Plaso vs SUMURI PALADIN
Plaso
plaso.readthedocs.ioSUMURI PALADIN
sumuri.comSide by side
| Figure | Plaso | SUMURI PALADIN |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | Yes | — |
| Windows | Yes | — |
| macOS | Yes | — |
| Linux | Yes | Yes |
| API | Yes | — |
| Self-hosted | Yes | — |
| Plans published | 2 | 2 |
| Spec score · Digital Forensics Software | 8.5 (#4) | 7.7 (#15) |
| Integrations | The documented analysis plug-ins include VirusTotal, NSRL server, and hash tagging. | PALADIN 9 LTS integrates Arsenal Image Mounter Remote Agent for advanced disk-image mounting and live or remote analysis. |
| Purpose | Plaso is a Python-based engine used by tools to create super timelines or more targeted timelines for digital forensic analysis. | PALADIN is a donation-supported, live Linux environment for forensic imaging, triage, and recovery. |
| Support | The project directs users to its discussion mailing list, Open Source DFIR Slack community, troubleshooting guide, and GitHub issue tracker; contributions are best effort. | SUMURI provides a PALADIN Version 9 Quick Start Guide and directs users to its knowledge base and support portal for help. |
Plans
In their own words
Plaso
Plaso is a Python-based engine for creating timelines used in digital forensic analysis. Its log2timeline tool extracts events from files, directories, storage-media images, or devices and stores them in a Plaso storage file. The psort tool can filter and sort that data and run automatic analysis. Other command-line tools include image_export, pinfo, and psteal. Documented inputs include Windows event logs and registry data, browser histories, SQLite databases, text logs, and cloud audit logs from AWS CloudTrail, Azure Activity, Google Cloud, and Microsoft 365. Plaso can create a CSV timeline from a storage image using psteal with dynamic output; listed formats also include JSON, JSON Lines, KML, TLN, XLSX, OpenSearch, and Timesketch. The framework supports additional parsers, analysis plug-ins, and scripts for forensic tasks. Documented analysis plug-ins include VirusTotal, NSRL server, and hash tagging. Plaso is free, with no commercial plan or usage limits stated. The project recommends packaged releases for general use and a version no older than six months.
SUMURI PALADIN
SUMURI PALADIN is a donation-supported live Linux environment for forensic imaging, triage, and recovery. PALADIN 9 LTS uses Ubuntu 24.04 LTS and is modified to prevent changes to attached media and disable automatic mounting at boot. Its graphical Toolbox handles imaging, logical acquisitions, hashing, and device mounting, with read-only options and logging. Included software includes Autopsy, The Sleuth Kit, and other open-source forensic tools. Supported image formats include E01/Ex01, RAW (.dd), SMART, AFF, VHD, and VMDK. PALADIN LTS can mount and image through NFS or SMB networks and supports BitLocker-encrypted Windows partitions from Vista through Windows 10. It integrates Arsenal Image Mounter Remote Agent for advanced mounting and live or remote analysis. Persistent Mode preserves reports and configurations between prepared sessions, subject to extra free space. PALADIN runs as a Linux live environment on 64-bit and 32-bit PC hardware.