log2timeline / plaso

Super timeline all the things
https://plaso.readthedocs.io
Apache License 2.0
1.66k stars 327 forks source link

How do I use the winiis text parser plugin? #4818

Closed b1draper closed 4 months ago

b1draper commented 4 months ago
          Thanks for the insight I was unaware of the winiis parser. I was under the impression that by not specifying a parser it would try everything or parse everything. The "basic-usage" paragraph on the linked page gave me that understanding [https://plaso.readthedocs.io/en/latest/sources/user/Using-log2timeline.html](url).  This method is also covered in the SANS 508 class as an "all-inclusive" approach. <br>

When I tried using the "winiis" parser I got an error. I edited the /usr/share/plaso/presets.yaml file modifying the list of parsers included with the win7_slow to have the winiis in the list like the others.
I invoke the command using the following syntax log2timeline.py --workers 45 --parsers "win7_slow" --storage-fime ./Servername_parsers.plaso ./ServernameOSdisk.vhd . That command gives me an error "Unknown Parser or Plugin names in element(s): "winiis". After which processing is aborted. Is this an add-on module?
image

Originally posted by @b1draper in https://github.com/log2timeline/plaso/issues/4813#issuecomment-1973721701

joachimmetz commented 4 months ago

See: https://github.com/log2timeline/plaso/issues/4813#issuecomment-1973737768 also see the output of --parsers list