Plaso: the source code is the parser family

The code is a family label

A Plaso row can show a short source code next to a longer source name. The short code groups the parser: a file-system family, a registry family, a web-history family. It tells you what kind of artifact produced the row. It does not name the machine, and it does not replace display_name.

Reading “FILE” as “this file is the evidence” skips the column that actually names the file. Reading “REG” as “the registry was edited by this user” adds a person the code does not contain.

Keep the code next to the parser name

When both the short code and the longer source string are present, quote both and say they agree or that you only have one of them. Do not translate FILE into a path, or REG into a hive, unless display_name gives you that path or hive.

A filter that keeps one code drops the other families. Write the filter. A sheet of only FILE rows is not “the whole timeline.”

What to file

File the source code, the longer source string if you have it, the parser, and display_name when the claim is about a file. Do not file the code as a hostname or as a user.

Worked case: FILE read as the whole story

A filtered export shows only rows whose source code is FILE. A draft says the lab image had no registry activity and no browser history. The filter was “source is FILE.” The store summary still lists registry and web-history parsers with counts above zero.

The note says the sheet is the file-system family only, because of the filter. Registry and web-history rows exist in the store and were not on this sheet. The finding does not say those families were empty.

sheet filter: source code FILE
rows on the sheet: file-system family only
store summary: registry count > 0, web history count > 0
write: this sheet is one family
not: the image had no registry or browser rows