plaso

Plaso (Plaso Langar Að Safna Öllu) - super timeline all the things

Plaso (Plaso Langar Að Safna Öllu), or super timeline all the things, is a Python-based engine used by several tools for automatic creation of timelines. Plaso default behavior is to create super timelines but it also supports creating more targeted timelines.

These timelines support digital forensic investigators/analysts, to correlate the large amount of information found in logs and other files found on an average computer.

A longer version

The initial purpose of Plaso was to collect all timestamped events of interest on a computer system and have them aggregated in a single place for computer forensic analysis (aka Super Timeline).

However Plaso has become a framework that supports:

adding new parsers or parsing plug-ins;
adding new analysis plug-ins;
writing one-off scripts to automate repetitive tasks in computer forensic analysis or equivalent.

And is moving to support:

adding new general purpose parses/plugins that may not have timestamps associated to them;
adding more analysis context;
tagging events;
allowing more targeted approach to the collection/parsing.

Also see

Homepage
Downloads
Documentation
Contact information:
- Plaso channel on Open Source DFIR Slack community
- Mailing list for general discussions: log2timeline-discuss
- Mailing list for development: log2timeline-dev

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

plaso-20260720.tar.gz (2.9 MB view details)

Uploaded Jul 21, 2026 Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

The dropdown lists show the available interpreters, ABIs, and platforms. Enable javascript to be able to filter the list of wheel files.

plaso-20260720-py3-none-any.whl (3.0 MB view details)

Uploaded Jul 21, 2026 Python 3

File details

Details for the file plaso-20260720.tar.gz.

File metadata

Download URL: plaso-20260720.tar.gz
Upload date: Jul 21, 2026
Size: 2.9 MB
Tags: Source
Uploaded using Trusted Publishing? Yes
Uploaded via: twine/6.1.0 CPython/3.13.14

File hashes

Hashes for plaso-20260720.tar.gz
Algorithm	Hash digest
SHA256	`c868892d9f203a3d002a907ef1942344ab06706412f32aefef856940a371927e`
MD5	`ccbc84c8bfddab3f0556feb3bfb69b41`
BLAKE2b-256	`c37c738f884fdf42a23744f868e2d3184cb273978ac5bcb4bb77e40f1e66b74c`

See more details on using hashes here.

Provenance

The following attestation bundles were made for plaso-20260720.tar.gz:

Publisher: build_wheel.yml on log2timeline/plaso

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Statement:
- Statement type: https://in-toto.io/Statement/v1
- Predicate type: https://docs.pypi.org/attestations/publish/v1
- Subject name: plaso-20260720.tar.gz
- Subject digest: c868892d9f203a3d002a907ef1942344ab06706412f32aefef856940a371927e
- Sigstore transparency entry: 2211339516
- Sigstore integration time: Jul 21, 2026
Source repository:
- Permalink: log2timeline/plaso@4ea03ef9a48dad5284c371ac9b537a184b3eea9c
- Branch / Tag: refs/tags/20260720
- Owner: https://github.com/log2timeline
- Access: public
Publication detail:
- Token Issuer: https://token.actions.githubusercontent.com
- Runner Environment: github-hosted
- Publication workflow: build_wheel.yml@4ea03ef9a48dad5284c371ac9b537a184b3eea9c
- Trigger Event: release