|
1 | 1 | ---------------- VERSION 4.7.0 -------------- |
2 | 2 | New Features: |
3 | 3 | - A graph visualization was added to the Communications tool to make it easier to find messages and relationships. |
4 | | -- A new Application content viewer provides custom views of media files, SQLite files, and Plists. |
5 | | -- A data source processor that runs Volatility was added to support ingesting memory images. |
| 4 | +- A new "Application" content viewer (lower right) that will contain file-type specific viewers (to reduce number of tabs). |
| 5 | +- New viewer for SQLite databases (in Application content viewer) |
| 6 | +- New viewer for binary PLists (in Appilcation content viewer) |
| 7 | +- L01 files can be imported as data sources. |
| 8 | +- Ingest filters can now use date range conditions for triage. |
| 9 | +- Passwords to open password protected archive files can be entered (by right clicking on the file). |
6 | 10 | - Reports (e.g., RegRipper output) generated by ingest modules are now indexed for keyword search. |
7 | | -- Passwords to open password protected archive files can be entered. |
8 | 11 | - PhotoRec carving module can be configured to keep corrupted files. |
9 | | -- Filters to reduce files processed by ingest modules can have data range conditions. |
10 | | -- L01 files can be imported as data sources. |
11 | | -- Block size can be supplied for local drives and for images for which SleuthKit auto detect fails. |
| 12 | +- Sector size can be specified for local drives and images when E01 is wrong or it is a raw image. |
| 13 | +- New data source processor in Experimental module that runs Volatility, adds the outputs as files, and parses the reports to provide INTERESTING_FILE artifacts. |
12 | 14 | - Assorted small enhancements are included. |
13 | 15 |
|
14 | 16 | Bug Fixes: |
15 | | -- Memory leaks and other issues revealed by fuzzing the SleuthKit have |
| 17 | +- Memory leaks and other issues revealed by fuzzing the The Sleuth Kit have |
16 | 18 | been fixed. |
17 | 19 | - Result views (upper right) and content views (lower right) stay in synch when switching result views. |
18 | 20 | - Concurrency bugs in the ingest tasks scheduler have been fixed. |
19 | 21 | - Assorted small bug fixes are included. |
20 | 22 |
|
| 23 | + |
21 | 24 | ---------------- VERSION 4.6.0 -------------- |
22 | 25 | New Features: |
23 | 26 | - A new Message content viewer was added to make it easier to view email message contents. |
|
0 commit comments