Release 2019-12-19

Truxton 3.1.0.0

<< Released 2019-12-19 >>

Improvements

1. Added file origin to file type breakdown report.
2. Output more feedback when using the automated installer.
3. Improved client dashboard load speed.
4. Client previewbox wraps to the next row when being viewed on smaller screen resolutions.
5. Improved accuracy of RTF carver for file types and author.
6. Improved extracted details of ELF executables.
7. User can now quickly hide directories from UI search results (on by default).
8. Increased support for windows event log messages.
   1. 1001 & 1002 Microsoft-Windows-Storsvc/Diagnostic - Microsoft USB storage device insertions.
   2. 2104 Microsoft-Windows-WebAuthN/Operational - Two Factor Authentication USB Devices.
9. Improved Unicode HTML identification.
10. Type colors start out as a random color instead of grey.
11. Reduced load memory consumption for some E01 configurations.
12. Improved empty detection used when carving.
13. Improved output for reports.
    1. Display notes for referenced files and findings in the My Findings report.
    2. User can choose to omit notes and referenced binaries when downloading the my findings report.
14. User can now quickly hide Truxton generated files from UI search results (on by default).
15. Better identification and exploitation of Android Telephony DB.
16. Can now copy the string or byte text from the hex viewer via ctrl-c.
17. More SQLite WAL consolidation.
18. Improved Android MMS SMS identification.
19. Improved Android Signal identification.
20. User can now choose encoding for text content view.
21. Improved MMS attachment extraction.
22. Updated NSRL to 2.66.
23. Users now manage connections to instances of Truxton via a unified interface for both metadata (database) and content (depots).
24. Pressing the escape key now closes dialogs in the UI.
25. New Alerts are now added when a media is reprocessed.
26. The order for sorting options in the search UI is now alphabetical
27. Improved ETL startup time.
28. Added ability for a user to force media being loaded to the next phase if it appears to be stuck.

Bug Fixes

1. Fix Android Bug Report offsets not being correct for machine name and serial number
2. Fix issue where Postgres db connections requiring SSL did not work
3. Fix issue when expanding SQL Lite file summaries missing information like name, hash, time, etc.
4. Fix memory leaks when rendering some reports
5. Fix the alpha channel for customized colors not being output correctly for HTML reports
6. Fix memory leaks in ETLs when streaming depot file content
7. Fix crash when initializing a new instance of Truxton without a locally installed database
8. Fix race condition when changing search result categories
9. Fix issues where SOLR based etls ran out of memory due to large differences in memory vs cpu cores
10. Fix corrupted name paths when analyzing prefetch files
11. Fix issue where new findings wouldn't be displayed in some certain circumstances
12. Normalize timestamps to zulu across forensic time displays
13. Fix issues when parsing certain EVTX files
14. Fix issue where filtering by location or time didn't navigate back to the search page as expected
15. Fix issue when parsing certain Android Binary XML files. Additionally improved the identification of these files
16. Fixed paging issue when view websites in the domain visualization
17. Fixed some cases where the size of the file as reported by the operating wasn't being set.
18. Fixed bug where notes for website visits weren't being saved
19. Fixed bug where displaying artifact correlation categories were duplicated
20. Fixed issue where you couldn't navigate to a correlated rapid review in progress
21. Fixed bug where performing bulk actions in the visual media display didn't always persist correctly
22. Fixed bug when exporting timeline didn't work due to invalid timestamps
23. Fixed certain MKV files not being identified
24. Fixed issue where real media videos weren't being displayed in the UI
25. Fixed email attachments occasionally not having a filename
26. Improved MOV file identification accuracy
27. Reduced false positives for base64 identification
28. Fix crash if user navigated away from load media page before it finished initializing
29. Fix bug where files extracted from RARs and 7zips were not being identified
30. Fix issue where application occasionally does not fully shut down
31. Fix issue where a website findings wasn't being added correctly
32. Fix bug where the TruxtonSettings.xml config file was being reset between installations.
33. SQLite sample files now have an origin of expanded instead of generated
34. Fixed Google Hangouts Messages not having their threads IDs calculated
35. Fixed some text files not being identified as javascript
36. Fixed Apple Partition Maps not being expanded
37. Fixed bug in SQLite schema identification, table.column names can now belong to multiple types of SQLite databases.
38. Fixed issue where duplicate properties can be written to settings file
39. Fixed issue where Truxton service events being written to the windows event log were not being quoted correctly
40. Fixed several issues with Unicode vCard parsing
41. Fixed issue where content/depots would not be cleared correctly when purging and instance of Truxton.
42. Fixed issue where docx files were not being displayed correctly in the preview window.
43. Fixed some images in the KMZ reports not displaying.
44. Fixed media reprocessing not working as expected. Including bulk reprocessing.
45. Fixed issue where more ETLs than specified would run on service startup.
46. Fixed issue where information being cached wasn't being updated in the UI. This was mostly apparent when viewing media while it was loading.
47. Fixed sorting arrows on search columns occasionally not being representative of the order which was being sorted.
48. Fixed issues where toggling offensive in certain areas was not persisting and updating the display correctly.
49. Fixed GIMP XCF identification.
50. Fixed issue where filtering by byte sizes was not working as expected due to rounding issues.
51. Fixed issue where the finding button was not highlighted accordingly for events in the timeline.
52. Fixed issue where volume serial number alerts weren't triggering.
53. Fixed issue where viewing XLSX spreadsheets in non compact search results would crash the UI in certain cases.