plaso tools doesn’t get updated.

[ZayadAlosaimi]

Greetings SIFT team,

Please advise on the issue for plaso tool update using apt or cast. the latest version is 2024 that is running in SIFT machine

[digitalsleuth]

Good morning @ZayadAlosaimi , are you currently running SIFT in Ubuntu Jammy (22.04)? If so, the GIFT PPA (source of the plaso package), currently only has 20240308-1ppa1~jammy as its latest package. However, Ubuntu Noble (24.04) currently has 20260119-4ppa1~noble.

If you are able to update your SIFT instance to 24.04 you will get a newer version of plaso, but because the repo only has 20240308 for Jammy, you might have to install the updated package manually either via python from the PyPi repository (pip/pipx), or manually by following the instructions on the website.