Plaso: a zero parser count is not proof nothing happened

The count is what that parser emitted

A Plaso store summary lists parsers and how many events each one produced. Zero means that parser added nothing to this store. It does not mean the activity you care about never occurred. Another parser may still have rows, or the parser may never have been asked to run.

A high count is also just a count. It does not rank which rows matter. It tells you the parser ran and emitted.

Three different reasons for zero

The parser can be left out of the run on purpose. It can start and fail, which a warning in the parse log would show. Or the artifact it reads can be absent from the image. Those three are different notes. The count line is the same in all three, so the count cannot choose among them.

Check the command or the log that lists which parsers were selected, and check whether the source file is in the image, before you write “nothing ran.”

What to file

File the store name, the parser name, the count, and where you read the count. If parsers were limited, file that list or say you did not check it. If the source file is missing from the image, say that as a separate fact. Do not write “no program execution” from a zero prefetch count alone.

Worked case: prefetch was not selected

The store summary for the lab image shows prefetch at 0 and file-system parsers in the thousands. A draft says no program was executed. The parse log shows the run limited parsers to file-system and registry sources. Prefetch was not selected. The prefetch files are present in the image listing.

The note quotes prefetch 0 and the parser list that omitted it. It says execution artifacts were not parsed. It does not say nothing executed. A later run that includes the prefetch parser is what would support a sentence about runs.

store: lab-image.plaso
prefetch count: 0
parsers selected: file system, registry
prefetch files in the image listing: present
write: prefetch was not parsed
not: no programs executed