Plaso

Plaso is ranked #13 of 29 in digital forensics software on The Geeks Club. It runs on Linux, macOS, Self-hosted, Windows. There is a free plan.

Plaso plans and pricing

All plans

Plaso Free No commercial plan or usage limits are stated github.com · 4 Oct 2026

Compared on digital forensics software

Free plan: Yes
Evidence sources: Storage-media images, files, directories, devices, logs, databases, Windows Registry data, Android and iOS artifacts
Mobile forensics: Yes
Disk imaging: Yes
Supported platforms: Linux, macOS, Windows, Docker
Export formats: CSV, JSON, JSON Lines, KML, TLN, XLSX, OpenSearch, Timesketch

Best Plaso alternatives

See all 12

7.5 Paraben E3 Forensic Platform Free trial $58.25/mo

7.1 Cellebrite Inseyets Free trial

7.1 NetworkMiner Free plan

6.9 Arkime Free plan

6.9 SUMURI PALADIN Free plan

6.8 CAINE Free plan

Plaso

Purpose: Plaso is a Python-based engine used by tools to create super timelines or more targeted timelines for digital forensic analysis.
Timeline collection: log2timeline extracts events from files, directories, storage media images, or devices into a Plaso storage file.
Timeline analysis: psort can filter, sort, and run automatic analysis on Plaso storage files.
Command-line tools: The project includes image_export, log2timeline, pinfo, psort, and psteal command-line tools.
Supported inputs: Documented formats include Windows event logs and registry data, browser histories, SQLite databases, and text-based logs.
Cloud log formats: The supported formats page lists AWS CloudTrail, Azure Activity, Google Cloud, and Microsoft 365 audit logs.
Output: Plaso can produce a CSV timeline from a storage image using psteal with the dynamic output format.
Extensibility: The project describes a framework for adding parsers, analysis plug-ins, and scripts for forensic tasks.
Integrations: The documented analysis plug-ins include VirusTotal, NSRL server, and hash tagging.
Platforms: The user guide lists Docker for Linux, Mac OS, and Windows, with Fedora, macOS, and Ubuntu as alternatives.
Release guidance: The documentation recommends packaged releases for general use and recommends using a version no older than six months.
Support: The project directs users to its discussion mailing list, Open Source DFIR Slack community, troubleshooting guide, and GitHub issue tracker; contributions are best effort.
License: The GitHub project page identifies the repository license as Apache-2.0.
Price from: Free

Visit site Alternatives

Where it ranks on The Geeks Club

Best Digital Forensics Software in 2026#13 of 29

Is Plaso yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote Plaso

Sources

plaso.readthedocs.io/en/latest/· checked 4 Oct 2026
plaso.readthedocs.io/en/latest/sources/user/Users-Guide.html· checked 4 Oct 2026
plaso.readthedocs.io/en/latest/sources/Supported-formats.htm· checked 4 Oct 2026
plaso.readthedocs.io/en/latest/sources/user/Creating-a-timel· checked 4 Oct 2026
github.com/log2timeline/plaso· checked 4 Oct 2026
plaso.readthedocs.io/en/latest/sources/api/plaso.html· checked 4 Oct 2026