Lion Cipher Lab
Triage a Plaso super-timeline in pandas and find the ten minutes that matter (Part 2)
- Digital Forensics & IR (DFIR)
- Advanced
- ~90 min
- Free · no account required
Why it matters
Part 1 ended with a CSV timeline and the advice to read it for a sequence. On a real case that CSV has tens of thousands to millions of rows, and nobody reads that top to bottom. What separates a responder who finds the intrusion in an afternoon from one who is still scrolling on Friday is a handful of data moves: load it with the right types, count before you read, look for bursts, pivot on what you find, and collapse the duplicates the format creates. This lab teaches those moves in pandas, the free Python data library, on a practice timeline with a known answer, so you can measure what you…
What you'll learn
- Loading a 48,729-row l2tcsv super-timeline into pandas with deliberate dtypes and UTC-aware datetimes
- Measuring how much a spreadsheet scroll would have cost before trusting a faster method
- Binning events per minute with resample and telling a benign burst from a malicious one
- Catching a time zone mistake before it sends the investigation to the wrong hour
- Pivoting on one executable name across all time, then on a time window around its first run
- Collapsing MACB duplicates so one file action reads as one line, not eight
- Separating filesystem noise from execution and persistence evidence
- Testing for timestomping with $STANDARD_INFORMATION vs $FILE_NAME, and seeing why the naive test fails
- Writing a triage table (time, artifact, what it proves, confidence) and scoring it against an answer key
Steps in this lab
- Recap Part 1, and the problem it leaves you with
- Install Python and pandas in a private environment
- Generate the practice timeline (and do not peek at the answer key)
- Load it the naive way and see what it costs
- Load it properly: categories, strings and UTC datetimes, then measure the scroll
- Get your bearings: what kinds of rows are these?
- Bin events per minute and find the bursts, then refuse the obvious answer
- The time zone trap: what the user said vs what the timeline says
- Pivot on the executable name, across all time, then around its first run
- Collapse the MACB duplicates so one file action is one line
- Separate filesystem noise from execution and persistence evidence
- Test for timestomping, and see why the obvious test is wrong
- Write the triage table: time, artifact, what it proves, confidence
- Score yourself against the answer key and count what you read
- When the timeline is 5 GB: chunks, fewer columns, and the limits of this method
- The judgment that makes this work