Plaso 20210606 released
Plaso 20210606 released
The Plaso team is pleased to announce a new Plaso release, 20210606. This release has a mixture of new features and under the hood improvements.
The “amcache” parser has been changed to a Windows Registry parser plugin and is now named “winreg/amcache”. If you’ve been referring to this parser by name, you’ll need to use its new name. In addition changes have been made to better support newer AMCache.hve formats.
As mentioned in previous release notes, the default ext2, ext3 and ext4 dfVFS back-end is now libfsext/pyfsext (#495), the default HFS+ and HFSX back-end is now libfshfs/pyfshfs (#494) and the default GPT back-end is now libvsgpt/pyvsgpt.
Changes to extract additional values of Chrome file download database (with thanks to @obsidianforensics).
Improved the resilience of various parsers to data format edge cases and corrupted source data including: apache (with thanks to @debernal), asl, iis (with thanks to @colemanjp), mactime, mac_keychain, plist, spotlight_storedb, winevtx, winreg (with thanks to @MikeHofmann).
Log2timeline.py no longer requires the Plaso storage file (.plaso) as an explicit command line argument. Similar to psteal.py, log2timeline.py now will generate a Plaso storage file name based on the source and date and time (#510). A Plaso storage file name can still be set using a positional argument as before (legacy method) and with the "--storage-file" command line option.
A warning was added to psort.py to discourage the use of second-only granularity and restricted field output formats such as tln, l2ttln and l2tcsv (#3570). More information about the shortcomings of these formats can be found here and here.
Added the "--dynamic-time" option to psort.py to preserve date and time values in their original granularity (#3582).
Pinfo.py will now report fewer extraction warnings since warnings due to recovery are now reported separately (#1381).
The full list of cleanups, performance tweaks and bug fixes can be found in the release milestone.
Upcoming changes in future releases
The legacy positional argument to specify a Plaso storage file name (.plaso) for log2timeline.py will be removed (#3606).
Where/how to get Plaso 20210606?
If you run into problems take a look at the Installation Problems page in the Plaso documentation, to see if other people have seen the issue before. If nothing there helps, ask for help on the Open Source DFIR slack or open an issue on the tracker.