Creating a timeline

Using psteal

The quickest way to generate a timeline with Plaso is using the “psteal” frontend. A command line like so: psteal.py --source ~/cases/greendale/registrar.dd -o l2tcsv -w /tmp/registrar.csv will produce a csv file containing all the events from an image, with some sensible defaults.