Open Source DFIR

  Plaso 20260720 released The Plaso team is delighted to announce a new Plaso release, 20260720. This release has a mixture of new features and under the hood improvements. Notable changes Changes to schema and storage format as previously noted . Note that these change default behavior and can break backwards compatibility of storage files, filters and tagging rules. These include: introduction of data type counter ( #5017 ) with thanks to @nflexfo   the “description” and “description_short” fields are no longer available in dynamic output. These fields previously were duplicate supported names for message and message_short, which are now the only way to refer to these fields. The filename and inode fields in the psort/psteal output are no longer auto-populated with a value derived from the path specification of the event data stream and will be left empty if not set in the event data. You can use the command line option “--output-fallback-path” to enable the behavior. The h...

  Plaso 20260512 released The Plaso team is delighted to announce a new Plaso release, 20260512. This release has a mixture of new features and under the hood improvements. Notable changes Added support for Apple MobileBackup plist ( #4916 ) with thanks to @rizabudi Added support for iOS WiFi Known Networks plist ( #4925 ) with thanks to @CopasAlpha26 Added support for iOS Accounts (Accounts3.sqlite) SQLite database ( #4926 ) with thanks to @studiawan Added support for IMO HD chat SQLite database ( #4927 ) with thanks to @agusgiinarsa Added support for Apple Burner (burners.sqlite) SQLite database ( #4928 ) with thanks to @brokamal and @SanGit56 Added support for Android Native Downloads (downloads.db) SQLite database ( #4929 ) with thanks to @ChristopherGammaWau and @barpeot Added support for Android App Launch (SimpleStorage) ( #4930 ) with thanks to @FathanAbi and @BeefRa Added support for iOS SIM information plist (com.apple.commcenter.data.plist) ( #4931 ) with thanks to @f...

  Plaso 20260119 released The Plaso team is delighted to announce a new Plaso release, 20260119. This release has a mixture of new features and under the hood improvements. Notable changes Changes for compatibility with OpenSearch 2.5 and later ( #4997 ) with thanks to @jaegeral Added support for Firefox 118+ download end time ( /#5019 ) and improvement to AppCompatCache parser ( #5025 ) with thanks to @Spferical Changes to use pyproject.toml ( #5015 ) Changes to Windows EventLogs parameter expansion ( #5023 ) The full list of cleanups, performance tweaks and bug fixes can be found in the release milestone . Upcoming changes in future releases Extend support for Windows 10 push notification databases ( #4458 ) Continued work on pre-processing and knowledge base ( #4543 ). Move image export to the dfImageTools project ( #1 ). Where/how to get Plaso 20260119? See Plaso's Users' Guide . The development team recommends using Docker to install Plaso without hassle.  If Docker does...

  Plaso 20250918 released This post has been pending for a while, but the Plaso team is delighted to announce a new Plaso release, 20250918. This release has a mixture of new features and under the hood improvements. Notable changes Added motherboard information Windows Registry plugin ( #4953 ) with thanks to @elad-levi-cyberark Changes to image export to map extracted files to artifact definitions ( #4949 ) with thanks to @sa3eed3ed Changes to Google Cloud audit logs parser ( #4923 ) with thanks to @roshanmaskey Changed amcache.hve parser to extract file identifier and application key modification time ( #4942 ) with thanks to @coperni Changes to IIS parser ( #4904 , #4910 , #4911 ) with thanks to @pyllyukko Changes to run plaso as user in Docker ( #4975 ) The full list of cleanups, performance tweaks and bug fixes can be found in the release milestone . Upcoming changes in future releases Extend support for Windows 10 push notification databases ( #4458 ) Continued work on pre-p...