Release 2018-11-11

Truxton 2.4.0.0

<< Released 2018-11-11 >>

Improvements

1. Artifact Locations now load faster
2. Break out more file details for zip files
3. Improved loading speed of images in the UI (pictures, domain icons, file type icons, video contact sheets, etc).
4. Improved MS office parsing: Added another variant of author details.
5. Renamed EXIF to Camera Info.
6. Major improvements to filtering the search results.
   1. Constructing a filter in the query builder is now unified and will apply to all search results. An indication will show when a certain filter field is not applicable.
   2. All search result category counts update when filters are updated.
   3. Saving filters are now no longer separated by the major types of search results (Artifacts, Camera Info, Events, Files, Hashes, Locations, Messages, Websites)
   4. Results now update in real-time as the filter changes.
   5. Added handy inline time and location "shortcut" filters any time a date or lat/lon are displayed
   6. Filter rules no longer fill horizontal width
   7. User can choose between meters or kilometers for location searches
7. EXE details now include "Reproducible Checksum" instead of timestamp
8. Added support to carve mpeg2 videos
9. Added parsing camera information from mpeg2 video streams
10. Added tag display to media list grids
11. Improved naming of carved JPEGs derived from EXIF information
12. Added support to carve MKVs
13. Reduced false positives when carving JPEGs
14. Updated to RegRipper 2.8
15. Added more files details for PE files
16. Expand RDP tile caches to produce BMPs
17. Exploit Windows System Event 7045 for service installation and possible malware infection point
18. New automatic tag of "External Drive" when references to drives other than "C:" are seen.
19. Operating System Time Zone is now included in the Media Summary Report.
20. Improvements to the conversations visualization
    1. Load speed and UI responsiveness improvements.
    2. Messages with lots of participants no longer make the conversation unreadable.
    3. When viewing a conversation involving a subject, show the associated picture instead of the initial of the message address
    4. When downloading a conversation, include attachments and the original source file of the message in the report. Additionally, display subject pictures.
21. When viewing a message body, strip out html and rtf markup.
22. Added support for Guojia Biaozhun Kuozhan code page in messages
23. Tree view control for file systems now only loads the first 100 items

New File Types

1. USN Change Journal
2. Windows Error Reporting
3. CIM Object Data
4. Windows Activity Database
5. Windows Notification DB
6. RDP Tile Cache (bin)
7. PCAP
8. Windows Event Trace Log
9. Microsoft Intra-Package Delta (Cabinet file entry)
10. Google Takeout Location History

Bug Fixes

1. In the hex viewer fixed issue where cycling through artifacts wasn't wrapping as expected
2. Fixed issue where full text search wasn't working when an investigation had a lot of media
3. Fixed a bug in zip fragment expansion
4. Fixed preview frame not loading video contact sheets correctly
5. Fixed issue where concurrent loading of video contact sheets would display incorrect image information
6. Fixed issue with plist parsing
7. Fixed artifacts indexing their parent media id multiple times
8. Fixed searching by event description not working
9. Fixed nested and/or not working correctly with full text search queries
10. Fixed partial sha1 and md5 search not respected not equal operand
11. Fixed filter criteria occasionally not persisting to local settings
12. Fixed generated files not being indexed
13. Fixed bug when parsing window logon hashes
14. Fixed eliminated files not indexing filenames
15. Visual Media no longer does a full page refresh when performing tagging or other analyst operations
16. Fixed address links not showing for addresses for correlated contacts report.
17. Fixed tagpicker not working for camera info view page
18. Fixed tagpickers not associating media id correctly
19. Fixed phone numbers found in Cellebrite xml which weren't being related to names in the correlated contacts
20. LNK files with no string data are now parsed correctly
21. Many bugs fixed in PST parsing
22. Media Summary Report was incorrectly reporting the primary user of a system based on logon counts.
23. Amcache files weren't being routed to RegRipper.
24. Master Boot Record details had garbage characters in it.
25. Fixed sorting for child file and hash children grids
26. Fixed issue where filtering visual media by tags wasn't working when navigating backwards.
27. Multiple bugs fixed in vCard processing. Offsets to artifacts is now correct.
28. Consolidated Contacts report was missing email addresses.
29. Fixed issue where child file grids were not persisting their state correctly. This included information such as sorting and column sizes