Open Source DFIR

  Discontinuing l2tscaffolder For years bootstrapping development for open-source digital forensics tools required dealing with a fair amount of repetitive boilerplate. To make life easier for developers writing parsers and plugins for tools like Plaso, Timesketch, and Turbinia, we relied on l2tscaffolder . By guiding developers through a series of questions, it cleanly generated the necessary templates and structure to get new modules off the ground. However, the software development landscape has fundamentally shifted. With the advent of advanced AI coding agents, the need for a dedicated, rigid template scaffolding tool has rapidly diminished. Modern AI coding assistants are now deeply context-aware and can generate complete, highly customized Plaso parsers or Timesketch plugins on demand simply by being fed example logs or data structures. Because these AI agents assist far better and offer unparalleled flexibility compared to static templates, we have decided to officially ret...

Plaso 20261027 released The Plaso team is delighted to announce a new Plaso release, 20261027. This release has a mixture of new features and under the hood improvements. A special shout out to @elhoim and @kev365 for all their changes to help improve Plaso. A friendly reminder if you are using a coding agent (or other type of artificial intelligence), please tune its output verbosity to a necessary minimum, have it follow project guidelines and standard practices, and double check any speculations it might make in write ups. For people reporting code weaknesses and/or vulnerabilities, we appreciate you helping improve Plaso’s resilience, but please do not speculate about impact and make sure to back up your claims by facts. Refrain from claiming hypothetical worst-case impact, please keep it factual . Assess trade-offs, sometimes a resilience change has adverse effects from the perspective of forensics reproducibility . The “log with a cape”' will always be a key part of log2tim...

  Plaso 20260720 released The Plaso team is delighted to announce a new Plaso release, 20260720. This release has a mixture of new features and under the hood improvements. Notable changes Changes to schema and storage format as previously noted . Note that these change default behavior and can break backwards compatibility of storage files, filters and tagging rules. These include: introduction of data type counter ( #5017 ) with thanks to @nflexfo   the “description” and “description_short” fields are no longer available in dynamic output. These fields previously were duplicate supported names for message and message_short, which are now the only way to refer to these fields. The filename and inode fields in the psort/psteal output are no longer auto-populated with a value derived from the path specification of the event data stream and will be left empty if not set in the event data. You can use the command line option “--output-fallback-path” to enable the behavior. The h...