domains / families / security / building-super-timelines-with-plaso

building-super-timelines-with-plaso

separate

Generate forensic super-timelines with Plaso's log2timeline.py, pinfo.py,

When to use

• Reconstructing the full sequence of events on a compromised host during incident response.
• Correlating activity across many artifact sources on a single normalized timeline.
• Investigating anti-forensic behavior such as timestomping or log clearing (which stands out against MACB and journal evidence).
• Feeding a curated timeline into Timesketch for team triage.

When not to use

• Unauthorized evidence analysis
• Live system analysis without forensic image

Skill page

Source