Sam at 10:03, 6 June 2024

2024-06-06T10:03:36Z

Sam: Created page with "=Truxton 3.0.0.0= << Released 2019-08-15 >> ==Improvements== # Add more domain favicons # Display the loader version number when..."

2024-06-06T10:03:13Z

Created page with "=Truxton 3.0.0.0= << Released 2019-08-15 >> ==Improvements== # Add more domain favicons # Display the loader version number when..."

New page

=Truxton 3.0.0.0=
[[Release 2019-01-04|<<]] Released 2019-08-15 [[Release 2019-12-19|>>]]

==Improvements==
# Add more domain favicons
# Display the loader version number when viewing media
# User can now reprocess media from the UI
# Added relationships display to UI - when viewing items Truxton now displays related items to quickly discover items of forensic interest. Applicable when viewing: Artifacts, Camera Info, Events, Files, Hashes, Locations, Messages, Websites.
# Added support to expand Windows Activities Database
# Added ability to export to Analyst Notebook (ANX)
# Added breakout of the bits of the Mach executable "flags" member.
# Added support for XWays and Autopsy hashset formats
# Added support to expand Jumplist Version 4
# Improved carve quality
# Added Truxton uri for sha1 hashes
# Added button in hex viewer to let user jump to next non-zero byte offset
# When tagging a file as having an external drive reference, we now include the drive letter that was the external drive.
# Added new Event Type: Possible Malware Infection
# Added new Event Type: Network Activity
# Added support to pull network activity from a SRUM database
# Added expansion for RDP Reconnections events
# MRU Entries are now exploited
# Added new Artifact type: Apple Authentication ID (AuthID)
# Added New section in the media summary report for RDP connection information.
# Added better support for new version of PNF files (3.3),
# Improved Patch Result file typing
# Timestamps are preserved when downloading files from the UI or when downloading a report with included binaries
# Explain what files are being listed in the media summary report
# User can now download items from any facet - artifacts, camera info, events, etc.
# When downloading items, also allow user to download metadata and tag information in a json file
# Added support for bulk tagging items in the search panel
# User can now manage file groups from the settings area.
# Added media CSV export
# Timeline now remembers where you last were
# Navigate to last viewed page when starting the client again
# Added more map url configuration presets
# Improved timeline load speed
# MAC addresses are now pulled out of URLs
# Multiselects now show their configured colors where applicable
# SOLR indexer is now faster (we were able to eliminate a database call)
# ETLs and desktop can now connect to a Postgres Server without a server certificate
# Drone flight paths can now violate sensitive sites
# WiFi passwords are now included in the WiFi section of the Media Summary Report
# Added feature to download events from the timeline in a portable report. It includes related files and pictures.
# User can now quickly hide eliminated files from search results (on by default)

==Bug Fixes==:
# Fix crash when loading more items in the filesystems treeview
# Fix occasional crash when quickly changing search categories
# Fix issue where tooltips from reports lingered around
# Fix issue where thumbnail hashes were being incorrectly calculated
# Fix some PNGs being incorrectly identified as JPGs
# Fix parentage bug when files inside of zips looked like a url
# Fix pdf authoring bug
# Fix malformed guids being extracted from SQLite dump
# Fix issue where certain xml wasn't being parsed correctly
# Fix issue where clicking go back would place you in the wrong location
# Fix USB report drive letter, volume name and serial number formatting issue
# Fix mis-identification of text file of hashes as base 64 encoded data
# Fixed CAB expansion bug
# Fixed crash when quickly navigating back to a pdf
# Fixed Zlib not being expanded
# Fixed javascript ID bug
# Tighten the identification of tar files and restore point logs when carving
# Fixed USB Serial Number Bug for EVTX
# Fixed LNK Parsing Bug
# Fixed database optimization missing a few tables
# Fixed issue where multiple categories can appear to be selected
# Fixed Registry ETL Missing UserAssist Keys
# Fixed media last update date not being UTC
# Fixed some SSIDs being added as MAC Address artifacts
# Fixed issue where some documents were not having their contents indexed by the text indexer
# Fixed issue where decimal values could not be partially searched
# Fixed issue where full text search index wasn't being purged when data was purged
# No longer add programs without names from the registry to events
# Fixed bug in 64-EXE Carved file naming
# Fixed messages not being displayed correctly in the my findings report
# Fix the tag control associating a tag when pressing the escape key (should discard)
# Fixed issue where Truxton ui could not launch when multiple users (RDP) on the same machine already had it open
# Fixed issue where tag control wasn't always rendering tags.
# Touch scrolling on reports is now supported
# Fix zip identification issue
# Installer now detects when the account name has a space in it which causes Postgres installer to fail
# Installer now installs C++ runtimes before attempting to install Postgres to prevent it from dying

==New File Types==
# Microsoft Software Protection Tokens (tokens.dat)
# Movie Filmroll File (moff)
# NOD32 anti-virus scanner update data file (NOD32)
# DVD info (DVD IFO)
# J2ME records management service (J2ME RMS)
# Interleaved Bitmap (ILBM)
# Restore Point Log
# Inno uninstall
# USN Journal - ($usnjnrl$.$J)
# Analysts Notebook XML Chart (ANX)
# Windows Error Report Snapshot (WER)
# Unity Asset Bundle
# Automatic Jumplist
# Windows Patch Data - Microsoft Binary Differential Compression (BDC)
# Dropbox Attributes
# System Resource Utilization Monitor - SRUM Dump (srudb.dat)
# Services Plist
# Powershell Transcript
# Powershell Module Analysis Cache
# Microsoft Patch Result
# PNF file details
# Git Blob
# Chrome Resource Pack v5
# Git tree
# Software License Internal Code (SLIC)
# Microsoft OneDrive Log
# Android Application (apk)
# GL Binary
# Viber Data
# Viber Messages
# Android Bug Report
# Android Network History
# Snapchat Preferences

@@ Line 45: / Line 45: @@
 # User can now quickly hide eliminated files from search results (on by default)
-==Bug Fixes==:
+==Bug Fixes==
 # Fix crash when loading more items in the filesystems treeview
 # Fix occasional crash when quickly changing search categories

Release 2019-08-15 - Revision history

Sam at 10:03, 6 June 2024

Sam: Created page with "=Truxton 3.0.0.0= << Released 2019-08-15 >> ==Improvements== # Add more domain favicons # Display the loader version number when..."