Setting up plaso on your own windows host using wsl distro- windows subsystem for linux.
First go to your linux vm and run below commands: docker must be installed on your linux vm.
docker run -t --name Plaso-v20230520 log2timeline/plaso:20230520 log2timeline.py --version
Link for plaso tags:
If you want to pull latest docker image then from the below link find the relative tags. Here we are pulling 20230520 plaso version.
https://hub.docker.com/r/log2timeline/plaso/tags
Making the .tar file that will be moved to windows vm.
docker export Plaso-v20230520 > /cases/Plaso-v20230520.tar
Now you can remove it from linux vm.
docker rm Plaso-v20230520
Now take it to windows vm. Then open command prompt in admin mode and run below commands:
mkdir C:\SANS\Plaso-v20230520
wsl --import Plaso-v20230520 C:\SANS\Plaso-v20230520 .\Plaso-v20230520.tar
Avi
Comments
Post a Comment