Plaso / Log2timeline
Definition
The cross-artifact super-timeline tool. log2timeline.py extracts events from many sources into a .plaso storage file; psort.py renders the timeline to CSV or Elasticsearch.
Related terms
- Auditd
- The Linux Audit Daemon. Writes /var/log/audit/audit.log based on rules configured in /etc/audit/audit.rules. Read with ausearch and aureport.
- Inode
- The ext2/3/4 metadata structure that holds a file's permissions, ownership, MAC times, link count and block pointers. The file name lives in...
- Journalctl
- The query interface to systemd-journald, the binary structured-logging daemon that backs modern Linux distributions. Binary database under /var/log/journal/.
- SUID / SGID
- Set-User-ID and Set-Group-ID permission bits. A SUID binary runs with the owner's privileges regardless of the invoking user. A common persistence and...
- Wtmp / Utmp / Btmp
- Binary login databases under /var/log and /var/run. wtmp logs successful logins, utmp reflects current sessions, btmp logs failed login attempts. Read with...
Explained in
- Linux Forensic Artifacts: File System, Logs, Cron and Shell HistoryThe cross-artifact super-timeline tool. log2timeline.py extracts events from many sources into a .plaso storage file; psort.py renders the timeline to CSV or E...