Plaso 20201007 released

 Plaso 20201007 released

The Plaso team is pleased to announce a new Plaso release, 20201007. This release has a mixture of new features and under the hood improvements.

Notable changes

  • The Elasticsearch output module now includes default type mappings thanks to @william-billaud. This avoids fields containing both numbers and text being misinterpreted by Elasticsearch.

  • A new parser containing initial support for Spotlight store database (store.db) files.

  • libfsext/pytfsext has been added as an experimental feature to overcome shortcomings in the pytsk ext implementation. Use the `--vfs-back-end=fsext` option to use libfsext instead of SleuthKit.

  • Log2timeline will now not attempt to extract events from MacOS sleep and swap files.

The full list of cleanups, performance tweaks and bug fixes can be found in the release milestone

Where/how to get Plaso 20201007?

See Plaso's Users' Guide. The development team recommends using Docker to install Plaso without hassle. 

If Docker does not fit your needs there are installation instructions available for MacOS, Ubuntu and Fedora

If you run into problems take a look at the Installation Problems page in the Plaso documentation, to see if other people have seen the issue before. If nothing there helps, ask for help on the Open Source DFIR slack or open an issue on the tracker.


Popular posts from this blog

Incident Response in the Cloud

Forensic Disk Copies in GCP & AWS

Introducing Libcloudforensics