Thema: Forensic Software diverses

[SiLæncer]

DiskMgr provides a user-friendly way to change DISK attributes in a Windows Forensic Environment (WinFE).

DiskMgr has both 32 and 64-Bit portable executables and is only for advanced users who understand and need to change their disk attributes. You can set your disk attributes to Offline, Online, Read-Only, and Read-Write.

DiskMgr makes setting your disk attributes super simple, but again, it should only be used by advanced users.

Freeware

http://reboot.pro/files/file/573-diskmgr/

[SiLæncer]

Changelog

File Index
New Zoom indexer build, fixed bug that was failing to index particular .OST and .PST files with compression.
File Name Search
Fixed a crash which could occur in the hash set lookup function when the hash set being searched contained very long string lengths.
Thumbnail View, flags are now custom drawn to increase the speed when updating path flags, for example when doing hash matching.
Hash Lookup
Added support for ‘Modeless’ dialogs for hash lookup for multiple files. This allows other modules in OSF to be used simultenously with hashing in background.
Fixed dialog resizing screen corruption issues in the hashset lookup window
Reduced the frequency of update to the user interface when hash operation is running to improve speed. It looks slower, but is actually much much faster.
When performing a hash set lookup for multiple files, 4 threads and a larger block sizes for disk reads are now used in order to increase performance. For large hashsets, with a fast SSD, performance improved 5 fold.
Added a limit of 1000 file set matches returned for a single file hash lookup. So 1 file on disk can now not match more than 1000 applications. Previously a zero length file would match 500,000 applications in NSRL list.
Added a limit of 5 file set matches returned for multiple file hash lookups file set results a hash set lookup for a single file will return which improves speed dramatically when hash set or files being looked up contain matches in multiple files sets (eg when searching for file hashes in a set containing millions of records such as NSRL hash sets)
Added caching of 0 byte / empty (contains only 0’s) files to speed up multiple hash set lookups. Zero length files appear around 5000 times on a typical hard drive. So this can save 5000 slow database queries.
Hash Sets
Added a „Properties“ right click menu item to display a dialog with some information about the hash set (disk location, number of product types, file sets, files).
Password recovery
Fixed a CSV formatting error when using the Copy row(s) to clipboard function if an item contained a ‘,’ character
Recent Activity
Fixed a bug where shellbag information was not being retrieved correctly when using “Scan drive” C: instead of live acquisition.
Fixed a CSV formatting error when using the Copy row(s) to clipboard function if an item contained a ‘,’ character
Fixed a bug where the last connected date of a USB item could be different in Live search when compared to a C: search

[close]

http://www.osforensics.com/

[SiLæncer]

Changelog

NEW Triage wizard Wizard launch icon on Start page. Huge amount of data can now be rapidly collected by inexperienced users with single click.
Customize workflow Now also removes icons from the Start page (and the menu)
It is possible to lock down the workflow with a password so inexperienced users can’t re-enable all the features so easily.
Case Manager Items added to a case can now be categorized into a type of Crime, this list can be customised by editing the “Categories.txt” file in the ProgramData folder.
On the “add to case” dialog when using the “Use same details for all” option if the title has not been changed by the user a special <Use item name> flag will be displayed. This will then be replaced by each item’s name when added to the case.
PDF reporting bug fix.
Fixed sorting by clicking on title in Case Management window.
Added new tag <!–OSF_CASE_CASEINFOTABLE–> to customisable reports for generating Case Info table. Only non-blank fields shall be outputted
File Index Fixed a buffer overflow bug due to illegally long filenames in ZIP files
Recent Activity Started sanitising the HTML output for some items when exporting to HTML so that HTML special characters (eg <>&) are safely encoded.
Thumbnail Viewer Now has a faster option to switch between the various thumbnail files found on drive via a drop down list.
Drive preparation 1 click drive preparation function. Can wipe, verify, format drive with 1 click. A log file is also now written to the drive recording the preparation steps.
Hash Set Lookup Added check if SHA256 hash is stored in the hash set. If not, SHA256 is not calculated. This saves a small amount of CPU time.
Email viewer A bug fix for parsing some rare corrupted PST flies
Misc Correction of various multi-threading bugs, which came to light when running a large number of tasks simultaneously. Registry access code wasn’t thread safe & could crash if multiple tasks were reading registry entries at same time, especially password recovery.
Caching of disk’s MFT into RAM didn’t work well with multiple threads. Solution was to enlarged cache slightly and unified it into a shared cache. Multiple threads should run significantly faster than before.
Some handles to various internal resources were not being free. Resulting in memory leaks and possible crashes.
Even larger cache sizes and more advanced cache lookup algorithm to speed up various operation that involve reading MFT (is a RAM usage / speed trade off). Slightly more RAM is used, but disk operations are faster. For example file name searches are now 33% faster.
Some help file updates
Fixed up the opening of the Help file to get the navigation menu showing again. The Edge browser in Win10 unexpectedly broke some of the help functions.
Fixed a crash in the 32bit version when trying to start a filename search

[close]

http://www.osforensics.com/

[SiLæncer]

Changelog

Recent Activity

    Fixed a crash that could occur when adding a filter when something other than "All" was selected in the treeview

Triage wizard

    Added "Manually carve files in unallocated clusters" suggested action
    Added "Generate new HTML report" and "Generate new PDF report" suggested actions.
    Fixed SysInfo "# commands completed" not updated properly on completion
    Fixed wording of several "Suggested Actions"
    Fixed BitLocker detection results appearing in System Information results
    'Manually search' suggested actions now automatically start the corresponding search
    Auto-generated HTML/PDF reports are now saved in separate "Triage PDF Report" and "Triage HTML Report" folders respectively
    Fixed underline/cursor/text colour confusion for list view text that are not links

[close]

http://www.osforensics.com/

[SiLæncer]

Autopsy is a graphical interface to The Sleuth Kit and other analysis tools. It was designed to be an extensible platform so that it can be an end-to-end digital forensics solution that incorporates plug-in modules from both open and closed source projects. The application provides users with various analysis features and with the possibility of generating HTML or CSV reports as well.

License: GPL

Changelog

Memory usage has been reduced to improve support for very large cases.
New central repository feature has been added that allows you to correlate between cases and track if an item was previously identified as being "bad" or notable.
Message attachments are not associated with the message (and not just the source file). These can be found in the data sources and messages parts of the tree.
Credit card number search has added logic to reduce false positives based on number lengths.
Virtual directory nodes in the tree view are distinguished in the Data Sources tree by the addition of a "V" to their icon. These are folders that Autopsy/TSK created.
A new version of the automated ingest dashboard has been added to allow insight into pending, running and completed automated ingest jobs in automated ingest Examiner mode.
All occurrences of "Known Bad" in the user interface have been changed to "Notable."
Assorted small enhancements and bug fixes are included.

[close]

http://www.sleuthkit.org/autopsy

[SiLæncer]

Changelog

Deleted File Search Fixed a stack corruption crash
SQLite Browser Fixed issue where OSF wasn’t able to extract blob contents for sqlite tables created using WITHOUT ROWID.
Forensic Imaging Fixed error when attempting to image a locked Bitlocker-encrypted drive. Instead of opening the drive letter (eg. ‘C:’), the underlying physical disk (eg. \.PhysicalDrive0) is opened instead
File Index New Zoom indexer build with added support for indexing .sqlite, .sqlite2, .sqlite3 and and identifying SQLite files with no extensions
Misc Made some changes to how temporary files are created to make them thread safe (to prevent multi threading issues when using the triage function)

[close]

http://www.osforensics.com/

[SiLæncer]

Changelog

Browser Passwords Fixed a crash that could occur when there was more than 50 Firefox username/passwords
Disk Imaging Allow continuation of imaging after encountering too many bad blocks (1000).
Added extra check if the first read fails when verifying the image created.
System Information Fixed crash possible with getting printer info when system returns bad information.
Fixed a crash in some cases when getting the computer name from the registry
Misc Fixed bug where navigation bar icons were incorrect for items near the end/bottom.

[close]

http://www.osforensics.com/

[SiLæncer]

Changelog

Case Report Added dll required by wkhtmltopdf.exe to installer to prevent an export to PDF error error seen on windows 8
Rainbow Tables Fixed crash occuring when cracking hashes from a pwdump txt file when secure case logger was enabled
Recent ACtivity Fixed a crash that could be caused by 0 length entries when processing Jump lists items
Triage Wizard Fixed a crash caused by trial limitations when running the triage wizard
Misc Improved how temp files are stored to make it more threadsafe (eg when running multiple tasks using the Triage Wizard)

[close]

http://www.osforensics.com/

[SiLæncer]

Changelog

Disk test:

Fixed a crash when formatting as FAT32 fails.
Fixed an issue with formatting as FAT32 on small drives.

Deleted Files:

Fixed a crash that could occur in deleted file search when file carving is selected but the physical disk has been removed from the system
Fixed an uncaught exception error when loading MFT for some OSF devices.
Fix a Bug where raw whole disc carving was incorrectly returning progress, causing possible crash when accessing the list.
Fixed error box appearing when failing to read non-resident MFT attributes (eg. LCN is invalid as the MFT attribute has been overwritten). Instead, the error is logged and the search silently continues
When parsing $ATTRIBUTE_LIST, buffer is now properly allocated according to the size of the attribute. Previously, this caused an assert error to occur due to the buffer size being too small

Internal Viewer:

Fixed potential memory leak when generating video thumbnails
Fixed potential concurrency issues when loading videos

Mismatch File Search:

Fixed a bug with the CSV export dialog displaying a .HTML file extensions instead of .CSV

Password recovery:

Removed a "File not found" error when running the windows password search on a non system drive

System Information:

Fixed a possible crash when getting printer information

Triage Wizard:

Fixed an uncaught exception error that could occur when running a scan on a non system drive (eg D) and having only windows passwords selected.
Fixed a missing file error message that was displayed when running a scan on a non system drive (eg D) and having only windows passwords selected and 0 results were found

[close]

http://www.osforensics.com/

[SiLæncer]

Changelog

New Features:

A new Message content viewer was added to make it easier to view email message contents.
A new Communications interface was added to make it easier to find messages and relationships.
Hash sets can be centrally stored and shared in the Central Repository.
New Encryption Detection module that will flag possibly encrypted files.
Can more easily run Autopsy from a USB drive and leave few traces on target system.
Tag definitions now have a "notable" property. The Central Repository uses this to mark files as notable.
Large slack files are now file typed.
The maximum number of Solr connections and ingest threads have increased.
Periodic keyword search will dynamically change based on how long queries are taking.
Users can change the amount of memory allocated to the application.
The amount of memory required for processing keyword hits has been reduced.
Layout of HTML reports has been modified make it easier to open.
"Databases" was added to File Type by Extension view.
Users can now enter more information about cases including examiner, organization, etc.
New dialog to open multi-user cases that allows for searching.
Auto ingest metrics are collected and displayed in dashboard.
Auto ingest module that extracts disk images from archive files.
Keyword search has been made more responsive to both search and ingest job cancellation.
Number of log files to keep before rollover is now configurable.
Preliminary changes to make Linux and OS X builds easier.

Bug Fixes:

Memory leaks and other issues revealed by fuzzing the SleuthKit have
Been fixed.
Memory issues caused by Tika are fixed (by upgrading to 1.17)
Assorted small enhancements and bug fixes are included.

[close]

http://www.sleuthkit.org/autopsy

[SiLæncer]

Changelog

Case Manager
Report Fix, if the background thread copying files for report didn't exit cleanly OSF may warn of background activity when quitting.
Case Details Dialog
Fixed bug that might cause case narrative text to be reset to default when editing case details.
Will prompt user to confirm cancelling changes when they edited case details fields and clicking cancel.
Case Export
Changed text on "Cancel" button to "Close" on the Generate Report Dialog since custom logos are saved to config once changed in the dialog.

[close]

http://www.osforensics.com/

[SiLæncer]

Whats new:>>

Recent Activity:

Fixed an error that could display when a jumplist was finished being processed

Registry Viewer:

Fixed a crash that could occur when reading a registry file

http://www.osforensics.com/

[SiLæncer]

OSFClone is a free, self-booting solution which enables you to create or clone exact raw disk images quickly and independent of the installed operating system.

In addition to raw disk images, OSFClone also supports imaging drives to the open Advance Forensics Format (AFF). AFF is an open and extensible format to store disk images and associated metadata. An open standard enables investigators to use quickly and efficiently their preferred tools for drive analysis. After creating or cloning a disk image, you can mount the image with PassMark OSFMount before conducting analysis with PassMark OSForensics™.

OSFClone creates a forensic image of a disk, preserving any unused sectors, slack space, file fragmentation and undeleted file records from the original hard drive. Boot into OSFClone and create disk clones of FAT, NTFS, and USB-connected drives! OSFClone can be booted from CD/DVD drives, or from USB flash drives.

Freeware

Changelog

Changed Linux OS to Porteus V4.0 RC4
Fixed bug with Compute Checksum calculation when choosing SHA256 and SHA512 would actually be computing SHA1.
Updated dc3dd to 7.2.646
Updated libewf to 20171104 (included libsmdev-20171112)
Updated afflib to 3.7.16
Updated aimage to 3.2.5
Updated ddrescue to 1.23
HFS+ filesystem supported for read/write.

[close]

http://osforensics.com/tools/create-disk-images.html

[SiLæncer]

Changelog

A graph visualization was added to the Communications tool to make it easier to find messages and relationships.
A new "Application" content viewer (lower right) that will contain file-type specific viewers (to reduce number of tabs).
New viewer for SQLite databases (in Application content viewer)
New viewer for binary PLists (in Appilcation content viewer)
L01 files can be imported as data sources.
Ingest filters can now use date range conditions for triage.
Passwords to open password protected archive files can be entered (by right clicking on the file).
Reports (e.g., RegRipper output) generated by ingest modules are now indexed for keyword search.
PhotoRec carving module can be configured to keep corrupted files.
Sector size can be specified for local drives and images when E01 is wrong or it is a raw image.
New data source processor in Experimental module that runs Volatility, adds the outputs as files, and parses the reports to provide INTERESTING_FILE artifacts.
Assorted small enhancements are included.

[close]

http://www.sleuthkit.org/autopsy

[SiLæncer]

Changelog

Case Management:

Added "Export case" button
Added a list of reports that have been generated (in case directory or last known export directory)
When creating/editing case, user can now specify whether or not USB write-block should be enabled. Whenever the USB write-block settings are changed, a warning is displayed to the user to detach/re-attach connected USB devices for the settings to take effect.
Changed list view to allow groups (devices, reports, files etc) to be collapsible
Added last access date to case management when case is loaded
Fixed error copying files with long file paths in when a report was created and the report contained deep / long paths.
Fixed a bug when creating a case report that was leaving a file handle open
Added support for encrypting PDF report
Added predefined offenses list to 'Offense' drop down list when creating/editing case
Case Details Dialog, fixed bug that might cause case narrative text to be reset to default when editing case details.
Case Details Dialog, will prompt user to confirm cancelling changes when they edited case details fields and clicking cancel.
Case Export, changed text on "Cancel" button to "Close" on the Generate Report Dialog since custom logos are saved to config once changed in the dialog.
Re-added "E-mail Delivery Time" to report and the associated timezone
Case load window was added at startup and when a case is loaded from the Case Management window. This is useful for showing load progress for very large cases with 10,000s of files in the case.
Report production progress window was added to show some progress activity when very large reports are produced.
New Command Line Parameter to load a specific case (-C <PathToCaseFolder>), if path does not exists or CaseDetails.OSFCase file cannot be found, OSF will default to loading the the last case used.

Create Index:

New indexing engine (Zoom V8 with multi-threaded offline indexing)
Much better indexing performance (3x speed increase)
Updated Create Index interface with new file type selections,
New "Memory optimization / Indexing Limits" step to bypass Pre-scan
Added support for user configurable number of indexing threads (up to 10)
Added options to enable/disable RAM drive
Improved RAM estimations and Indexing Limits settings
Improved indexing Status interface
Updated OSF interface to show multi-threaded indexing
Updated OSF Create Index options to offer more control with file type selection
Removed unnecessary indexing warnings
Added count display for Prescan
Added thousands grouping for large numbers shown in Create Index windows
Increased sleep/wait time while starting indexer to allow for a slower initialisation which could cause an error to be displayed
Renamed indexing process. Now using "OSFIndexer32.exe" and "OSFIndexer64.exe" instead of ZoomEngine32.exe and ZoomEngine64.exe, this should make it more obvious what is running in task manager.
Added some internal checking to clean up detached instances of OSFIndexer and temporary RAM drives.
Fixed a bug with indexing the compete content of Emails in PST files that were text only EMails.

Deleted Files:

Column ordering, visibility and size now saved in OSForensics config file
Configuration options now saved in OSForensics config file
Fixed a crash caused by logging a magic number incorrectly when getting deleted files
Fixed uncaught exception error when loading MFT for some OSF devices
Fix Bug where raw whole disc carving was incorrectly returning progress, causing possible crash when accessing the list.
Added check for buffer overrun when looking for slack $I30 entries
Errors when parsing non-resident attributes of deleted MFT records no longer causes the search to terminate and throw an error message. This is an expected case. Errors are now written to the debug log and the process continues.
Fixed a crash that could occur in deleted file search when file carving is selected but the physical disk has been removed from the system
File Carver, added minimum file size option when carving. Changed "Reserved/Future Use" field in osf_filecarve.conf to "Min File Size"
File Carver, TIFF/CR2 extraction should be better.

Disk Imaging:

Added extra check if the first read fails when verifying the image created.
Disk Preparation
Can now wipe BitLocked drives. Previously these drives appeared to be lock and could not be formatted.

Disk Test:

Fixed issue with formatting as FAT32 on small drives.
Fixed Crash when formatting as FAT32 fails.

E-mail Viewer:

E-mail times now include the timezone offset, both 'Delivery Time' and 'Client Submit Time'
Fixed printed e-mails missing e-mail addresses due to HTML entities not being escaped
Fixed bug where case item title set to '<Use item name>' when selecting 'Use same details for all'

File System Browser:

Added right-click menu option to jump to MFT record in the raw disk viewer
Fixed stack overflow when attempting to add device to case

File Name Search:

Added an "Uncheck all" menu item to uncheck currently selected items
Added 'Windows Shortcut Files' (ie. lnk files) to the file name search presets list
Column ordering, visibility and size now saved in OSForensics config file
Removed folders from results when filtering using hash set
When filtering using hash set, fixed bug with current file being added to results after cancelling search
In hash set' flag is now set for results when hash set is used and made active
Added support for filtering by whether or not the file belongs in the hash set. This allows the user to search for files on disk that match a set of hash values
Re-arranged configuration dialog
Forensic Imaging
Re-arranged tabs
Create Image, for physical disks, disk model and serial number are now saved in the info file
Added new 'Device and SMART Info' for displaying physical disk attributes + SMART info
Device & SMART Info, Added support for export and adding report to case
Device/SMART Info, added mouseover tooltip descriptions for SMART attributes

Forensics Copy:

Moved allocation of virtual disk image to thread to prevent system from being unresponsive

Hash Set:

Added option to create 'Quick hash set', allowing the user to quickly create a hash set by specifying a list of hashes
Fixed deleted hash set databases appearing in the file name search config drop down box
Re-organised buttons in main window
Added functionality for importing Project VIC JSON files with MD5 hashes & optimised the import load time.
Added default database name when importing VIC data set
Stopped navigation bar being disabled when importing hash set. User can now do other tasks in parallel to importing a large hash set.
Fixed hash set operation LED still "active" when there's an error
Fixed number display and file size formatting to be more readable for large import files (> 4GB)
When creating hash set databases, columns are no longer created for hashes that don't exist (eg. VIC/NSRL datasets)
Hash set lookup
Added right click menu option to open files in internal viewer
Fixed incorrect # files hashed text due to not updating the dialog once all files are hashed
When performing hash set lookups, hashes are no longer checked for columns that do not exist. This reduces the query time for large hash sets. e.g. we don't check for SHA1 matches if the particular hash set doesn't have SHA1 values.
When performing single file hash lookups, filename matches are no longer queried. This reduces the query time for large hash sets.

Install to USB:

Added help Link
Added separate "temp build" directory field when using WinPEBuilder.

Internal File Viewer:

EFS Support. When an EFS file now opened in the file viewer a temp copy will be created and passed to the hex and text viewee. If the matching certificate has been installed on the system then the text should appear decrypted.
Hex View, added right-click option to add selected strings to case (as HTML file)
Fixed potential mem leak when generating video thumbnails
Fixed potential concurrency issues when loading videos

Memory viewer:

Column ordering, visibility and size now saved in OSForensics config file
Added button to add memory dump to case
Removed 'Error' text and icon from message box when process memory cannot be dumped because of access restrictions

Mismatch File Search:

Fixed a bug with the CSV export dialog displaying a .HTML file extensions instead of .CSV

NSRL Hash Import:

Import 9x faster. While importing repeated file hashes, checks for duplicity are no longer being done using a lookup on non-indexed database (very slow). Now checks are done by comparing product code between two consecutive lines in input file.
Import will create new database automatically with default name based on date and time. Thus, incremental import is no longer an option.
New NSRL import config window to specify input and (temp) output folders
Temp Output folder can be specified so that user can specify RAM drive or SSD to speed up the import. Database is then moved from temp location to default hash sets location.
Updated help file with info about allocating enough space on a RAM drive.
Status now displays percentage counter during file importing

Password Recovery:

Added tab to allow PFX certificates to be installed on the local system, to facilitate opening EFS encrypted files when the certificate and password are available
Column ordering, visibility and size now saved in OSForensics config file
Browser passwords, made some changes to Firefox login recovery, now has a 64bit and 32bit helper executable (as FireFox have started distributing as 64bit).
Registry passwords, now displaying password hint value next to 'NT Password' column. Displays '(empty)' if not present.
Registry Passwords , added support for win10 anniversary update for live system in Forensics mode
Removed a "File not found" error when running the windows password search on a non system drive

Prefetch Viewer:

Added right-click option to export selected items to CSV

Rainbow Tables:

Fixed crash occurring when cracking hashes from a pwdump txt file - wrong data types were being past to format string when secure case logger was enabled

Raw Disk Viewer:

Added progress window when carving to file
Renamed 'Decode' window to 'Disk Info'
Renamed 'Data Interpreter' window to 'Data Decode', split windows and shuffled content between decode window.
Added right-click menu options to 'Data Decode' window, Jump to File and Jump to File Record.
Clicking on file paths now open the internal viewer
Clicking on LCN/offsets now jump to the offset in the raw disk viewer
Data Interpreter window now shows the MFT record number and filepath if the current cursor position is inside the $MFT file
Fixed crash issue when sector size could not be determined
Fixed right-click "Jump to offset" not working some of the time

Recent Activity:

Added a quick filter option (text box and button) to quickly apply a text filter to recent activity items
"Show empty activity types" checkbox to default to on so empty types are displayed
Results are now sorted by Date (desc order) by default
Fixed possible crash when reading jumplist info

Registry Viewer:

Support for generating reports for known registry hives (currently only SOFTWARE hive at the moment)
Fixed a possible crash when processing a registry file

SQLite Browser:

Will checks for Skype Sqlite database files during "Scan for DB Files".
Resizeable Dialog/Controls
Option (enabled by default) to convert known timestamps to readable format
Scan Folder button is now more useful. Will now populate with locations of known SQLite files (e.g. Chrome and Firefox profile directories)
Scan Folder button will scan for known Android user data directory (where apps usually store their own data) on currently selected drive

System Information:

A new tab is now created for every new result
Added option to restore command lists back to default
Added "Recovery of Bitlocker Keys" to command list
Added ability to assign a name to an entered command. This name will then be displayed in the output/report.
Added support for Embedded Python 3.6.5
Removed the "Get" from the start of some item names.
Changed button text from 'Add...' to 'New...' when adding new commands
Moved 'Reset lists to default' option to dialog window. Added confirmation prompt to prevent accidental press.
Replaced spin control for moving items up/down due to overriding the handling of mouse wheel messages
Re-organized controls
Added command to get current clipboard contents
Added command to get anti malware (windows defender) software status
Added command to get current TPM status
Started encoding HTML special entities in output from tools so anything with HTML characters will display correctly
Fixed crash possible with getting printer info when system returns bad information.

Triage Wizard (now renamed to Auto-Triage):

Changed Wizard icon to fingerprint icon & removed forensics dude. R.I.P forensics dude, we loved you, but the world just wan't ready for you.
Added option to create logical image with known system files
Added agent help text when mouse is hovering over a control
Added a free disk space check (for at least 1GB + memory size if memory dump selected)
Fixed a unhandled exception that could occur in the triage wizard when running a scan on a non system drive (eg D) and having only windows passwords selected.
Fixed a missing file error message that was displayed when running a scan on a non system drive (eg D) and having only windows passwords selected and 0 results were found
Fixed a crash caused by trial limitations when running the triage wizard

Web Browser:

Added status bar to browser.
Can now select export format as Web Archive Format (.mht) when exporting webpage.
Can now export linked PDF, ZIP and other files. Also added check boxes to allow user to select what is downloaded.
There is an option to download videos (MP4 format) from sites such as YouTube and add them to the case.
Added a progress indicator for downloading large files.

Misc:

Added colour coding of encrypted files displayed in a file list
Added exit confirmation message
Added warning message on OSF shutdown whenever the USB write-protect settings are changed during the course of execution
Fixed a long delay at startup when not running as Admin
Removed agent icon from feature description text on start window
After successfully saving a file to disk, fixed a bug with activity monitor displaying task is still active
Changed how temp files are stored, each thread now has a temp folder
Increased a timeout (from 60 seconds to 180 seconds) when trying to repair esedb databases with esetutl as was timing out during triage runs
To prevent machine from sleeping when running from USB, the mouse will jiggle if the time between user input (i.e. keyboard or mouse input) surpasses 10 secs.
Added DLL (MSVCR120.dll) required by wkhtmltopdf.exe to installer (error seen on windows )
Switched debug logging to logging library g3log for thread-safe, crash-safe, faster logging

[close]

http://www.osforensics.com/