Plaso
7.3#2 in digital forensics softwareFree planFree planAPILinuxmacOSSelf-hosted
VisitPlaso vs Timesketch
Timesketch
6.1#17 in digital forensics softwareFree planFree planWebAPILinuxSelf-hosted
VisitWhat both publish
| Fact | Plaso | Timesketch |
|---|---|---|
| Integrations | The documented analysis plug-ins include VirusTotal, NSRL server, and hash tagging. | Documented analyzer integrations include Sigma, Google Safe Browsing, BigQuery, Yeti, and HashR. |
| Purpose | Plaso is a Python-based engine used by tools to create super timelines or more targeted timelines for digital forensic analysis. | Timesketch is an open-source tool for collaborative forensic timeline analysis. |
| Support | The project directs users to its discussion mailing list, Open Source DFIR Slack community, troubleshooting guide, and GitHub issue tracker; contributions are best effort. | The project lists user and developer mailing lists and a Timesketch Slack community as resources. |
Plaso plans
- Open-source Plaso packageFree
- PlasoFree
Timesketch plans
- TimesketchFree
Pick Plaso if…
Plaso suits digital forensic practitioners who need to collect and analyze timelines from files, devices, logs, or storage images. Its parser and plug-in framework may also suit users extending forensic workflows.
Pick Timesketch if…
Timesketch suits forensic teams that need to organize and collaboratively explore timeline data. It is a fit for users prepared to deploy it with Docker on Ubuntu 22.04 and provide at least 8 GB of RAM.