Plaso 20240308 released

Plaso 20240308 released

The Plaso team is delighted to announce a new Plaso release, 20240308. This release has a mixture of new features and under the hood improvements.

Notable changes

  • Support for Mac OS login window (#4799), startup item (#4800) and login and background items plist plugins (#4790) plist files with thanks to Matthew Pfeiffer (@Spferical).

  • Support for Mac OS launchd.log text parser plugin (#4686) with thanks to @rick-slin.

  • Improvements to Windows EventLog resource extraction and message formatting (#4259).

  • Moved data into Python module and migrated tools to Python entry points (#4769).

The full list of cleanups, performance tweaks and bug fixes can be found in the release milestone.

Upcoming changes in future releases

  • Migrate Docker image to Ubuntu 24.04 once released.

  • Continued work on pre-processing and knowledge base (#4543).

  • Move image export to the dfImageTools project (#1).

Where/how to get Plaso 20240308?

See Plaso's Users' Guide. The development team recommends using Docker to install Plaso without hassle. 

If Docker does not fit your needs there are installation instructions available for Mac OS, Ubuntu and Fedora

If you run into problems take a look at the Installation Problems page in the Plaso documentation, to see if other people have seen the issue before. If nothing there helps, ask for help on the Open Source DFIR slack or open an issue on the tracker.


Popular posts from this blog

Parsing the $MFT NTFS metadata file

Incident Response in the Cloud

Container Forensics with Docker Explorer