Release 2018-08-31

Truxton 2.3.1.0

<< Released 2018-08-31 >>

Improvements

1. New package tracking number variant (UPS)
2. We pull more information out of XRY XML files (chats, MMS, etc)
3. Timeline navigation improvements
4. EXIF "Model" fields now get rid of "Make" information.
5. Better support for INFO2 carving.
6. New package tracking numbers from SMS.
7. Improved serial number extraction from EXIF.

New File Types

1. Encrypted Expert Witness (ADCRYPT)
2. Python NumPy Array data
3. Windows Restore Point Queue

Bug Fixes

1. Variable length encoded text (like UTF-8) was causing the text side of the hex view to get out of sync with the bytes side.
2. Arabic RFC-2047 encoded text wasn't being decoded properly.
3. The MHT file recognizer is now more forgiving.
4. The Excel2Yara.ps1 script stopped working if you updated your computer to the July 30, 2018 version of Microsoft Office 365. Microsoft removed the ability for scripts to use Excel. The script now uses the same library as the desktop to read Excel spreadsheets.
5. Better handling of Arabic filenames coming from Zip archives.
6. Spanned Zip files that don't span any files are now handled properly. Cellebrite likes to do this.
7. Loads that produced no files would get stuck at 98% complete.
8. Newer XRY files are now identified.
9. My Findings report now generates when SHA1 hashes are missing.
10. New tool, FixSHA1, to populate old databases with SHA1 hashes.