Tips and Tricks

This is a collection of few tips and tricks that can be used with plaso

analyzeMFT and plaso

Plaso can parse the output of analyzeMFT in bodyfile (or mactime) output.

Run analyzeMFT as following:

$ analyzeMFT.py -b output.bodyfile -f input.MFT
$ log2timeline.py test.plaso output.bodyfile

The mactime parser of plaso will parse the bodyfile.

Also see: Mactime

Split the output of psort

psort itself does not provide you the option of splitting the file into chunks, however there are other ways to achieve that, such as using the standard Unix tool split, eg:

$ psort.py test.plaso | split -b 10m - split_output_

This will leave you with the following files:

• split_output_aa

• split_output_ab

• split_output_ac

• split_output_ad

• …

And so on… the size can be controlled by the ``-b``` parameter of the split command.