CCYNARKS LearnLogin
← All tools

Plaso (log2timeline)

DFIR · Advanced

Super-timeline generation from disk artifacts.

Knowledge reference only. Prefer in-browser Labs first. Use this tool only on systems you own or have written authorization to test.

What to learn

  • Parsers
  • Timeline

Legitimate use

Forensic timeline analysis.

Official docs →

Example commands (lab VMs only)

  • log2timeline.py timeline.plaso image.raw
    Parse lab image