Realizando Reconstrução de Linha do Tempo com Plaso

Quando Usar

• Ao construir uma linha do tempo forense abrangente a partir de múltiplas fontes de evidência
• Para correlacionar eventos entre metadados do sistema de arquivos, logs de eventos, histórico de navegador e registro
• Durante investigações complexas que exigem a reconstrução cronológica de atividades
• Quando a análise de logs padrão é insuficiente para estabelecer a sequência de eventos
• Para apresentar os resultados da investigação em um formato visual e cronológico

Pré-requisitos

• Plaso (log2timeline/psort) instalado na estação de trabalho forense
• Imagem(s) de disco forense em formato raw (dd), E01 ou VMDK
• Armazenamento suficiente para a saída do Plaso (pode ser 10x ou mais o tamanho da imagem)
• Mínimo de 8GB de RAM (16GB+ recomendado para imagens grandes)
• Timeline Explorer (Eric Zimmerman) ou Timesketch para visualização
• Compreensão dos tipos de carimbo de data/hora (MACB: Modified, Accessed, Changed, Born - Modificado, Acessado, Alterado, Criado)

Fluxo de Trabalho

Etapa 1: Instalar o Plaso e Preparar o Ambiente

# Install Plaso on Ubuntu/Debian
sudo add-apt-repository ppa:gift/stable
sudo apt-get update
sudo apt-get install plaso-tools

# Or install via pip
pip install plaso

# Or use Docker (recommended for dependency isolation)
docker pull log2timeline/plaso

# Verify installation
log2timeline.py --version
psort.py --version

# Create output directory
mkdir -p /cases/case-2024-001/timeline/

# Verify the forensic image
img_stat /cases/case-2024-001/images/evidence.dd

Etapa 2: Gerar o Arquivo de Armazenamento do Plaso com log2timeline

# Basic processing of a disk image (all parsers)
log2timeline.py \
   --storage-file /cases/case-2024-001/timeline/evidence.plaso \
   /cases/case-2024-001/images/evidence.dd

# Process with specific parsers for faster targeted analysis
log2timeline.py \
   --parsers "winevtx,prefetch,mft,usnjrnl,lnk,recycle_bin,chrome_history,firefox_history,winreg" \
   --storage-file /cases/case-2024-001/timeline/evidence.plaso \
   /cases/case-2024-001/images/evidence.dd

# Process with a filter file to focus on specific paths
cat << 'EOF' > /cases/case-2024-001/timeline/filter.txt
/Windows/System32/winevt/Logs
/Windows/Prefetch
/Users/*/NTUSER.DAT
/Users/*/AppData/Local/Google/Chrome
/Users/*/AppData/Roaming/Mozilla/Firefox
/$MFT
/$UsnJrnl:$J
/Windows/System32/config
EOF

log2timeline.py \
   --filter-file /cases/case-2024-001/timeline/filter.txt \
   --storage-file /cases/case-2024-001/timeline/evidence.plaso \
   /cases/case-2024-001/images/evidence.dd

# Using Docker
docker run --rm -v /cases:/cases log2timeline/plaso log2timeline \
   --storage-file /cases/case-2024-001/timeline/evidence.plaso \
   /cases/case-2024-001/images/evidence.dd

# Process multiple evidence sources into one timeline
log2timeline.py \
   --storage-file /cases/case-2024-001/timeline/combined.plaso \
   /cases/case-2024-001/images/workstation.dd

log2timeline.py \
   --storage-file /cases/case-2024-001/timeline/combined.plaso \
   /cases/case-2024-001/images/server.dd

Etapa 3: Filtrar e Exportar a Linha do Tempo com psort

# Export full timeline to CSV (super-timeline format)
psort.py \
   -o l2tcsv \
   -w /cases/case-2024-001/timeline/full_timeline.csv \
   /cases/case-2024-001/timeline/evidence.plaso

# Export with date range filter (focus on incident window)
psort.py \
   -o l2tcsv \
   -w /cases/case-2024-001/timeline/incident_window.csv \
   /cases/case-2024-001/timeline/evidence.plaso \
   "date > '2024-01-15 00:00:00' AND date < '2024-01-20 23:59:59'"

# Export in JSON Lines format (for ingestion into SIEM/Timesketch)
psort.py \
   -o json_line \
   -w /cases/case-2024-001/timeline/timeline.jsonl \
   /cases/case-2024-001/timeline/evidence.plaso

# Export with specific source type filters
psort.py \
   -o l2tcsv \
   -w /cases/case-2024-001/timeline/registry_events.csv \
   /cases/case-2024-001/timeline/evidence.plaso \
   "source_short == 'REG'"

psort.py \
   -o l2tcsv \
   -w /cases/case-2024-001/timeline/evtx_events.csv \
   /cases/case-2024-001/timeline/evidence.plaso \
   "source_short == 'EVT'"

# Export for Timeline Explorer (dynamic CSV)
psort.py \
   -o dynamic \
   -w /cases/case-2024-001/timeline/timeline_explorer.csv \
   /cases/case-2024-001/timeline/evidence.plaso

Etapa 4: Analisar a Linha do Tempo com Timesketch

# Instalar Timesketch (implantação Docker)
git clone https://github.com/google/timesketch.git
cd timesketch
docker compose up -d

# Importar arquivo Plaso para Timesketch via CLI
timesketch_importer \

…