Release 2017-08-04

Truxton 2.1.0.0

<< Released 2017-08-04 >>

Improvements

1. Desktop UI is more responsive.
2. Video Contact Sheet truncation. Short videos no longer have 10x10 contact sheets generated. Improves load time.
3. Load Lists now support all command line features by using the G: line.
4. New LoadAs loader option to force the loader's method of loading data. This allows you to force the loader to load a file as a disk image.
5. Layout of the search filters has been improved.
6. Jurisdiction support has been added to the UI.
7. Amazon search terms added.
8. Full Windows account information now included in Media Summary report.
9. File slack space is now a child file. If there is no slack space or the slack space is completely empty, there will be no child file.
10. All run times from prefetch files are reported instead of just the last one.
11. Initial support for PST/OST files.
12. Support for FedEx, Lasership and UPS package tracking numbers.
13. Alert counts are now shown for media and investigations.
14. Added hex dumps to load debugging. If the Load.exe doesn't process a disk image correctly, you can now do:
    Load.exe -loadas 514 -verbose Yes -tsk_verbose Yes -pfiles No -pfree
    No "Disk.E01" The loader will tell you what it will do without processing files or freespace.
15. File carving is now multithreaded.
16. The desktop can now manage a list of databases to connect to.
17. TuneDatabase.ps1 Powershell script will configure PostgreSQL server for multiple users and faster performance.
18. Database library now detects PostgreSQL deadlocks and waits them out.
19. Truxton now extracts the authors from PDF files.
20. Support for loading L01 files.
21. New Powershell script, MyFindings.ps1 will export your My Findings report along with all files referenced in that report to a folder of your choosing.
22. You can now create tags in a Coordinated Rapid Review.

New File Types

1. NeXTSTEP Bill of Materials
2. Apple Icon
3. Android Backup
4. KA3D Data
5. Berkeley Database
6. Apple Keychain
7. Google Quick Search
8. Android Call Log
9. iPhoto Faces

Bug Fixes

1. Carved 64-bit Windows executables are now named.
2. Phantom media identifiers were being added to File table records.
3. UTF-8 stored in ASCII fields is now detected. This affected tar files and LNK files.
4. "N/A" coming from Cellebrite reports is now ignored.
5. SQLite file header details were missing integer fields.
6. MP3 file carving was utterly stupid. It is much better now.
7. Image Thumbnailer ETL now has a dead-man-switch. If a file causes the code to neter an endless loop, the process will die after 50 seconds.
8. Improved carved SQLite file length calculation.
9. User account last logon times are now correct.
10. Entropy calculation now checks for zero entropy. Sometimes, a file full of zeroes would produce a non-zero entropy like 0.00000000000000012 (floating point number fun).
11. When spawning the loader from the desktop, the current working directory is now set. Relative pathed disk image names were being missed.
12. The "data" variant of E01 is now supported.
13. Fixed a Media list paging bug.
14. Unique entity list contained multiple entries.
15. plist parsing bug was causing ETL death.
16. Expanding zip file fragments was broken.
17. Years before 1981 are now parsed in MIME headers.
18. Index.dat files were causing exceptions to be thrown.
19. Firefox Cache2 file carver was too loose.