Plaso
What it is
Plaso is a free Python-based engine for creating timelines used in digital forensic analysis. Its log2timeline tool extracts events from files, directories, storage-media images, or devices and saves them in a Plaso storage file. The psort tool can filter and sort that data and run automatic analysis. Other command-line tools include image_export, pinfo, and psteal. Documented inputs include Windows event logs and registry data, browser histories, SQLite databases, text-based logs, and cloud audit logs from AWS CloudTrail, Azure Activity, Google Cloud, and Microsoft 365. Plaso can produce CSV timelines from storage images; its listed output formats also include JSON, JSON Lines, KML, TLN, XLSX, OpenSearch, and Timesketch. The framework supports adding parsers, analysis plug-ins, and forensic scripts. Documented plug-ins include VirusTotal, NSRL server, and hash tagging. Plaso supports Linux, macOS, Windows, Docker, and self-hosted use, and its repository license is Apache-2.0. The documentation recommends packaged releases for general use and a version no older than six months.
For and against
For
- Free, with no commercial plan or usage limits stated
- Collects events from files, devices, and storage images
- Supports cloud audit logs from four listed services
- Framework allows additional parsers and analysis plug-ins
Against
- The documentation recommends a version no older than six months
- Project contributions are best effort
- The project directs support questions to community channels and its issue tracker
The verdict
Plaso provides command-line collection and analysis tools for building forensic timelines from varied evidence sources. Users should follow its release guidance and account for best-effort support.
Who it suits
Plaso may suit digital forensic analysts who need to collect and examine event timelines from files, devices, storage images, or logs. It is available for Linux, macOS, Windows, Docker, and self-hosted use.
Plans and prices
Open-source Plaso package
Python-based forensic timeline engine · self-hosted installation · no paid tiers listed
Read 15 Oct 2026 · pypi.org
Plaso
No commercial plan or usage limits are stated
Read 4 Oct 2026 · github.com
On the record
- Analysis plugins
- Analysis plugins can calculate hashes, apply YARA rules and tag events of interest.plaso.readthedocs.io · read 15 Oct 2026
- Cloud log formats
- The supported formats page lists AWS CloudTrail, Azure Activity, Google Cloud, and Microsoft 365 audit logs.plaso.readthedocs.io · read 4 Oct 2026
- Collection
- Collection recursively scans images, directories and files, with support for archives and compressed streams.plaso.readthedocs.io · read 15 Oct 2026
- Command-line tools
- The project includes image_export, log2timeline, pinfo, psort, and psteal command-line tools.plaso.readthedocs.io · read 4 Oct 2026
- Company identity
- PyPI identifies the maker as the community-run Log2Timeline maintainers group rather than a named commercial corporation.pypi.org · read 15 Oct 2026
- Core workflow
- log2timeline extracts events into a Plaso storage file, while pinfo and psort inspect or process that file.github.com · read 15 Oct 2026
- Docker
- Official instructions provide a Docker Hub image, Dockerfile build, bind mounts and commands for log2timeline, psort, pinfo and psteal.plaso.readthedocs.io · read 15 Oct 2026
- Extensibility
- The project supports adding parsers, parser plugins, analysis plugins, output modules, tagging rules and automation scripts.github.com · read 15 Oct 2026
- Independent defect
- Kali reported that Plaso packages in Kali 2024.2 could fail at startup with a missing MacOSLocalTime artifact; Kali marked the issue fixed in version 2024.3.bugs.kali.org · read 15 Oct 2026
- Independent praise: artifact correlation
- A computer-forensics Reddit commenter praised Plaso for combining MFT, event-log, registry, link-file and browser-history timestamps into one reference timeline.reddit.com · read 15 Oct 2026
- Independent praise: customization
- The same Reddit discussion highlighted Plaso's customizable output formatting through formatter configuration files.reddit.com · read 15 Oct 2026
- Integrations
- The documented analysis plug-ins include VirusTotal, NSRL server, and hash tagging.plaso.readthedocs.io · read 4 Oct 2026
- Latest package
- PyPI records version 20260720 as released on July 21, 2026.pypi.org · read 15 Oct 2026
- Licence
- PyPI and GitHub identify the project as Apache-2.0 licensed.pypi.org · read 15 Oct 2026
- License
- The GitHub project page identifies the repository license as Apache-2.0.github.com · read 4 Oct 2026
- Limit: processing speed
- A Reddit practitioner described Plaso as heavyweight and slow, especially when it generates many events that are not needed.reddit.com · read 15 Oct 2026
- Limit: resource usage
- Official troubleshooting documentation says workers can be killed by out-of-memory conditions and that components may consume excessive memory or leak it.plaso.readthedocs.io · read 15 Oct 2026
- Limit: setup complexity
- The project recommends packaged releases for ordinary users because development installations can break and require troubleshooting.github.com · read 15 Oct 2026
