Plaso (plaso langar að safna öllu) is the Python based back-end engine used by tools such as log2timeline for automatic creation of a super timelines. The goal of log2timeline (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers and related systems, such as network equipment to produce a single correlated timeline. This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system.
Auxiliary goal of plaso is to provide forensic analysts and tool makers powerful libraries that they can use to access, find, read and parse various files within disk images to create their own tools, or to adjust log2timeline to their own workflow, instead of relying on the workflow provided by log2timeline.py.
The original version of log2timeline was written in Perl mainly for Linux, but has been known to work on both Mac OS X and Windows. Due to various issues the old Perl back-end engine log2timeline has been deprecated in favor of a Python based one, named plaso.
The original SANS Gold paper describing the log2timeline framework can be read here [although the current version does not share much with that original concept].
The plaso source code along with all of the tools that utilize plaso (such as log2timeline, pinfo, plasm and psort) can be found at: https://github.com/log2timeline/plaso
The Perl version of log2timeline can be found at: https://code.google.com/p/log2timeline.
This site serves as a documentation portal, to both potential developers of the tool and to users. The site is split up in three main sections:
If you find something missing in these sections feel free to leave a comment on either of the mailing lists (as discussed below or on the G+ community).
There is also a blog that is dedicated to plaso development, usage and other timeline analysis related, http://blog.kiddaland.net
And also two mailing groups that discuss plaso and log2timeline:
Finally there is a Google+ community dedicated to plaso and log2timeline.
The regular disclaimer applies: