Skip to content

Automated TimeLine Generation with Plaso

Jump to bottom Edit New page
OMENScan edited this page Oct 28, 2019 · 1 revision

AChoir has been designed, not only for collection of Telemetry and Artifacts, but to automate their Post-Processing.

The Plaso.ACQ script located in the \Scripts directory does the following:

  1. Check if Plaso has already been downloaded. If not, Download and Extract it.
  2. Run log2timeline against the collected Artifacts to build a BodyFile Timeline
  3. Run Psort to convery the BodyFile timeline to a CSV Version of the same Timeline
Add a custom footer
Add a custom sidebar
Clone this wiki locally