Plaso vs X-Ways Imager
Plaso
plaso.readthedocs.ioX-Ways Imager
x-ways.netSide by side
| Figure | Plaso | X-Ways Imager |
|---|---|---|
| Price from | Free | 6.17 CHF/mo |
| Free plan | Yes | — |
| Free trial | — | — |
| Open source | Yes | — |
| Windows | Yes | Yes |
| macOS | Yes | — |
| Linux | Yes | — |
| API | Yes | — |
| Self-hosted | Yes | — |
| Plans published | 2 | 2 |
| Spec score · Digital Forensics Software | 8.5 (#4) | 7.0 (#27) |
| Purpose | Plaso is a Python-based engine used by tools to create super timelines or more targeted timelines for digital forensic analysis. | X-Ways Imager is a forensic disk imaging tool and a stripped-down version of X-Ways Forensics focused on imaging functionality. |
| Support | The project directs users to its discussion mailing list, Open Source DFIR Slack community, troubleshooting guide, and GitHub issue tracker; contributions are best effort. | The maker lists general or technical inquiries by email and says to check the program help or user manual first. |
Plans
X-Ways Imager
- X-Ways Imager non-perpetual license74 CHF a year
- X-Ways Imager perpetual license157 CHF, paid once
In their own words
Plaso
Plaso is a Python-based engine for creating timelines used in digital forensic analysis. Its log2timeline tool extracts events from files, directories, storage-media images, or devices and stores them in a Plaso storage file. The psort tool can filter and sort that data and run automatic analysis. Other command-line tools include image_export, pinfo, and psteal. Documented inputs include Windows event logs and registry data, browser histories, SQLite databases, text logs, and cloud audit logs from AWS CloudTrail, Azure Activity, Google Cloud, and Microsoft 365. Plaso can create a CSV timeline from a storage image using psteal with dynamic output; listed formats also include JSON, JSON Lines, KML, TLN, XLSX, OpenSearch, and Timesketch. The framework supports additional parsers, analysis plug-ins, and scripts for forensic tasks. Documented analysis plug-ins include VirusTotal, NSRL server, and hash tagging. Plaso is free, with no commercial plan or usage limits stated. The project recommends packaged releases for general use and a version no older than six months.
X-Ways Imager
X-Ways Imager has no write-up on Specifiction yet; its figures are above.