Skip to content
SPECIFICTION
Get listed

Plaso

plaso.readthedocs.io

Free plan Open source WindowsmacOSLinuxAPISelf-hosted
Visit plaso.readthedocs.io
Spec score 8.5 #4 of 30 in Digital Forensics Software

What it is

Plaso is a Python-based engine for creating timelines used in digital forensic analysis. Its log2timeline tool extracts events from files, directories, storage-media images, or devices and stores them in a Plaso storage file. The psort tool can filter and sort that data and run automatic analysis. Other command-line tools include image_export, pinfo, and psteal. Documented inputs include Windows event logs and registry data, browser histories, SQLite databases, text logs, and cloud audit logs from AWS CloudTrail, Azure Activity, Google Cloud, and Microsoft 365. Plaso can create a CSV timeline from a storage image using psteal with dynamic output; listed formats also include JSON, JSON Lines, KML, TLN, XLSX, OpenSearch, and Timesketch. The framework supports additional parsers, analysis plug-ins, and scripts for forensic tasks. Documented analysis plug-ins include VirusTotal, NSRL server, and hash tagging. Plaso is free, with no commercial plan or usage limits stated. The project recommends packaged releases for general use and a version no older than six months.

Spec sheet

What it does
Plaso is a Python engine that automatically builds super timelines from computer logs and files for digital-forensics analysis.Read 15 Oct 2026 · plaso.readthedocs.io
Purpose
Plaso is a Python-based engine used by tools to create super timelines or more targeted timelines for digital forensic analysis.Read 4 Oct 2026 · plaso.readthedocs.io
Platforms
The user guide lists Docker for Linux, Mac OS, and Windows, with Fedora, macOS, and Ubuntu as alternatives.Read 4 Oct 2026 · plaso.readthedocs.io
Integrations
The documented analysis plug-ins include VirusTotal, NSRL server, and hash tagging.Read 4 Oct 2026 · plaso.readthedocs.io
Support
The project directs users to its discussion mailing list, Open Source DFIR Slack community, troubleshooting guide, and GitHub issue tracker; contributions are best effort.Read 4 Oct 2026 · plaso.readthedocs.io
License
The GitHub project page identifies the repository license as Apache-2.0.Read 4 Oct 2026 · github.com
Analysis plugins
Analysis plugins can calculate hashes, apply YARA rules and tag events of interest.Read 15 Oct 2026 · plaso.readthedocs.io
Cloud log formats
The supported formats page lists AWS CloudTrail, Azure Activity, Google Cloud, and Microsoft 365 audit logs.Read 4 Oct 2026 · plaso.readthedocs.io
Collection
Collection recursively scans images, directories and files, with support for archives and compressed streams.Read 15 Oct 2026 · plaso.readthedocs.io
Command-line tools
The project includes image_export, log2timeline, pinfo, psort, and psteal command-line tools.Read 4 Oct 2026 · plaso.readthedocs.io
Company identity
PyPI identifies the maker as the community-run Log2Timeline maintainers group rather than a named commercial corporation.Read 15 Oct 2026 · pypi.org
Core workflow
log2timeline extracts events into a Plaso storage file, while pinfo and psort inspect or process that file.Read 15 Oct 2026 · github.com
Docker
Official instructions provide a Docker Hub image, Dockerfile build, bind mounts and commands for log2timeline, psort, pinfo and psteal.Read 15 Oct 2026 · plaso.readthedocs.io
Extensibility
The project supports adding parsers, parser plugins, analysis plugins, output modules, tagging rules and automation scripts.Read 15 Oct 2026 · github.com
Independent defect
Kali reported that Plaso packages in Kali 2024.2 could fail at startup with a missing MacOSLocalTime artifact; Kali marked the issue fixed in version 2024.3.Read 15 Oct 2026 · bugs.kali.org
Independent praise: artifact correlation
A computer-forensics Reddit commenter praised Plaso for combining MFT, event-log, registry, link-file and browser-history timestamps into one reference timeline.Read 15 Oct 2026 · reddit.com
Independent praise: customization
The same Reddit discussion highlighted Plaso's customizable output formatting through formatter configuration files.Read 15 Oct 2026 · reddit.com
Latest package
PyPI records version 20260720 as released on July 21, 2026.Read 15 Oct 2026 · pypi.org
Licence
PyPI and GitHub identify the project as Apache-2.0 licensed.Read 15 Oct 2026 · pypi.org
Limit: processing speed
A Reddit practitioner described Plaso as heavyweight and slow, especially when it generates many events that are not needed.Read 15 Oct 2026 · reddit.com
Limit: resource usage
Official troubleshooting documentation says workers can be killed by out-of-memory conditions and that components may consume excessive memory or leak it.Read 15 Oct 2026 · plaso.readthedocs.io
Limit: setup complexity
The project recommends packaged releases for ordinary users because development installations can break and require troubleshooting.Read 15 Oct 2026 · github.com
Maintainers
PyPI credits two maintainers, joachimmetz and onager, under the Log2Timeline maintainers group.Read 15 Oct 2026 · pypi.org
Operating systems
The user guide documents Docker use on Linux, macOS and Windows plus native Fedora, macOS and Ubuntu alternatives.Read 15 Oct 2026 · plaso.readthedocs.io
Output
Plaso can produce a CSV timeline from a storage image using psteal with the dynamic output format.Read 4 Oct 2026 · plaso.readthedocs.io
Output formats
Built-in output modules include dynamic delimited text, JSON, JSON Lines, KML, legacy CSV/TLN, raw Python and null output.Read 15 Oct 2026 · plaso.readthedocs.io
Parser development
Parser documentation provides a complete example covering parser code, registration, event data, tests, timeliner configuration and message formatters.Read 15 Oct 2026 · plaso.readthedocs.io
Parsers
Plaso uses parsers and parser plugins to extract events from supported forensic formats.Read 15 Oct 2026 · plaso.readthedocs.io
Preprocessing
Preprocessors identify operating systems, hostnames, time zones, user accounts and other context used to enrich extraction.Read 15 Oct 2026 · plaso.readthedocs.io
Public API
Generated Python API documentation exposes Plaso packages, CLI tools, parsers, analysis modules, storage and output classes.Read 15 Oct 2026 · plaso.readthedocs.io
Release cadence
The GitHub release history shows releases dated September 28, July 20, May 12 and January 19 in 2026.Read 15 Oct 2026 · github.com
Release guidance
The documentation recommends packaged releases for general use and recommends using a version no older than six months.Read 4 Oct 2026 · plaso.readthedocs.io
Release status
PyPI classifies the package as beta software.Read 15 Oct 2026 · pypi.org
Runtime requirement
The current PyPI package declares Python 3.10 or newer.Read 15 Oct 2026 · pypi.org
Security policy
The GitHub repository exposes a security-policy link, but no compliance certifications or availability guarantees are stated on the reviewed project pages.Read 15 Oct 2026 · github.com
Security scan
Snyk reports no direct vulnerabilities for the scanned package versions, while warning that dependencies are outside that result.Read 15 Oct 2026 · security.snyk.io
Self-hosting
Plaso is distributed as a local command-line application and can be run in Docker or installed through Linux and macOS packaging paths.Read 15 Oct 2026 · plaso.readthedocs.io
SQLite plugin tooling
The l2t_scaffolder utility can generate the files and branch structure for a new SQLite plugin.Read 15 Oct 2026 · plaso.readthedocs.io
Supported artifacts
Documented formats include Windows Registry, Windows Event Logs, browser histories, SQLite, plist, ESE, OLE, Android and iOS artifacts, cloud logs and many text logs.Read 15 Oct 2026 · plaso.readthedocs.io
Supported inputs
Documented formats include Windows event logs and registry data, browser histories, SQLite databases, and text-based logs.Read 4 Oct 2026 · plaso.readthedocs.io
Targeted timelines
The engine can create focused timelines instead of processing every available artifact.Read 15 Oct 2026 · plaso.readthedocs.io
Timeline analysis
psort can filter, sort, and run automatic analysis on Plaso storage files.Read 4 Oct 2026 · plaso.readthedocs.io
Timeline collection
log2timeline extracts events from files, directories, storage media images, or devices into a Plaso storage file.Read 4 Oct 2026 · plaso.readthedocs.io
Timesketch integration
An OpenSearch Timesketch output module writes Plaso events into OpenSearch for Timesketch use.Read 15 Oct 2026 · plaso.readthedocs.io

Plans and prices

Open-source Plaso package Free Python-based forensic timeline engine · self-hosted installation · no paid tiers listed Read 15 Oct 2026 · pypi.org
Plaso Free No commercial plan or usage limits are stated Read 4 Oct 2026 · github.com

Every Plaso plan and price →

Strong points and limits

Strong points

  • Collects events from files, devices, and storage images.
  • Supports cloud audit logs from four listed providers.
  • Includes filtering, sorting, and automatic analysis.
  • Free, with no usage limits stated.

Limits

  • The project recommends using a version no older than six months.
  • Support is best effort.
  • General use guidance recommends packaged releases.

Who it suits

Plaso suits digital forensic practitioners who need to collect and analyze events across files, devices, storage images, and logs. Its framework is also suited to teams adding parsers, analysis plug-ins, or forensic scripts.

Verdict

Plaso provides a free command-line workflow for collecting and analyzing forensic timelines, with a broad set of documented inputs and outputs. Its release guidance favors packaged versions that are no older than six months.

Where Specifiction places it

Alternatives to PlasoAll alternatives →