Lion Cipher Lab
Build a forensic super-timeline with Plaso (Part 1)
- Digital Forensics & IR (DFIR)
- Intermediate
- ~60 min
- Free · no account required
Why it matters
An incident is never a single event; it is a sequence. A file arrives, then it runs, then it reaches out to the internet, then something else changes. Any one of those artifacts in isolation tells you almost nothing, but put in order they tell you what happened and when, which is the question every investigation is really trying to answer. The problem is that the evidence for that sequence is scattered across dozens of places on a system, each recording time in its own format: filesystem timestamps, event logs, browser history, registry keys, prefetch, and more. A super-timeline is the…
What you'll learn
- why order-of-events is the backbone of an incident story
- installing Plaso (log2timeline) with Docker
- running log2timeline to build a .plaso storage file from a source you own
- using psort to filter to a time window and export a CSV timeline
- reading a timeline for a created -> executed -> connected sequence
- scoping a noisy super-timeline by time and artifact
- recognising that timestamps can be manipulated (timestomping)
Steps in this lab
- Why a timeline is the backbone of an investigation
- What Plaso, log2timeline, psort, and a .plaso file are
- Get a data source you are allowed to analyse
- Install Plaso with Docker
- Build the .plaso storage file with log2timeline
- Filter to a time window and export a CSV with psort
- Read the timeline for a sequence, and distrust single timestamps
- What you can now do, and the discipline that makes it work