Release 2017-03-17

Truxton 1.171.52967.348

<< Released 2017-03-17 >>

Improvements

1. When performing a load, the loader will automatically determine if the folder where the depot file is written is part of a shared folder and populate the "URI" column in the "Depot" table for you.
2. Added more details to depot file headers.
3. Added TAR file as a supported depot format but the disk usage was out of control. We will no longer speak of this.
4. Download Logs on the desktop help screen generates a ZIP file with all of the different log files needed to diagnose a problem. Try it sometime and see what we (the Truxton developers) would see when you report a bug.
5. Much more logging was added to the installer. This helped when we discovered that it is possible for Windows to screw up the security ACLs on a file. There's an MSDN article from 2009 that talks about "ACL is non-canonical" grrrr
6. New paging control now has a fixed geometry so you can click without having to move your mouse to go to the next page of results.
7. You can now import from the Media page as well as the Investigation page.
8. The Depot size in the database is now properly updated.
9. Made Ogg serial numbers an entity type. We can now correlate the movement of Ogg files through media/investigations. These were added to the investigator finding's report.
10. Titles added to all facets in the desktop.
11. You can now navigate to the Timeline view from the investigation events page.
12. Added Chrome file downloads to events and web browsing history. Also process Chrome search terms.
13. Hashes are now clickable to see details about them. They were also added to the investigator findings report.
14. Many "count queries" were improved for the desktop.

Bug Fixes

1. The individual load monitor process (also Load.exe) would sometimes get confused and continue to spawn load processes.
2. Malformed RFC 2047 email addresses were causing email expander to die a sad death.
3. When a BOLO generates an Alert, the BOLO hit count is now incremented.
4. CreateHashList.exe no longer blows when processing an empty hash list.
5. Some entities were not able to be added to the investigator findings report.
6. MD5 Hash table is now updated when new data is imported from other Truxtons.
7. SQLite Summaries didn't have the same date/time stamps of the parent.
8. Loader is many times faster for large loads. Keeping track of loaded files is now much faster.
9. Support for Android Gallery image caches