Plaso Import Module Questions

Autopsy Help
1

Hi All,

I have done some searching and I am not 100% clear on a few things with the plaso import module.
I have created a plaso storage file (well several) and have my disk image in Autospy and ran a few ingest modules. Ive also imported the plaso file using the Plaso Import module, pointing the directory for psort to the Autopsy internal directory and found my plaso file. All seems to run well, no issues and ingest says completed. My questions are:

  1. I have read that only ‘some’ of the data will go into the Timeline, is there a way to know what data that is?
  2. What exactly happens when the plaso import module is run. The plaso storage file is converted to an sqlite db and then where is it presented in the UI, if at all?

I have tried to review the module code, but im not a great coder and it wasnt obvious to me, hopefully my question makes sense!

2

Hi Shanna,

When you run the Plaso Import module against a Plaso storage engine file it does the following:
1. Runs psort.exe against the storage file to create a SQLite database.
2. The SQLite database is then brought into Autopsy and artifacts are created based on the source of the time-based artifact that is in the SQLite database. The only exception may be if you select not to import the time-based artifacts based on MACB time.
3. At this point there would be nothing that would be brought into the Timeline feature as the artifacts do not match up with the artifacts that have been determined to be in the timeline.

Once the plugin has completed then you should see the artifacts that were created in the tree with a name of "Plaso Source ".

I would have to look further and run a sample of plaso again to see what is generated and what timeline artifacts could be generated. When I created the plugin it was around Autopsy 4.3 which had a different version of the timeline then it does now, maybe the code should be revisited. What version of Plaso are you running against your data source to created your storage file?

Hope this helps.

Mark

3

Thanks Mark!
OK, something definitely wrong then as i have no Plaso tree, something for me to look into! Explains why im confused about where the data is :rofl: