Plaso 20210213 released

Plaso 20210213 released

The Plaso team is pleased to announce a new Plaso release, 20210213. This release has a mixture of new features and under the hood improvements.

Notable changes

  • Experimental integration with libvsgpt/pyvsgpt has been added to provide hybrid GUID Partition Table/Master Boot Record (GPT/MBR) support. This support is needed to correctly process CoreOS and ChromeOS storage media images. 

    • Use the `--vfs-back-end=vsgpt` option to use libvsgpt instead of Sleuthkit when Plaso encounters a hybrid GPT/MBR.

  • A substantial revision to the ‘elastic’ output module, with some new features:

  • A new elastic_ts output module (#3470) that allows Plaso to directly output to a Timesketch Elasticsearch database. More information about this feature will be in the upcoming Timesketch release.

  • Changes to pinfo.py JSON output to match the text output more closely, and the addition of a new Markdown output option.Backwards compatibility with older storage formats has been removed, and the oldest storage format now supported is 20190309 (#3399).

  • The default branch for Plaso and other log2timeline projects is now called 

‘main’. This is primarily of interest to people actively developing Plaso or those maintaining a fork.


The full list of cleanups, performance tweaks and bug fixes can be found in the release milestone

Upcoming changes in future releases

  • The timesketch output module will be removed (#2560).

  • Raw fields support will be removed from the elastic output module (#3469).

  • The default back-end for GPT in will be changed to libvsgpt/pyvsgpt.


Where/how to get Plaso 20210213?

See Plaso's Users' Guide. The development team recommends using Docker to install Plaso without hassle. 


If Docker does not fit your needs there are installation instructions available for MacOS, Ubuntu and Fedora


If you run into problems take a look at the Installation Problems page in the Plaso documentation, to see if other people have seen the issue before. If nothing there helps, ask for help on the Open Source DFIR slack or open an issue on the tracker.

Comments

Popular posts from this blog

Incident Response in the Cloud

Forensic Disk Copies in GCP & AWS

Introducing Libcloudforensics