Plaso: build a super timeline from a lab disk image and filter it

Many artifacts, one clock

A Windows image holds hundreds of time sources: file system timestamps, event logs, prefetch, registry key write times, browser history, LNK files. Plaso parses them into one store of events, each with a timestamp, a source, and a description. Sorting them together is what lets an analyst see that a download, a process start, and a new service happened within ninety seconds.

Parsing an image

log2timeline.py reads a disk image, a mounted folder, or a KAPE VHDX. --parsers limits work to what the case needs; win7 is a preset that covers modern Windows artifacts despite its name. The official Docker image avoids dependency trouble.

docker run --rm -v /cases/HB-114:/data log2timeline/plaso \
  log2timeline.py --storage-file /data/ws07.plaso \
  --parsers win7,!filestat --hashers sha256 /data/ws07.E01

docker run --rm -v /cases/HB-114:/data log2timeline/plaso pinfo.py /data/ws07.plaso | head -40

Exporting a window

psort.py reads the store and writes it with an output module. l2tcsv and dynamic are common for spreadsheets; json_line suits Timesketch or jq. The filter expression keeps the export to the incident window.

psort.py -o dynamic -w /data/ws07-window.csv /data/ws07.plaso \
  "date > '2026-10-28 09:00:00' AND date < '2026-10-28 11:00:00'"

datetime,timestamp_desc,source,source_long,message,parser,display_name
2026-10-28T09:11:58,Last Visited Time,WEBHIST,Chrome History,https://files.example.top/u.ps1,chrome_27_history,...History
2026-10-28T09:12:44,Last Time Executed,LOG,WinPrefetch,POWERSHELL.EXE was executed run count 3,prefetch,...POWERSHELL.EXE-920BBA2A.pf
2026-10-28T09:13:20,Content Modification Time,REG,Registry Key,[HKCU\...\Run] OneDriveSync: C:\Users\Public\u.exe,winreg/winreg_default,NTUSER.DAT

Worked reading of three rows

Read in order: Chrome visited the .top URL at 09:11:58, PowerShell ran 46 seconds later, and a Run key pointing into C:\Users\Public was written at 09:13:20. Each row names its parser and source file, so each claim in the report can cite the artifact behind it.

Plaso stores timestamps in UTC. Note the host’s configured time zone from the SYSTEM hive in the report, because user-facing logs from the same host may be in local time.