Release 2018-03-08

Truxton 2.1.17.0

<< Released 2018-03-08 >>

Improvements

1. Automatic tagging of malware infection points
2. New entity type of Cryptographic Key ID
3. TuneDatabase.ps1 script now includes settings suggestions from http://pgtune.leopard.in.ua/
4. PGP ASCII Public Keys are now exploited
5. BMP file identification is loosened. We now account for BMPs that have an invalid format yet they still work.
6. We now have Credit Card and Phone Number specialized entity search
7. New Artifact Types report to tell you about all of the possible artifacts Truxton can process.
8. Global Artifact Correlation report. This report lists artifacts that exist in multiple sources in Truxton regardless of the investigation.
9. New Administrative Reports:
   Depot Audit - This checks to see if there's any missing depot files and attempts to locate and add them to the database.
   Optimize Database - This report will tell the database to update all statistics to make queries go faster.
10. Numerous improvements to the user interface.

New File Types

1. USPS Database
2. Android Resources
3. Microsoft Defender Scans
4. Inno ZLib
5. PGP Public Keyring
6. Apple System Statistics
7. Apple Application Bookmark

Bug Fixes

1. DatabaseTableName table was being double initialized.
2. Some JPGs were being missed in carving due to the identifier being too strict.
3. Serious bug where partitions in the middle of a disk that had no file system was processing more freespace than bytes in the partition.
4. Dashboard display no longer gets crowded when more than 50 investigations are added in a single day.
5. More credit card false-positive work done.
6. We now process the "long link name" variant of a TAR entry as well as handle filenames longer than 260 characters. The new limit is 32,768 characters.