Plaso 20220428 released

Plaso 20220428 released

The Plaso team is pleased to announce a new Plaso release, 20220428. This release has a mixture of new features and under the hood improvements.

Notable changes

  • A Dropbox sync history parser was added, with thanks to @sydp.

  • An AWS ELB access log parser was added and the Santa log parser updated to support the latest format, with thanks to @jleaniz.

  • Parsers for GCP cloud logging, Azure Activity log and AWS Cloudtrail log were added, with thanks to @jonathan-greig.

  • An Azure application gateway access log parser was added, with thanks to @alexgoedeke.

  • Parsers for iOS sysdiagnose log, iOS lockdown daemon log, iOS power log and iOS mobile installation log were added, with thanks to @rick-slin.

  • Added Parallels Hard Disk image (PHDI) format support and several optimizations for HFS+/HFSX support.

The full list of cleanups, performance tweaks and bug fixes can be found in the release milestone

Upcoming changes in future releases

  • Additional improvements to Windows EventLog resource extraction (#163).

  • Support for reading and updating Plaso storage files that have multiple event tags per event will be removed in the 2022 July release (#3714).

  • The elasticsearch and elasticsearch_ts output modules will be removed in favor of opensearch and opensearch_ts modules in the 2022 July release (#4012).

Where/how to get Plaso 20220428?

See Plaso's Users' Guide. The development team recommends using Docker to install Plaso without hassle. 

If Docker does not fit your needs there are installation instructions available for MacOS, Ubuntu and Fedora

If you run into problems take a look at the Installation Problems page in the Plaso documentation, to see if other people have seen the issue before. If nothing there helps, ask for help on the Open Source DFIR slack or open an issue on the tracker.


Popular posts from this blog

Incident Response in the Cloud

Parsing the $MFT NTFS metadata file

Forensic Disk Copies in GCP & AWS