Tips and Tricks

This is a collection of few tips and tricks that can be used with Plaso

Import the output of a third party tool into Plaso

If want to import the output of a third party tool into your Plaso timeline export it to bodyfile (or mactime) format. The Plaso mactime parser can parse a bodyfile.

Note that the bodyfile format has numerous limitations see: ForensicsWiki: Bodyfile

The Plaso mactime parser supports timestamps with a fraction of a second since Aug 25, 2020.