v0.6.1

What's New

• Per-artifact provenance grading with evidence chain display in Examiner Portal
• Provenance chain tooltips — hover any chain step for full audit detail (command, timing, input files, SHA-256)
• vhir restore — restore cases from backup including OpenSearch indices
• OpenSearch backup via vhir backup --include-opensearch
• Interactive vhir case init prompts when run with no arguments
• Wintools watchdog with automatic restart on crash

Bug Fixes

• Masquerade detection scoped to curated system binaries, reducing false positives
• Evidence staging — VHDX/container evidence auto-staged to SMB share for wintools access
• Plaso --storage_file argument compatibility
• Config file permissions on samba.yaml/network.yaml
• Typosquatting false positives on short filenames
• Audit ID regex now supports hyphenated examiner names
• Case_id cache invalidation on mid-session case switch
• EVTX-only directory ingest crash (UnboundLocalError)

Existing Installs

Run vhir update — pulls new code, reinstalls packages, restarts gateway. No migration needed.

Full Changelog: v0.6.0...v0.6.1