........................................3 1.1.4 The tools............................................4 1.2 Creating a timeline............................................5 1.2.1 Using psteal...........................................5 1.2.2 Using log2timeline and psort..................................5 1.3 Collection Filters.............................................5 1.3.1 Using Forensic Artifacts definitions..............................5 1.3.2 Using filter files.........................................6 1.3.3 References............................................7 1.4 Event filters................................................7 1.4.1 How do event filters work....................................8 1.4.2 Example event filter expressions................................8 1.4.3 Value type helpers.......................................9 1.4.4 References............................................9 1.5 Analysis Plugins.............................................9 1.6 Tips and Tricks..............................................9 1.6.1 Import the output of a third party tool into Plaso........................ 10 1.7 Switching from Log2Timeline Perl (Legacy) to Plaso.......................... 10 1.7.1 Old method........................................... 10 1.7.2 New method........................................... 11 2 Developer documentation 15 2.1 Developer Guide............................................. 15 2.1.1 Setting up and maintaining your development environment.................. 15 2.1.2 Getting Started......................................... 15 2.1.3 Design.............................................. 16 2.1.4 Roadmap............................................ 16 2.1.5 Contributing Code....................................... 16 2.2 Style Guide................................................ 17 2.2.1 Plaso specific style points.................................... 17 2.3 How to write a parser........................................... 18 2.3.1 Introduction........................................... 18 2.3.2 Format.............................................. 19 2.3.3 Parsers vs. Plugins....................................... 19 2.3.4 Test data............................................. 19 2.3.5 Parsers, formatters, events and event data........................... 19 i 2.4 How to write a parser plugin....................................... 21 2.5 How to write an analysis plugin..................................... 21 2.5.1 Create file and class....................................... 21 2.5.2 Write minimal tests....................................... 21 2.5.3 Develop plugin......................................... 22 2.5.4 Expand tests........................................... 22 2.5.5 Register classes......................................... 22 2.5.6 Code review/submit....................................... 22 2.6 How to write an output module..................................... 22 2.6.1 Create file and class....................................... 22 2.6.2 Write minimal tests....................................... 22 2.6.3 Develop plugin......................................... 23 2.6.4 Expand tests........................................... 23 2.6.5 Register classes......................................... 23 2.6.6 Code review/submit....................................... 23 3 Troubleshooting 25 3.1 Quick list................................................. 25 3.1.1 Performance related issues................................... 26 3.2 Isolating errors.............................................. 26 3.3 Producing debug logs.......................................... 27 3.4 Import errors............................................... 27 3.5 Crashes, hangs and tracebacks...................................... 27 3.5.1 A worker segfault-ing...................................... 28 3.5.2 A worker gives a killed status.................................. 28 3.5.3 Which processes are running.................................. 28 3.5.4 Analyzing crashes with single process and debug mode.................... 28 3.5.5 Analyzing crashes with gdb................................... 29 3.6 High memory usage........................................... 29 3.7 MacOS specific issues.......................................... 30 3.7.1 How do I remove a Plaso installation.............................. 30 3.7.2 PyParsing errors......................................... 30 3.7.3 ImportError: cannot import name dependencies........................ 30 3.7.4 You used pip without virtualenv and have messed up your site-packages......... 30 3.8 Ubuntu Linux specific issues....................................... 30 3.8.1 Origin of an installed package................................. 30 3.9 Windows specific issues......................................... 30 3.9.1 Not a valid Win32 application................................. 30 3.9.2 Unable to find an entry point in DLL.............................. 31 3.9.3 setup.py and build errors.................................... 31 4 Supported Formats 33 4.1 Storage media image file formats.................................... 33 4.2 Volume system formats......................................... 33 4.3 File system formats............................................ 33 4.4 File formats................................................ 33 4.5 Bencode file formats........................................... 35 4.6 Browser cookie formats......................................... 35 4.7 Compound ZIP file formats....................................... 35 4.8 ESE database file formats........................................ 35 4.9 OLE Compound File formats...................................... 35 4.10 Property list (plist) formats........................................ 35 4.11 SQLite database file formats....................................... 36 4.12 Syslog file formats............................................ 37 ii 4.13 Windows Registry formats........................................ 37 4.14 Hashers Supported............................................ 38 5 plaso package 39 5.1 Subpackages............................................... 39 5.1.1 plaso.analysis package..................................... 39 5.1.2 plaso.analyzers package..................................... 54 5.1.3 plaso.cli package........................................ 62 5.1.4 plaso.containers package.................................... 97 5.1.5 plaso.engine package...................................... 122 5.1.6 plaso.filters package....................................... 154 5.1.7 plaso.formatters package.................................... 167 5.1.8 plaso.lib package........................................ 178 5.1.9 plaso.multi_process package.................................. 186 5.1.10 plaso.output package...................................... 195 5.1.11 plaso.parsers package...................................... 211 5.1.12 plaso.preprocessors package.................................. 469 5.1.13 plaso.serializer package..................................... 478 5.1.14 plaso.single_process package.................................. 479 5.1.15 plaso.storage package...................................... 480 5.1.16 plaso.unix package....................................... 504 5.1.17 plaso.winnt package....................................... 504 5.2 Submodules............................................... 505 5.3 plaso.dependencies module....................................... 505 5.4 Module contents............................................. 505 6 Indices and tables 507 Python Module Index 509 Index 515 iii iv Plaso (log2timeline), Release 20210606 Plaso (Plaso Langar Að Safna Öllu), or super timeline all the things, is a Python-based engine used by several tools for automatic creation of timelines. Plaso default behavior is to create super timelines but it also supports creating more targeted timelines. These timelines support digital forensic investigators/analysts, to correlate the large amount of information found in logs and other files found on an average computer. The source code is available from the project page. CONTENTS 1 Plaso (log2timeline), Release 20210606 2 CONTENTS CHAPTER ONE USER DOCUMENTATION 1.1 User’s Guide 1.1.1 How to get started First determine which version of Plaso is must suitable to your needs, for more information see Releases and roadmap 1.1.2 Installing the packaged release To get Plaso up and running quickly: • Docker for Linux, Mac OS and Windows. Alternative options: • Fedora • MacOS • Ubuntu If you run into problems installing, check out the installation troubleshooting guide 1.1.3 Before we start Please report all discovered bugs on the issue tracker. To follow announcements from the Plaso team or send in generic inquiries or discuss the tool: • subscribe to the log2timeline-discuss mailing list. • join the Plaso channel part of the open-source-dfir Slack community, more information can be found here. I know the good old Perl version If you are one of those people that liked the old Perl version of log2timeline but really would like to switch use all the nifty features of the Python version. Fear not, here is a guide to help you migrate. 3 Plaso (log2timeline), Release 20210606 1.1.4