Plaso: display_name is the file the parser read

The source file is its own column

A timeline row has a message and a display_name. The message is the parser’s sentence. display_name is the file or hive the parser was reading when it emitted the row. Those can be the same path. They are often not. A registry row’s message can name an executable while display_name is the hive.

Citing the executable path as “the file we parsed” is wrong when display_name is the hive. The executable path is content the hive recorded. The hive is the artifact in the image.

Quote the column you mean

If the finding needs the artifact, quote display_name and the parser. If it needs a path mentioned in the sentence, quote the message and say it is the message. Do not drop one into the other’s role because both look like paths.

A row with an empty display_name is a row whose source file was not printed. Write “display_name empty.” Do not promote the first path in the message into that column.

What to file

File the parser, display_name, and the message text you are using, each labeled. File the timestamp description only if you are also making a claim about which time it is. Do not file a single unlabeled path.

Worked case: a hive row read as the program file

A lab row’s message mentions C:\Program Files\LabTools\helper.exe. display_name is NTUSER.DAT and the parser is a registry parser. A draft says the timeline parsed helper.exe and that file is the evidence.

The note says the parser read NTUSER.DAT. The program path is text in the message, which means the hive recorded that path. helper.exe was not the file this row parsed. Opening helper.exe is a different step, and this row does not show that the file was in the image.

parser: registry
display_name: NTUSER.DAT
message mentions: C:\Program Files\LabTools\helper.exe
artifact parsed: NTUSER.DAT
not: helper.exe was the file this row read