Plaso vs Timesketch

Plaso is a Python-based engine for creating timelines used in digital forensic analysis. Its log2timeline tool extracts events from files, directories, storage-media images, or devices and stores them in a Plaso storage file. The psort tool can filter and sort that data and run automatic analysis. Other command-line tools include image_export, pinfo, and psteal. Documented inputs include Windows event logs and registry data, browser histories, SQLite databases, text logs, and cloud audit logs from AWS CloudTrail, Azure Activity, Google Cloud, and Microsoft 365. Plaso can create a CSV timeline from a storage image using psteal with dynamic output; listed formats also include JSON, JSON Lines, KML, TLN, XLSX, OpenSearch, and Timesketch. The framework supports additional parsers, analysis plug-ins, and scripts for forensic tasks. Documented analysis plug-ins include VirusTotal, NSRL server, and hash tagging. Plaso is free, with no commercial plan or usage limits stated. The project recommends packaged releases for general use and a version no older than six months.

Timesketch is a free, open-source tool for collaborative forensic timeline analysis. A sketch normally represents one case and can contain multiple timelines, views, comments and stories. Investigators can search and filter timelines, inspect data in charts and save discoveries as views. Sketches may be private or shared with individuals, groups or all system users. Supported imports include Plaso storage files, CSV, JSON, JSONL, Pandas DataFrames, Python dictionaries and spreadsheet files. Python analyzers run in background workers to enrich events, add tags or create saved views; documented integrations include Sigma, Google Safe Browsing, BigQuery, Yeti and HashR. Sigma support is marked alpha with known performance and functionality issues. Timesketch offers a web interface, REST API and command-line client. Docker is the only tested and actively maintained installation method; documentation calls for Ubuntu 22.04 and at least 8 GB of RAM. Indexes depend on physical disk space, and searches may fail above 150 indices in a timeline. The self-hosted plan is free.