plaso log2timeline

log2timeline.py plaso.dump <path>

Build the system super-timeline with plaso (log2timeline): files, logs, registry, and artifacts in a single temporal store.

Run it when you need the complete system timeline: log2timeline processes the image (or directory) and extracts events from all sources — filesystem (MACB), logs (EVTX, syslog), Windows registry, artifacts (prefetch, amcache, LNK) — into an event store (plaso.dump). It's the super-timeline: every system activity with its timestamp, ready to filter by the incident window. In IR, plaso is the standard for timelines: the question 'what happened on this machine between 10:00 and 10:20?' is answered with all artifacts at once, not file by file.

Don't use it for quick analysis: processing a full image takes time (hours on large systems) and the store is heavy — for a specific question, individual artifacts (MFT, prefetch) are analyzed with their own tools. Quality depends on parsers: plaso covers many formats, but artifacts from exotic applications may lack a parser. And note: log2timeline extracts events; the readable timeline is built with psort (112) — the dump is the intermediate step. The store is generated from preserved evidence: the original image is never touched.