performing-timeline-reconstruction-with-plaso

What problem does it solve? Investigators struggle to reconstruct the sequence of events during an incident because evidence is scattered across file system metadata, event logs, browser history, and registry hives. This Skill consolidates all timestamped artifacts into a single chronological super-timeline using Plaso. ## Core Features & Use Cases - Super-Timeline Generation: Run log2timeline against raw, E01, or VMDK disk images with full or targeted parser sets and filter files. - Filtering and Export: Use psort to slice timelines by date range or source type and export to CSV, dynamic CSV, or JSON Lines. - Collaborative Analysis: Import timelines into Timesketch for searching, tagging, Sigma analysis, and team-based investigation. - Use Case: During a ransomware investigation, process the victim's disk image, filter to the incident window, and trace the chain from phishing email to PowerShell execution, lateral movement, and data exfiltration. ## Quick Start Ask the agent to build a Plaso super-timeline from a forensic disk image and export the incident window to CSV for analysis.