Sam: Created page with "=Truxton 2.4.0.0= << Released 2018-11-11 >> ==Improvements== # Artifact Locations now load faster # Break out more file details..."

2024-06-06T09:59:34Z

Created page with "=Truxton 2.4.0.0= << Released 2018-11-11 >> ==Improvements== # Artifact Locations now load faster # Break out more file details..."

New page

=Truxton 2.4.0.0=
[[Release 2018-09-24|<<]] Released 2018-11-11 [[Release 2019-01-04|>>]]

==Improvements==
# Artifact Locations now load faster
# Break out more file details for zip files
# Improved loading speed of images in the UI (pictures, domain icons, file type icons, video contact sheets, etc).
# Improved MS office parsing: Added another variant of author details.
# Renamed EXIF to Camera Info.
# Major improvements to filtering the search results.
## Constructing a filter in the query builder is now unified and will apply to all search results. An indication will show when a certain filter field is not applicable.
## All search result category counts update when filters are updated.
## Saving filters are now no longer separated by the major types of search results (Artifacts, Camera Info, Events, Files, Hashes, Locations, Messages, Websites)
## Results now update in real-time as the filter changes.
## Added handy inline time and location "shortcut" filters any time a date or lat/lon are displayed
## Filter rules no longer fill horizontal width
## User can choose between meters or kilometers for location searches
# EXE details now include "Reproducible Checksum" instead of timestamp
# Added support to carve mpeg2 videos
# Added parsing camera information from mpeg2 video streams
# Added tag display to media list grids
# Improved naming of carved JPEGs derived from EXIF information
# Added support to carve MKVs
# Reduced false positives when carving JPEGs
# Updated to RegRipper 2.8
# Added more files details for PE files
# Expand RDP tile caches to produce BMPs
# Exploit Windows System Event 7045 for service installation and possible malware infection point
# New automatic tag of "External Drive" when references to drives other than "C:" are seen.
# Operating System Time Zone is now included in the Media Summary Report.
# Improvements to the conversations visualization
## Load speed and UI responsiveness improvements.
## Messages with lots of participants no longer make the conversation unreadable.
## When viewing a conversation involving a subject, show the associated picture instead of the initial of the message address
## When downloading a conversation, include attachments and the original source file of the message in the report. Additionally, display subject pictures.
# When viewing a message body, strip out html and rtf markup.
# Added support for Guojia Biaozhun Kuozhan code page in messages
# Tree view control for file systems now only loads the first 100 items

==New File Types==
# USN Change Journal
# Windows Error Reporting
# CIM Object Data
# Windows Activity Database
# Windows Notification DB
# RDP Tile Cache (bin)
# PCAP
# Windows Event Trace Log
# Microsoft Intra-Package Delta (Cabinet file entry)
# Google Takeout Location History

==Bug Fixes==
# In the hex viewer fixed issue where cycling through artifacts wasn't wrapping as expected
# Fixed issue where full text search wasn't working when an investigation had a lot of media
# Fixed a bug in zip fragment expansion
# Fixed preview frame not loading video contact sheets correctly
# Fixed issue where concurrent loading of video contact sheets would display incorrect image information
# Fixed issue with plist parsing
# Fixed artifacts indexing their parent media id multiple times
# Fixed searching by event description not working
# Fixed nested and/or not working correctly with full text search queries
# Fixed partial sha1 and md5 search not respected not equal operand
# Fixed filter criteria occasionally not persisting to local settings
# Fixed generated files not being indexed
# Fixed bug when parsing window logon hashes
# Fixed eliminated files not indexing filenames
# Visual Media no longer does a full page refresh when performing tagging or other analyst operations
# Fixed address links not showing for addresses for correlated contacts report.
# Fixed tagpicker not working for camera info view page
# Fixed tagpickers not associating media id correctly
# Fixed phone numbers found in Cellebrite xml which weren't being related to names in the correlated contacts
# LNK files with no string data are now parsed correctly
# Many bugs fixed in PST parsing
# Media Summary Report was incorrectly reporting the primary user of a system based on logon counts.
# Amcache files weren't being routed to RegRipper.
# Master Boot Record details had garbage characters in it.
# Fixed sorting for child file and hash children grids
# Fixed issue where filtering visual media by tags wasn't working when navigating backwards.
# Multiple bugs fixed in vCard processing. Offsets to artifacts is now correct.
# Consolidated Contacts report was missing email addresses.
# Fixed issue where child file grids were not persisting their state correctly. This included information such as sorting and column sizes

Release 2018-11-11 - Revision history

Sam: Created page with "=Truxton 2.4.0.0= << Released 2018-11-11 >> ==Improvements== # Artifact Locations now load faster # Break out more file details..."