Release 2018-06-01

Truxton 2.2.0.0

<< Released 2018-06-01 >>

Improvements

1. Eliminated a JPEG false positive identification.
2. File carving speed has been improved.
3. Truxton now has hit highlighting. When doing a text search, we now display that hit in context.
4. More information included in iOS executables File Details
5. Carved SQLite WAL files are now truncated.
6. The My Findings report, when downloaded, now includes the files referenced in the report.
7. Images are now displayed in reports.
8. DJI Drone parser now includes GPS timestamps.
9. Tracklogs in KMZ reports are now animated.
10. Truxton can now generate a geographic report at the Investigation level.
11. New Powershell script, GenerateReloadList.ps1, will create a load list out of your current holdings. This makes doing a reload much easier (for testing different releases of Truxton).
12. Seized media locations are now included in the Geographic report.
13. Tags now contain the reason they were created. Media summary page now displays automatic tags and their sources.
14. Quoted search terms allow exact term searching.
15. Alerts hits for media are now displayed in the media information section.
16. SHA1 hashes are now displayed in the UI
17. Database is now tuned during install
18. Report logo is now configurable in the general settings section
19. LNK files are now expanded out of registry files
20. New Correlated Contacts Report. Produces a unique list of contact information from an investigation or individual media.
21. We now exploit Apple Account3 databases
22. Filter by tags in Media Management page
23. Visual Media section much better tagging, bulk toggle offensive, overlay tags, etc.
24. Much better touch screen support
25. Microsoft Office Document spoofing detection. Documents that look like they may have been altered outside of Office will be tagged with "Document Spoofing" tag.

New File Types

1. iOS Device Values
2. WhatsApp Log
3. Chromium Cache File
4. NeXTSTEP Typed Stream
5. iOS Restrictions Pin
6. Windows Recent File Cache
7. Symbian Resource
8. Symbian MIF
9. AmCache Registry
10. SparkPeople Database
11. Apple Bluetooth
12. Pandora Music

Bug Fixes

1. Fix random order of items when looking at query results after second page.
2. Improved SQLite identification of:
   Apple Call History
   iOS Photos
   Safari History
   Android Contacts
3. The Identify ETL process would never exit.
4. plist expansion had nameless children.
5. Carver speed improvements exposed a bug in freespace offset calculation (database record caching).
6. iPhone camera orientations now take into account if the photo came from the front or back camera.
7. Fixed the handling of emoji in text messages going into the database. Changed to a much simpler form of text escaping.
8. Populating Depot's URI column with the correct case of the machine name has been fixed. Turns out, when you ask Windows for the name of the computer, it converts it to all upper case which prevents software (like Truxton) from connecting to shares on that machine.
9. Existing media information is no longer overwritten when performing a prism load.
10. Contact sheets for videos are now constrained by height when there are less than 100 cells
11. Fix breadcrumb navigation occasionally not working
12. When tabbing between cells for physical artifacts, it now tabs left to right instead of top to bottom
13. Fix alerts being generated twice for the same media
14. Added some missing text based file types to SOLR Text extractor
15. Fix hex viewer not highlighting active search result
16. Fix some search queries not including expected results
17. RegRipper reports can contain non-text. Now, any non-text character is normalized to space character so we see the entire report.
18. It is now possible to load media from the desktop UI after updating to Windows 10 to release 1803. Thanks Microsoft.