Performing Timeline Reconstruction with Plaso

When to Use

• When building a comprehensive forensic timeline from multiple evidence sources
• For correlating events across file system metadata, event logs, browser history, and registry
• During complex investigations requiring chronological reconstruction of activities
• When standard log analysis is insufficient to establish the sequence of events
• For presenting investigation findings in a visual, chronological format

Prerequisites

• Plaso (log2timeline/psort) installed on forensic workstation
• Forensic disk image(s) in raw (dd), E01, or VMDK format
• Sufficient storage for Plaso output (can be 10x+ the image size)
• Minimum 8GB RAM (16GB+ recommended for large images)
• Timeline Explorer (Eric Zimmerman) or Timesketch for visualization
• Understanding of timestamp types (MACB: Modified, Accessed, Changed, Born)

Workflow