Quick answer: Plaso is a free and open source tool that builds a super timeline in digital forensics. It gathers all time information from hundreds of different sources in a disk image (file timestamps, registry, browser history, event logs, LNK files, prefetch) and merges it into a single chronological timeline. It has two core commands: log2timeline.py collects the data and psort.py filters and renders it readable. Output typically goes to CSV or Elasticsearch and is visualized with tools such as Timesketch. Its biggest pitfall is data abundance: an unfiltered super timeline runs to millions of rows, and the work is filtering and narrowing.

The hardest question in forensics is usually not "what happened" but "when, and in what order". An attacker entered a system, escalated privileges, copied data and covered their tracks. Reconstructing the order of these events is more valuable than finding individual pieces of evidence, because it tells the story. Plaso was designed to build exactly that story. This article explains the super timeline concept and Plaso through a training lens.

Why the timeline matters so much

That a file exists says something; when it was created, when it was opened and what it happened alongside says far more. On a modern system, time information sits in dozens of places:

  • File system timestamps (creation, modification, access, MFT change)
  • Windows event logs
  • The last written time of registry keys
  • Browser history and downloads
  • Prefetch, showing when a program was run
  • LNK shortcut files, showing which file was opened
  • Jump lists, USB connection records

Examining each source separately is slow and loses context.

Time source What it shows
File system timestamps When a file was created, modified, accessed
Prefetch When a program first and last ran
Event logs Logons, service installs, PowerShell activity
Registry last written When a setting or persistence was established
LNK and jump lists Which file was opened when
Browser history Which address was visited when

A super timeline merges them all into one ordered list, so you answer "what happened at 03:14" at a glance.

Plaso, log2timeline and psort

The names confuse people, so let us be clear:

  • Plaso is the project name (Plaso Langar Að Safna Öllu, "collects everything").
  • log2timeline.py is the collection engine. It scans an image or file, runs all parsers and writes the result to a storage file (.plaso).
  • psort.py is the post processing tool. It takes the .plaso file, filters, sorts and exports to CSV, JSON or another format.

The typical flow is two steps: first collect with log2timeline.py, then filter with psort.py.

log2timeline.py --storage-file case.plaso disk.e01
psort.py -o l2tcsv -w timeline.csv case.plaso "date > '2026-07-14 00:00:00'"

The logic of a Plaso examination

  1. Collect. Extract all time data from the image with log2timeline.py. This step can take a long time, hours on a large image. Be patient, it is a one time cost.
  2. Narrow. The raw .plaso file may hold millions of events. Use psort.py filters to focus on the incident's time window, a specific user or specific artifact types.
  3. Visualize. Instead of reading the CSV directly, import it into a tool such as Timesketch, which presents Plaso output as a timeline with tagging and collaboration.
  4. Interpret. Raw time data carries no meaning on its own. Seeing the sequence "Word opened, then PowerShell ran, then an outbound connection was made" reconstructs the attack story.

The biggest pitfall of the super timeline

The beginner mistake is producing a huge unfiltered CSV and drowning in it. A full super timeline of an image easily reaches tens of millions of rows. In that form it is useless, even harmful, because you lose the important event in the noise.

The correct approach is targeted filtering:

  • Find the incident's rough time window first, then narrow to it.
  • Select only relevant artifact types. For an execution examination, prefetch and event logs suffice, while all file timestamps add noise.
  • Eliminate known good system activity. The millions of events produced by a Windows update do not concern your investigation.

Do not forget memory either, the disk timeline is half the story. See our article on memory analysis with Volatility.

Timestamp pitfalls

Three technical pitfalls arise when building a timeline:

  • Time zone. Sources may log in different time zones. If you do not normalize them all to a single reference (usually UTC), your timeline shifts. This is the most common silent mistake.
  • Timestomping. Attackers can alter file timestamps. If a file system timestamp is suspect, compare the MFT's $STANDARD_INFORMATION and $FILE_NAME fields; an inconsistency between them signals tampering. Plaso extracts both.
  • Interpretation difference. A file's "access time" may not have been updated depending on the operating system setting. You must know what each timestamp means.

Learning path

Stage 1. Learn Windows artifacts: prefetch, LNK, jump lists, registry, event logs. Without knowing these, Plaso output is a meaningless pile of rows. For the registry side, see our Windows Registry forensics article.

Stage 2. Run log2timeline.py and psort.py on a small training image. Map each output line to its source.

Stage 3. Install Timesketch and visualize Plaso output. Practice telling an incident's story on the timeline.

Stage 4. Study the art of filtering. What separates a good DFIR examiner is the ability to pull the right window out of enormous data.

Common mistakes

  • Producing a huge unfiltered CSV. Useless. Narrow the time window first.
  • Not normalizing the time zone. It shifts the whole timeline.
  • Looking only at file timestamps. Prefetch, event logs and the registry are often more reliable.
  • Skipping timestomp. Confirm a suspect timestamp with MFT fields.
  • Ignoring memory. The disk timeline is half the story.
  • Reporting raw data without interpretation. A timeline is a narrative, not a list of rows.

Frequently asked questions

Does Plaso acquire images? No. Plaso extracts and analyzes time data. Imaging requires separate tools.

How long does log2timeline take? It depends on image size and the parsers selected; it can take hours on a large image. It is a one time cost.

Is Timesketch mandatory? No, but strongly recommended. Reading raw CSV by hand is very inefficient.

Does Plaso support non Windows systems? Yes, it parses Linux and macOS artifacts too, though its most mature support is on Windows.

Is a super timeline sufficient on its own? No. Combined with memory, network and mobile evidence it gives the full picture.

Will I notice if a timestamp was altered? Because Plaso extracts $STANDARD_INFORMATION and $FILE_NAME timestamps separately, you can catch tampering by comparing them.

Sources

Building an incident's story through a timeline turns scattered evidence into meaning. For examination support or DFIR and timeline analysis training for your team, contact DSET. We provide incident response and digital forensics from our Ankara Hacettepe Teknokent laboratory.