File: Creating-a-timeline.md

package info (click to toggle)
plaso 20201007-2
  • links: PTS, VCS
  • area: main
  • in suites: bullseye
  • size: 519,924 kB
  • sloc: python: 79,002; sh: 629; xml: 72; sql: 14; vhdl: 11; makefile: 10
file content (5 lines) | stat: -rw-r--r-- 323 bytes parent folder | download | duplicates (2) 
1
2
3
4
5
 
# Creating a timeline

## Using psteal
The quickest way to generate a timeline with Plaso is using the "psteal" frontend. A command line like so:
`psteal.py --source ~/cases/greendale/registrar.dd -o l2tcsv -w /tmp/registrar.csv` will produce a csv file containing all the events from an image, with some sensible defaults.