What is Plaso's primary function in timeline analysis with Timesketch?

• A. Storing and exporting pre-built timeline data for Timesketch.
• B. Analyzing network traffic in real time.
• C. Scanning for malware using heuristic methods.
• D. Generating timeline data from multiple log sources.

Answer: (D)

Generating timeline data from multiple log sources is what Plaso specializes in within the Timesketch workflow. Plaso ingests a wide range of forensic artifacts—from Windows event logs and browser histories to file system metadata and other log sources—and parses them into a unified event model with timestamps, sources, and metadata. The result is a consolidated timeline that spans many data sources, which Timesketch then ingests for interactive analysis, search, and visualization. This tool isn’t about real-time network analysis or malware scanning; its primary role is to extract and assemble timeline events from diverse sources so investigators can see how events relate over time.