Log2timeline timeline generation: Log2Timeline Perl (Legacy)

# Switching from Log2Timeline Perl (Legacy) to Plaso

This page contains information for those that are used to using the 0.x version
of log2timeline, also known as Log2Timeline Perl or Log2Timeline legacy.

The syntax has changed somewhat from the 0.x version, the largest differences
may be:

* The output of the tool is no longer controllable through the log2timeline.py command line tool (or front-end). There is only one storage mechanism and that is the Plaso storage file. To produce an output file comparable with the 0.x version you'll need to run the psort.py command line tool with l2t_csv output module.
* The log2timeline.py command line tool can extract events **directly** from storage media images, such as raw or E01. Removing the need to manually mounting these images.
* The names of the parser have changed. There are a numerous new parsers, but note that some of the older parsers have not been ported.
* The post-processing tool is no longer called l2t_process, it is now named **psort.py**.
* The command line parameters and options have changed considerably. More information below.

In the information below the name Plaso is the name of the new back-end as
opposed to Log2Timeline which is the old Perl back-end. log2timeline.py is
a CLI tool (or front-end). There are other front-ends to the tool though, for
example [Timesketch](https://github.com/google/timesketch).

Let's go over the old and new method of collecting a timeline from a raw
storage media image file.

## Old method

First of all we needed to mount the image. Something like this:

```bash
sudo mount -t ntfs-3g -o ro,nodev,noexec,show_sys_files,streams_interface=windows,loop,offset=32256 image.dd /mnt/nfts
```

Then we needed to run log2timeline against the mount point. You needed to
define the timezone of the suspect image, which could get overwritten if a
correct value was found and you needed to define which parsers to use. The
sample run is:

```bash
cd /mnt/ntfs
log2timeline -r -p -z CST6CDT -f win7 . > /cases/timeline/myhost.csv 2> /cases/timeline/myhost.log
```

This would pick all the parsers defined in the "win7" list and run those
against every file found in the mount point. A list of all available parsers
and lists could be produced by running:

```bash
log2timeline -f list
```

As noted earlier, the above approach would produce a large "kitchen-sink"
approach timeline that is not sorted. To sort that one (no filtering):

```bash
cd /cases/timeline
l2t_process.py -b myhost.csv > myhost.sorted.csv
```

Now we would have a large sorted CSV file ready to analyze.

Limiting the output to a specific date could be achieved using methods like:

```bash
l2t_process.py -b myhost.csv 10-10-2012..10-11-2012
```

However, you could not limit the output of the timeline to a more narrow
timeframe than a single day, for that you needed grep (or some other tools of
choice).

```bash
l2t_process.py -b myhost.csv 10-10-2012..10-11-2012 | grep ",1[8-9]:[0-5][0-9]:[0-9][0-9],"
```

And filtering based on content was constrained to few options:
* Use a keyword file that contained case-insensitive regular expressions to include or exclude events.
* Use a YARA rule that matched against the description_long field.
* Use grep/sed/awk.

The problem with most of the l2t_process filtering is that it was either done
on the whole line or against the description_long field. There was no easy way
to filter against a more specific attribute of the event.

## New method

Since the new version works directly on a raw image file there is no need to
mount the image first (and mounting them is actually highly discouraged), the
timeline can be created in a single step:

```bash
log2timeline.py --storage-file /cases/timeline/timeline.plaso image.dd
```

The tool will detect whether or not the input is a file, directory or a disk
image/partition. If the tool requires additional information, such as when VSS
stores are detected or more than a single partition in the volume the tool will
ask for additional details. An example of that:

```
The following Volume Shadow Snapshots (VSS) were found:
Identifier      VSS store identifier                    Creation Time
vss1            23b509aa-3499-11e3-be88-24fd52566ede    2013-10-16T13:18:01.685825+00:00
vss2            8dfc93b3-376f-11e3-be88-24fd52566ede    2013-10-18T00:28:29.120593+00:00
vss3            dc8ffcf4-3a6b-11e3-be8a-24fd52566ede    2013-10-21T19:24:50.879381+00:00

Please specify the identifier(s) of the VSS that should be processed:
Note that a range of stores can be defined as: 3..5. Multiple stores can
be defined as: 1,3,5 (a list of comma separated values). Ranges and lists can
also be combined as: 1,3..5. The first store is 1. If no stores are specified
none will be processed. You can abort with Ctrl^C.
```

The options can also be supplied on the command line, `--vss_stores '1,2'` for
defining the VSS stores to parse, or `--vss_stores=none` or `-vss-stores=all`
for respectively processing no or all VSS stores.

This can be achieved without calculating the offset into the disk image.

```bash
log2timeline.py --partitions 2 --storage-file /cases/timeline/timeline.plaso image.dd
```

First of all there is quite a difference in the number of parameters, let's go
slightly over them:

* There is no `-r` for recursive, when the tool is run against an image or a directory recursive is automatically assumed, run it against a single file and it recursion is not turned on.
* There is no need to supply the tool with the `-p` (preprocessing) when run against an image, that is automatically turned on.
* The `-z CST6CDT` is not used here. The tool does automatically pick up the timezone and use that. However in the case the timezone is not identified the option is still possible and in fact if not provided uses UTC as the timezone.
* You may have noticed there is no `-f list` parameter used. The notion of selecting filters is now removed and is done automatically. The way the tool now works is that it tries to "guess" the OS and select the appropriate parsers based on that selection. The categories that are available can  be found here or by issuing `log2timeline.py --info`. If you want to overwrite the automatic selection of parsers you can define them using the `--parsers` parameter.
* You have to supply the tool with the parameter to define where to save the output (can no longer just output to STDOUT and pipe it to a file).

The equivalent call of the old tool of `-f list` can now be found using
`--info`. That will print out all available parsers and plugins in the tool.
One thing to take note of is the different concepts of either plugins or
parsers. In the old tool there was just the notion of a parser, which purpose
it was to parse a single file/artifact. However Plaso introduces both plugins
and parsers, and there is a distinction between the two. The parser understands
and parses file formats whereas a plugin understands data inside file formats.
So in the case of the W