# Plaso: building forensic super timelines from disk images and log files

> Plaso is a Python-based forensic engine that aggregates every timestamped event from a computer system into a single timeline. Its pyproject.toml dependency list covers filesystems, disk image formats, Windows artefacts, and encrypted volumes through a set of C-library Python bindings.

**log2timeline/plaso** — Super timeline all the things

- Repository: https://github.com/log2timeline/plaso
- Website: https://plaso.readthedocs.io
- Stars: 2,168 · Forks: 427
- Language: Python
- License: Apache-2.0
- Published: 2026-10-11 · Updated: 2026-10-11 · Language: en
- Canonical page: https://hysenlabs.com/projects/log2timeline-plaso

## What plaso does for forensic analysts and when a super timeline is warranted

Plaso's full name, Plaso Langar Að Safna Öllu, is Icelandic for "plaso wants to collect everything," which is a literal description of its default mode. Given a computer system or disk image, it extracts every timestamped event it can find and writes them all into a single timeline. Forensic investigators use this to correlate what happened across multiple data sources at once: file system activity, registry changes, Windows Event Log entries, browser cache, prefetch files, and more.

That default mode is the right tool when the scope of an investigation is unknown or when patterns across sources matter. It becomes inefficient when the investigation has a narrow focus, such as a single application's log or a known time window. For those cases, plaso also supports targeted timelines, where the collection scope can be constrained.

The project describes itself as both an engine and a framework. Other tools are built on top of the plaso engine to provide different interfaces to the same underlying parsing and aggregation capabilities.

## Installing plaso: Python 3.10 required, with many C-library Python bindings

Plaso requires Python 3.10 or higher. The pyproject.toml sets `requires-python = ">=3.10"` explicitly and names the package `plaso`. The project's GitHub page at github.com/log2timeline/plaso lists downloads, and full installation steps for specific platforms are at plaso.readthedocs.io.

The dependency list in pyproject.toml names both framework-level packages and a set of lib*-python bindings, each a Python wrapper around a C library that handles a specific file format or storage technology. Framework-level packages include dfvfs >= 20260731, dfwinreg >= 20240229, dfdatetime >= 20260730, and dtfabric >= 20230518 alongside PyYAML >= 3.10 and XlsxWriter >= 0.9.3. One entry, bencode.py, carries no minimum version specifier at all, while the rest pin a floor.

Installing all of them and ensuring they are mutually compatible is the main friction point in getting plaso running on a new system. The README does not describe a GUI for browsing timeline output; the engine produces data files that other tools consume. A managed install environment such as a pre-configured forensic distribution is easier than assembling all dependencies by hand.

## Which filesystems, disk image formats, and Windows artefacts the lib*-python list covers

Each lib*-python entry in pyproject.toml corresponds to a specific file format or storage technology that plaso can parse. Reading that list tells you exactly what evidence sources plaso can address:

- libevt-python and libevtx-python cover Windows Event Log files in both the legacy .evt format and the current .evtx XML format
- libfsntfs-python, libfsext-python, libfsapfs-python, libfshfs-python, libfsfat-python, and libfsxfs-python cover NTFS, ext, APFS, HFS+, FAT, and XFS filesystems respectively
- libewf-python handles Expert Witness Format disk images, the standard format in forensic acquisition tools
- libqcow-python, libmodi-python, and libphdi-python support QEMU, macOS DMG/sparse, and Parallels disk image formats
- libfvde-python, libluksde-python, and libbde-python cover macOS FileVault, Linux LUKS, and Windows BitLocker encrypted volumes
- libregf-python and libcreg-python parse the Windows Registry in current and Windows 9x formats
- libesedb-python handles Microsoft Extensible Storage Engine databases, used by Active Directory, Exchange, and Windows Search
- libolecf-python covers the OLE Compound File format used by older Microsoft Office documents
- libmsiecf-python and libscca-python handle Internet Explorer cache index files and Windows prefetch files
- liblnk-python and libfwsi-python cover Windows shortcut files and Windows Shell Items

This coverage spans the artefacts most commonly examined in Windows forensics and extends to Linux and macOS filesystems.

## libewf-python's minimum version floor predates most other entries in the dependency file

One detail worth reading closely in pyproject.toml: the minimum version floors for lib*-python packages are not uniform. libewf-python, the Expert Witness Format library, carries a minimum version of 20131210, which is older than every other lib*-python entry visible in the file. libfsfat-python, by contrast, requires 20260717, among the most recent floors in the same list.

This spread is specific to plaso: it shows that EWF disk image support has been a requirement since the early days of the project, while FAT filesystem support was formalised at current version requirements much more recently. The practical effect is that libewf tends to be available in older operating system package repositories because it has been present in them for a long time, whereas libfsfat at its stated minimum may require a more current package source or a source build.

Neither version number appears in the README, which means a developer integrating plaso into a forensic platform would only discover this gap by reading pyproject.toml directly.

## Parser and analysis plug-in architecture: adding new formats without touching the core

Plaso is described as a framework as well as an engine. Adding support for a new file format or log type means writing a new parser or parsing plug-in rather than modifying plaso's existing code. Analysis plug-ins are separate: parsers extract events from files, while analysis plug-ins process the extracted events to add context, tag events, or correlate them.

The README also describes a third category: one-off scripts to automate repetitive tasks in computer forensic analysis. That category is for workflows too specific to package as a reusable plug-in but that still benefit from plaso's collection infrastructure.

Two development mailing lists exist: log2timeline-discuss for general discussion and log2timeline-dev for development topics. The Open Source DFIR Slack community also has a plaso channel. Both are the documented contact routes for contributors adding new parsers or plug-ins.

## Targeted timelines as an alternative to collecting every timestamped event

Plaso's default mode is comprehensive, but the project explicitly documents targeted timelines as an alternative. Targeted timelines restrict the collection scope rather than gathering every timestamped event on the system. The README links to a blog post from 2013 at blog.kiddaland.net that introduced the concept.

The trade-off is coverage versus output size. A super timeline over a large disk image produces a large volume of data that requires time to generate and time to review. A targeted timeline narrows the scope at the cost of potentially missing relevant events outside the defined boundaries.

Plaso's direction includes adding support for parsers and plug-ins that do not require timestamps, which is a departure from its original all-timestamps premise. Event tagging and richer analysis context are also listed in the README as directions the project is moving toward, not current capabilities. Analysts who need non-timestamped artefacts such as registry value contents or configuration file entries may not find complete support in the current state of the framework. The README does not describe the output format plaso produces from a super timeline run; those details are in the documentation at plaso.readthedocs.io.

## The Beta classifier in pyproject.toml and what it means for custom parser authors

The pyproject.toml classifiers include `Development Status :: 4 - Beta`. For a project with a multi-year history and production use in forensic investigations, that Beta label is consistent with the README's description of features still under development: general-purpose parsers without timestamps, richer analysis context, and event tagging are all listed as directions the project is moving toward rather than current capabilities.

The Beta status has a concrete consequence for anyone writing custom parsers or analysis plug-ins against plaso's framework API. Beta status means the interface between the core engine and its extensions is not guaranteed stable, so a custom parser written against one version may need updates before it works with a newer one. Testing custom extensions against each new plaso package before deploying a production forensic platform is the safest approach.

The project's documentation at plaso.readthedocs.io and the log2timeline-dev mailing list are the two resources the README gives for navigating the framework's development conventions.

## Conclusion

Plaso suits digital forensic investigators who need to correlate timestamped events across an entire system, including encrypted volumes, proprietary disk images, and Windows artefacts, all in a single output. Analysts with a narrow scope, such as searching one log file or examining a single Windows Event Log, will find the dependency overhead and super-timeline approach more work than their task requires. The prerequisite list includes many C-library Python bindings that must be mutually compatible and installed against Python 3.10 or higher; test the full installation on a representative system before deploying in a production forensic environment. The project is Apache-2.0 and the last push was on 2026-09-28.

## FAQ

### What is plaso used for?

Plaso is a Python engine that builds super timelines for digital forensic analysis. It extracts all timestamped events from a computer system or disk image and aggregates them into a single timeline, making it possible to correlate activity across filesystems, Windows Event Logs, browser cache, prefetch files, and other sources.

### What Python version does plaso require?

The pyproject.toml sets requires-python to >= 3.10, so Python 3.10 or higher is required.

### How do I install plaso?

The README directs to the project's GitHub page for downloads, and detailed installation steps for specific platforms are at plaso.readthedocs.io. The pyproject.toml defines the Python package name as plaso, built with setuptools.

### What file formats does plaso support?

The pyproject.toml dependency list includes C-library bindings for Windows Event Log (evt and evtx), NTFS, ext, APFS, HFS+, FAT, XFS, Expert Witness Format disk images, QEMU and Parallels disk images, Windows Registry, ESE databases, OLE Compound Files, Internet Explorer cache files, Windows prefetch and shortcut files, and encrypted volumes including BitLocker, FileVault, and LUKS.

### Can I add a new parser to plaso?

The README describes plaso as a framework that supports adding new parsers, parsing plug-ins, and analysis plug-ins. Development discussion takes place on the log2timeline-dev mailing list and the plaso channel in the Open Source DFIR Slack community.

## Sources

- [License: Apache-2.0](https://github.com/log2timeline/plaso/blob/main/LICENSE)
- [log2timeline/plaso on GitHub](https://github.com/log2timeline/plaso)
- [Project website](https://plaso.readthedocs.io)
- [README](https://github.com/log2timeline/plaso/blob/main/README.md)
- [Releases](https://github.com/log2timeline/plaso/releases)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/log2timeline-plaso