Section 4.4: Super Timeline & Analysis

Question 1

How does the log2timeline.py tool function? Why is inputting local timezone for the image important?

Answer 1

It extracts events from a group of files, mount point, or a forensic image and saves results in a Plaso storage file. It is important to add the local time zone so that it can convert it to UTC and match the other files.

Question 2

What is the purpose of the pinfo tool?

Answer 2

It prints out information from a storage file. It has information on how and when the collection took place and any preprocessing stages that were employed.

Question 3

What is the purpose of the psort tool?

Answer 3

It is a post-processing tool used to filter, sort, and process the storage file. Since the storage file initially isn’t in human readable format, this tool creates it.

Question 4

What can Plaso parse?

Answer 4

Windows computers, registry, webhistory, Linux, Android, and Mac.

Question 5

What data sources can the log2timeline.py tool use parse data?

Answer 5

Raw images (.dd), EWF image (.E01), Virtual Disk Image (.vhdx), Physical Devices (sdd), Partitions (–partition), and Triage Folder (\triage-output).

Question 6

What are the two filter file formats I can use for Plaso and what is the difference between the between the two?

Answer 6

Text-based filter files and YAML files. YAML files can add and exclusion to the path they want to filter.

Question 7

The example of this text-based filter says what: /(Users|Documents and Settings)/.+/NTUSER.DAT

Answer 7

I am looking for a file within the users or documents and settings followed by any subfolder (.+) which includes a file specifically named NTUSER.DAT.

Question 8

The example of this text-based filter says what: {systemroot}/winevt/Logs/.+evtx

Answer 8

I am telling it to parse all evtx files stored under the given directory.

Question 9

What are path expansion variables for the text-based and YAML-based filters?

Answer 9

Text-based ({}) and YAML-based (%%)

Question 10

To get more columns for supertimeline analysis, what output format should I use?

Answer 10

l2tcsv

Question 11

What tools can I use to analyze timelines at scale?

Answer 11

Databases like Splunk or ELK are good for investigating multiple timelines. To search for IOC’s in timelines, use yara_match.py. To work with multiple timelines in real-time with other investgators, use Timesketch.