Plaso 20211024 released

 Plaso 20211024 released

The Plaso team is pleased to announce a new Plaso release, 20211024. This release has a mixture of new features and under the hood improvements.

Notable changes

  • Windows EventLog message (template) string extraction has been integrated (#636). Note that and will enable this feature by default but can be disabled with "--no_extract_winevt_resources".

  • The “file_hashes” analysis plugin has been replaced by a report that can be generated by “ --report file_hashes case.plaso” (#3718)

  • The filestat parser has been changed to include additional information such as owner user identifier (UID) and group identifier (GID) (#3883) and names of extended attributes on ext, HFS+/HFSX and XFS (#3893).

  • and now handle localized (#3751) and MUI form (#3754) Windows time zone names.

  • Thanks to @sydp a Fish shell history (#3802) and a Linux locate (updatedb) database (#3799) parsers were added, and the Firefox cache file parser now supports format version 3 (#3827).

  • The legacy positional argument to specify a Plaso storage file name (.plaso) for has been removed (#3606).

  • The Plaso SQLite storage format has been changed to store 1 event tag per event (#3601). Due to historical reasons, dating back to the ZIP-based Plaso storage file format, event tags were previously appended.

The full list of cleanups, performance tweaks and bug fixes can be found in the release milestone

Upcoming changes in future releases

  • Additional improvements to Windows EventLog resource extraction (#163).

  • Support for reading and updating Plaso storage files that have multiple event tags per event will be removed in the 2022 February release (#3714).

Where/how to get Plaso 20211024?

See Plaso's Users' Guide. The development team recommends using Docker to install Plaso without hassle. 

If Docker does not fit your needs there are installation instructions available for MacOS, Ubuntu and Fedora

If you run into problems take a look at the Installation Problems page in the Plaso documentation, to see if other people have seen the issue before. If nothing there helps, ask for help on the Open Source DFIR slack or open an issue on the tracker.


Popular posts from this blog

Incident Response in the Cloud

Forensic Disk Copies in GCP & AWS

Common misconceptions about Windows EventLogs