User documentation

• How to get started
  • How to get started
  • Installing the packaged release
    • MacOS
      • Mac OS X 10.11 (El Capitan) and higher
    • Ubuntu
      • SANS Investigative Forensic Toolkit (SIFT) Workstation
      • Ubuntu 16.04 and 18.04 LTS
    • Fedora Core
      • Fedora Core 28 and 29
    • Windows
    • Docker
      • Install Docker on Ubuntu
      • Build an image
        • From Docker Public Registry
        • From Dockerfile
      • Export the Plaso docker image to a non-internet connected system
      • Run Plaso from your new docker image
  • Before we start
    • I know the good old Perl version
  • The tools
    • image
      • Usage
        • Path, filename or extension
      • Time range
      • Format signature
      • Other options
    • Using log2timeline.py
    • Usage
    • Running the tool
      • Triage
      • Running against more than a single partition
        • OTHER OPTIONS TO DISCUSS
    • pinfo
      • Usage
    • psort
      • Usage
        • Output
          • Changing Output Format
          • Modify the Timezone
          • Quiet and More Verbose Output
        • Automatic Analysis
        • Filtering
          • Time Slices
          • Filters
          • Filter and Include Surrounding Events
        • Other options
          • Debug
      • How do I?
        • How do I filter on tags?
    • image_export
    • log2timeline
    • pinfo
    • preg
    • psort
• Creating a timeline
  • Using psteal
• Troubleshooting
  • Quick list
  • Isolating errors
  • Producing debug logs
  • Import errors
  • Crashes, hangs and tracebacks
    • A worker segfault-ing
    • A worker gives a killed status
    • Which processes are running
    • Analyzing crashes with single process and debug mode
    • Analyzing crashes with gdb
  • High memory usage
  • Also see
    • Troubleshooting Mac OS X specific issues
      • How do I remove a plaso installation
      • pyparsing errors
      • ImportError: cannot import name dependencies
        • You used pip without virtualenv and have messed up your site-packages
    • Troubleshooting Ubuntu specific issues
      • Origin of an installed package
    • Troubleshooting Windows specific issues
      • Plaso keeps telling me SQLite3 is too old
      • Not a valid Win32 application
      • Unable to find an entry point in DLL
      • setup.py and build errors
        • Cannot open input file ‘kernel32.lib’
        • Unable to find vcvarsall.bat
        • ValueError: [u’path’] when running setup.py
        • I’m getting linker “unresolved externals” errors when running setup.py
    • Troubleshooting Plaso Issues - Memory Edition
• Using collection Filters
• Event filters
  • How do the filters work
  • Example Queries
• Analysis plugins
  • nsrlsvr
    • Setting up nsrlsvr
    • Running nsrlsvr
    • Running plaso
  • tagging
    • Creating the tagging file
    • Running plaso
    • Also see
  • viper
    • Setting up Viper
    • Running plaso
  • virustotal
    • Getting an API key
    • Running plaso
• Tips and Tricks
  • analyzeMFT and plaso
  • Split the output of psort
• Log2Timeline Perl (Legacy)
  • Old method
  • New method