169k views
1 vote
What are the commands to run both memory and mft to a log2timeline using plaso as well

1 Answer

2 votes

Final answer:

To run memory and MFT to a log2timeline using plaso, you can use the log2timeline.py and py-mysql.py commands.

Step-by-step explanation:

To run both the memory and MFT to a log2timeline using plaso, you can use the following commands:

  • log2timeline.py -z timezone logfile
  • py-mysql.py -h hostname -D database -t table -u username -p password logfile

The first command, log2timeline.py, is used to generate the timesketch data using the timezone and logfile. The second command, py-mysql.py, is used to export the log timeline database to MySQL using the provided parameters. Make sure to replace the placeholders with the correct values.

User Norayr Sargsyan
by
8.0k points