Forensics++ v1.0.0-beta.5

Forensics++ v1.0.0-beta.5

Release date: 2026-08-27

中文

版本过旧提示（新功能）

页面启动时自动计算当前版本发布日期，若超过 90 天，在顶部显示「版本可能已过时」横幅，点击可跳转 GitHub Releases 下载新版。

移动端修复

• Binary / PCAP / Browser Artifacts 的自定义分段标签在窄屏下可横向滚动，不再裁切最后一个标签。
• CyberChef 窄屏下保持 920px 桌面宽度、外层横向平移，操作/配方/输出三栏不再挤压变形。

解析与修复

• 修复签名损坏 PNG 位于完整签名 PNG 之前时被 locatePngStart 跳过的问题；现按升序单遍扫描，最早 PNG 优先。
• Carver 新增 TIFF/MP4/Ogg/PCAP/FLAC 真实结构边界识别。
• APK v1 (JAR) 签名校验补齐 per-section .SF digest 比对，MANIFEST.MF 中被篡改的条目直接报 mismatch。
• 修复版本过旧横幅在网格布局下被塌缩/覆盖的问题（顶栏与横幅归入同一顶区容器）。

其他

• 空态工作区铺满视口、输入卡片顶部对齐。
• 新增单文件构建 npm run build:standalone，file:// 双击即可运行。
• 测试 199 个全部通过（新增 jar-v1/password/jwt 单测）。

English

1.0.0-beta.5 focuses on version self-check, mobile layout fixes, and closing out forensics-parsing depth.

Stale-version notice (new)

On startup the app computes the current version's release date. If it is older than 90 days, a "version may be outdated" banner appears at the top with a one-click link to GitHub Releases. Dismissing it applies to the current session only — switching tools does not bring it back, and the next refresh shows it again. The check is fully computed (releaseDate + 90 days vs now), so releases only maintain the appReleaseDate constant.

Mobile fixes

• Binary / PCAP / Browser Artifacts segmented tabs scroll horizontally on narrow screens instead of clipping the last tab.
• CyberChef keeps its 920px desktop width on phones and pans horizontally inside the stage, so the three panes are no longer squeezed.

Parsing & repair

• Fixed locatePngStart skipping a signature-damaged PNG when a valid-signature PNG precedes it; a single ascending pass now prefers the earliest PNG.
• Carver gained real structural extents for TIFF/MP4/Ogg/PCAP/FLAC.
• APK v1 (JAR) verification now compares per-section .SF digests, so tampered MANIFEST.MF entries are reported as mismatches.
• Fixed the stale-version banner being collapsed/covered by the grid layout (topbar and banner now share one top-region container).

Misc

• Empty workbenches fill the viewport with the input card top-aligned.
• New npm run build:standalone produces a single-file index.html runnable from file://.
• 199 tests pass (new jar-v1/password/jwt unit tests).

---

完整构建与校验请使用完整 npm 依赖环境执行：

npm ci
npm run verify
npm run release:package

Forensics++ v1.0.0-beta.1

Forensics++ v1.0.0-beta.1

中文

这是第一个 beta 版本，标志着 Forensics++ 从 alpha 阶段进入正式可用性打磨阶段。核心工作集中在三项：案件报告工具全面重构、Service Worker 缓存根除重建后崩溃、以及全局 CSS/交互细节优化。

案件记录 / 证据报告 重构

原来的报告界面把 7 个导出按钮平铺在一行，并用三列布局把笔记列表、详情、完整性摘要、时间线和证据清单塞在一起，信息密度过高，操作路径不清晰。

重构后：

• 导出按钮合并为单一「导出」下拉菜单：Markdown、HTML、打印/PDF、复制 Markdown、JSON、Bundle JSON、索引 CSV 全部收纳在一个下拉中。
• 三列改为三个标签页：
  • 证据列表：笔记列表 + 当前项详情（标题编辑、完整性摘要表、内容文本区、复制/删除操作）。
  • 报告预览：全宽 HTML 渲染预览（iframe），支持渲染预览 / Markdown 源码切换和打印。
  • 完整性与时间线：完整性摘要表 + 采集时间线 + 证据清单（含源文件核验功能）。
• 案件信息表单改为可折叠（有证据项时默认收起）。
• 报告摘要改为紧凑的统计条（6 个指标卡）。
• 页面顶部增加紧凑统计行（证据数 × 工具数 × 关注项数）。

Service Worker 缓存根除重建崩溃

原 Service Worker 对静态资源使用 cache-first 策略且 CACHE_VERSION 写死为包版本号。每次重建后 index.html 引用的 chunk 哈希变化，旧 SW 仍命中旧缓存 → loading chunk failed → 错误边界 → reload → 重复命中旧 SW → 所有懒加载工具连锁崩溃。

修复：

• fetch 改为 network-first + 仅离线回退缓存。
• CACHE_VERSION 增加构建指纹（对 dist/assets 的 js/css 文件名排序后 SHA1 取前 10 位），每次资源变化 → 指纹变化 → activate 自动删除旧 cache。

全局 CSS token 审计

脚本扫描全项目 var(--token) 引用 vs --token: 定义，发现并修复：

• --app-mono 被 40 处引用但从未定义 → 所有等宽 UI（hash 展示、hex dump、代码查看器）静默回退到 sans-serif。
• --app-border、--border-subtle、--text-secondary 等 5 个 token 同样未定义 → 边框缺失、次要文字变全强度。
• --app-text-soft 和 --app-ok 虽有 fallback，但 fallback 抹掉了设计意图 → 补全。
• 滚动条样式改为主题色自适应（深色模式下滚动条更清晰可见）。

复制反馈

全局 copyText 被 72 处调用但全无反馈。新增依赖无关的「已复制」提示浮层，复制成功后底部居中弹出自动消失提示，prefers-reduced-motion 安全。

其他

• 密码工具分段按钮从三列网格改为单行布局，SQL 按钮不再折行。
• 修复多个 CSS 媒体查询空块和格式问题。
• 版本号升级为 1.0.0-beta.1。

验证

• 137 个自动测试通过。
• TypeScript、版权头、生产构建、静态发布包验证通过。
• 36 个工具的桌面/窄屏布局审计通过。

English

This is the first beta release, marking the transition from alpha to production-readiness polishing. The three main improvements: a complete Case Reporter UX overhaul, a Service Worker cache fix that eliminates post-rebuild crashes, and systematic CSS token auditing.

Case Reporter Redesign

The original reporter had seven export buttons in a single row and a three-column layout mixing notes, detail, integrity, timeline, and evidence register — too much information density with unclear operation paths.

The redesign:

• Seven export buttons merged into a single "Export" dropdown: Markdown, HTML, Print/PDF, Copy Markdown, JSON, Bundle JSON, and Index CSV are all in one menu.
• Three-column layout replaced with three tabs:
  • Evidence: notes list + selected-note detail (title edit, integrity info table, content textarea, copy/delete actions).
  • Report Preview: full-width HTML rendered preview in an iframe, with rendered-preview / Markdown-source toggle and print.
  • Integrity & Timeline: integrity summary table + capture timeline + evidence register (with source-file verification).
• Case metadata form is now collapsible (collapsed by default when evidence items exist).
• Report summary replaced with a compact stat strip (6 metric cards).
• Header includes a compact stats row (evidence count × tool count × items needing review).

Service Worker Cache Fix

The original SW used cache-first for static assets with a hardcoded CACHE_VERSION matching the package version. After every rebuild, index.html referenced new chunk hashes while the old SW served stale cached chunks → loading chunk failed → error boundary → reload → repeat. This caused all lazily-loaded tools to break after a rebuild.

Fixes:

• fetch handler changed to network-first with offline cache fallback.
• CACHE_VERSION now includes a build fingerprint (first 10 characters of SHA1 of sorted dist/assets js/css filenames). Every asset change → new fingerprint → activate deletes the old cache.

CSS Token Audit

A script diffing all var(--token) references against --token: definitions found and fixed:

• --app-mono used 40× but never defined → all monospace UI (hash displays, hex dumps, code viewers) silently fell back to sans-serif.
• --app-border, --border-subtle, --text-secondary and 3 other tokens also undefined → missing borders, secondary text rendered at full strength.
• --app-text-soft and --app-ok had fallbacks that defeated their design intent → cleared.
• Scrollbar styling made theme-aware (clearly visible in dark mode).

Copy Feedback

copyText was called 72 times with zero feedback. Added a dependency-free "Copied" toast that appears centered at the bottom and auto-dismisses, with prefers-reduced-motion safety.

Other

• Password tool segmented buttons: single-row layout, SQL button no longer wraps.
• Fixed several empty CSS media-query blocks and formatting issues.
• Version bumped to 1.0.0-beta.1.

Verification

• 137 automated tests passed.
• TypeScript, copyright headers, production build, and static package verification passed.
• Desktop and narrow-screen layout audit for all 36 tools passed.

Forensics++ v1.0.0-alpha.1

Forensics++ v1.0.0-alpha.1

中文

这是 v1.0.0 的首个预览版本。重点是把几个高频工具做成可以持续检查的工作区，并减少大文件分析期间的页面阻塞。

核心更新

• SQLite Browser 增加 WAL / SHM 关联加载、页面映射、WAL 帧来源和可复核的空闲空间片段查看。
• PCAP 增加双向 TCP 流重组，处理乱序、重传重叠、序列缺口、序列号回绕和端口复用。
• TCP 流支持文本 / Hex 查看、会话筛选、文本保存和完整单向原始字节导出。
• HTTP 响应可以跨 TCP 数据包解析，并在有明确文件名时提取附件。
• 图片、浏览器数据、EVTX、Office / PDF、邮件和 PCAP 的工作区可以在刷新后恢复。
• 统一工作区的保存、清空、版本校验和异步任务失效处理，选择新文件时不会被旧任务覆盖。
• 图片只保存原始文件字节，通道图、隐藏数据扫描和修复结果仍按需生成，避免缓存重复的 base64 预览。
• SQLite 取证页增加保守的敏感字段、常见标识和外部扩展动作提示，不对普通文本和 BLOB 强行判定。
• 新增案件记录 / 证据报告工作区，可把有实际输入或输出的工具结果加入报告，填写案件信息，查看完整性摘要、时间线并导出 Markdown / JSON。
• 布局审计增加隐藏文件选择器检查，避免不可见的文件控件进入键盘或读屏顺序。
• PCAP 展示阶段不再为每个数据包计算 SHA-256；仅在明确的证据或报告场景中计算摘要。
• 发布检查会对照 package.json 验证设置页的开源项目清单，并验证哈希工具必须点击后才计算、默认只选 SHA-256。
• 页面声明同时支持亮色和暗色原生控件，避免切换主题后浏览器下拉框仍使用错误配色。
• 窄屏下的强制确认弹窗保留稳定的左右边距，按钮仍保持清晰可操作。

验证

• 72 项自动测试全部通过。
• 36 个工具、17 个填充状态和 12 个文件加载状态通过 375 × 812、1366 × 900、1920 × 1080 响应式布局审计。
• 图片、浏览器数据、EVTX、Office / PDF 刷新恢复专项通过。
• PCAP TCP 流、邮件 HTML 和附件专项通过。
• TypeScript、版权头、生产构建和静态发布包边界检查通过。

下载

• ForensicsPP-v1.0.0-alpha.1-static.zip：构建好的纯静态网站。
• SHA256SUMS.txt：静态 ZIP 的 SHA-256 校验值。
• GitHub 同时提供完整源码 ZIP 和 tar.gz。

静态包应通过 GitHub Pages、Nginx、Apache、对象存储或其他静态服务器访问。现代浏览器通常会限制通过 file:// 直接运行 ES Module、Worker 和 WASM。

English

This is the first preview of v1.0.0. The release focuses on workspaces that can be continued after navigation or a refresh, with fewer UI stalls during large-file analysis.

Core changes

• SQLite Browser adds WAL / SHM loading, page mapping, WAL frame provenance, and reviewable free-space fragments.
• PCAP adds bidirectional TCP stream reassembly with out-of-order segments, retransmission overlap removal, sequence gaps, wraparound, and port reuse.
• TCP streams support text / Hex views, session filtering, text export, and raw-byte export for complete directions.
• HTTP responses can be parsed across TCP packet boundaries and attachments are extracted when a filename is available.
• Image, browser-artifact, EVTX, Office / PDF, email, and PCAP workspaces can be restored after a refresh.
• Workspace save, clear, version validation, and stale-task invalidation now share one lifecycle. Replacing a file cannot be overwritten by an older task.
• Images persist only the original file bytes. Channel previews, hidden-data scans, and repair results remain on demand instead of duplicating base64 previews in storage.
• SQLite triage adds conservative markers for sensitive columns, common identifiers, and external extension actions without labeling ordinary text or BLOB values.
• Adds a local Case Notes / Evidence Report workspace for meaningful tool snapshots, case metadata, integrity summaries, timeline review, and Markdown / JSON export.
• Adds a layout-audit check that keeps hidden file inputs out of keyboard and screen-reader order.
• Removes per-packet SHA-256 work from PCAP display serialization; digests are calculated only for explicit evidence or report outputs.
• Adds release checks for the open-source dependency inventory and the hash workflow: input changes stay idle until calculation is started, with SHA-256 as the only default algorithm.
• Declares both light and dark color schemes so native browser controls follow the selected theme.
• Keeps the mandatory confirmation dialog within stable margins on narrow screens while preserving clear actions.

Verification

• All 72 automated tests pass.
• Responsive audits pass for 36 tools, 17 populated states, and 12 file-loaded states at 375 × 812, 1366 × 900, and 1920 × 1080.
• Image, browser-artifact, EVTX, and Office / PDF restore-after-refresh audits pass.
• PCAP TCP stream and email HTML / attachment audits pass.
• TypeScript, copyright headers, production build, and static-package boundary checks pass.

Downloads

• ForensicsPP-v1.0.0-alpha.1-static.zip: pre-built static website files.
• SHA256SUMS.txt: SHA-256 checksum for the static ZIP.
• GitHub also provides the complete source as ZIP and tar.gz archives.

Serve the static package with GitHub Pages, Nginx, Apache, object storage, or another static server. Modern browsers commonly restrict ES modules, workers, and WASM under file://.

Forensics++ v0.9.0

Forensics++ v0.9.0

这一版主要处理大文件分析、YARA 和 SQLite。工具数量没有增加，重点是让已有功能更稳、更容易操作。

主要更新

• YARA 扫描改用 VirusTotal YARA-X，在浏览器内通过 WebAssembly 编译和运行规则，支持更完整的 YARA 语法和编译错误提示。
• 邮件、图片、EVTX / Sigma、PCAP、浏览器数据、Office 文档、Registry、IOC、字符串、熵和 Android 解析统一放到可取消的 Worker 任务中。
• SQLite 增加按列筛选、BLOB 文本 / 十六进制查看，以及小于等于 32 MiB 数据库的一步撤销。
• 图片的结构检查、隐藏数据扫描和修复候选生成移到 Worker，减少大图片卡住页面的情况。
• 修正快速切换输入或清空页面后，旧任务仍把结果写回来的问题。
• 大文件读取期间可以直接清空或取消；后台密码计算也不会在输入改变后恢复过期结果。

界面

• 默认主题色从页面第一帧起使用 #4457A6，不再短暂显示旧颜色。
• 图片拖放状态、工具清空状态和处理中反馈保持一致。
• 36 个工具页面继续使用同一套桌面布局和控件尺寸。

验证

• 59 项自动测试通过。
• 36 个页面、17 个带结果状态和 12 个文件加载状态通过 1366 × 900 布局审计。
• 生产构建、版权头、静态包边界和版本字段检查通过。

下载

• ForensicsPP-v0.9.0-static.zip：构建好的静态网站，可部署到 GitHub Pages、Nginx、Apache、对象存储或其他静态托管服务。
• SHA256SUMS.txt：静态 ZIP 的 SHA-256 校验值。

现代浏览器通常会限制通过 file:// 直接运行 ES Module、Worker 和 WASM。请使用静态服务器访问解压后的文件，不要直接双击 index.html。

---

This release focuses on large-file analysis, YARA, and SQLite. It does not add more tools; it makes the existing ones steadier and easier to use.

Highlights

• YARA scanning now uses VirusTotal YARA-X, compiling and running rules in browser-side WebAssembly with broader syntax support and clear compiler errors.
• Email, image, EVTX / Sigma, PCAP, browser data, Office document, Registry, IOC, string, entropy, and Android parsing now share a cancellable Worker task model.
• SQLite adds per-column filtering, BLOB text / hex inspection, and one-step undo for databases up to 32 MiB.
• Image structure checks, hidden-data scans, and repair-candidate generation run in a Worker to reduce main-thread stalls on large images.
• Older tasks can no longer overwrite newer input after rapid changes or clearing a page.
• Large-file reads can be cleared or cancelled, and password operations ignore results that became stale while running.

Interface

• The default #4457A6 theme color is applied from the first rendered frame, without flashing the previous color.
• Image drag feedback, clear actions, and processing states now behave consistently.
• All 36 tool pages retain the same desktop layout and control sizing.

Verification

• 59 automated tests pass.
• The 1366 × 900 layout audit covers 36 pages, 17 populated states, and 12 file-loaded states.
• Production build, copyright headers, static-package boundaries, and version metadata checks pass.

Downloads

• ForensicsPP-v0.9.0-static.zip: pre-built static files for GitHub Pages, Nginx, Apache, object storage, or another static host.
• SHA256SUMS.txt: SHA-256 checksum for the static ZIP.

Modern browsers commonly restrict ES modules, workers, and WASM under file://. Serve the extracted files with a static web server instead of opening index.html directly.

Forensics++ v0.8.1

Forensics++ v0.8.1

本次更新集中处理数据留存、长任务、SQLite 修改保护、法律说明和静态发布路径。

改进

• 工具输入与分析结果保留在当前标签页中，切换工具不会丢失；刷新或关闭标签页后不再继续保留检材内容。
• 文件和文本工具统一为更直接的空状态与主要操作，并在解析前检查不合理的文件大小。
• 文件哈希改为分块读取，显示字节进度，支持取消；SM3 超过支持范围时给出明确提示。
• SQLite 在存在未导出修改时，关闭工具、清空工作区或打开其他数据库前会要求确认。
• 设置中的“关于项目”和“本地数据”重新整理，当前打开的工具列表更紧凑。
• 法律说明补充授权范围、证据保全、数据与隐私、安全风险、结果边界、第三方组件和责任范围。

发布修正

• 构建资源、法律页和 CyberChef 使用相对路径，可部署到网站二级目录。
• 修正 SEO 版本、Service Worker 缓存版本和社交分享图片缓存路径。
• 发布校验会阻止版本字段不一致或重新出现根路径资源。

验证

• 48 项自动测试全部通过。
• 36 个页面、17 个带结果状态、12 个文件加载状态通过 1366 × 900 布局审计。
• 已验证生产包部署在二级目录时：首页、动态工具、法律页、CyberChef 和离线核心资源均可加载。

下载

• ForensicsPP-v0.8.1-static.zip：构建好的纯静态网站，可部署到 GitHub Pages、Nginx、Apache、对象存储或其他静态托管服务。
• SHA256SUMS.txt：静态 ZIP 的 SHA-256 校验值。

现代浏览器通常会限制通过 file:// 直接运行 ES Module、Worker 和 WASM，因此不要直接双击 index.html。

---

This update focuses on data retention, long-running operations, SQLite change protection, the legal notice, and static deployment paths.

Improvements

• Tool inputs and results stay available while navigating in the current tab, but evidence content is no longer retained after a refresh or tab close.
• File and text tools now use clearer empty states and primary actions, with practical size checks before expensive parsing.
• File hashing reads incrementally, reports byte progress, supports cancellation, and explains the SM3 file-size limit.
• SQLite asks for confirmation before closing, clearing, or replacing a database with unexported changes.
• The About and Local Data settings are more compact and easier to scan.
• The legal notice now covers authorization, evidence preservation, data handling, security risks, result limits, third-party software, and liability boundaries.

Release fixes

• Build assets, the legal page, and CyberChef use relative paths and work when hosted under a subdirectory.
• Corrected stale SEO metadata, service-worker cache naming, and the cached social-image path.
• Release verification now rejects mismatched version metadata and root-absolute build assets.

Verification

• All 48 automated tests pass.
• The 1366 × 900 layout audit covers 36 pages, 17 populated states, and 12 file-loaded states.
• The production output was served from a subdirectory and verified with the home page, lazy-loaded tools, legal page, CyberChef, and offline core assets.

Downloads

• ForensicsPP-v0.8.1-static.zip: pre-built static files for GitHub Pages, Nginx, Apache, object storage, or another static host.
• SHA256SUMS.txt: SHA-256 checksum for the static ZIP.

Modern browsers commonly restrict ES modules, workers, and WASM under file://, so do not open index.html directly.

Forensics++ v0.8.0

Forensics++ v0.8.0

中文

这一版集中整理现有核心工具，不增加工具数量。重点是让常用操作更直接、结果更容易查看，并降低大文件导致浏览器卡顿的概率。

主要修改

• SQLite 浏览器支持拖动列宽、双击编辑，并明确区分浏览和编辑状态。
• 图片工作台精简分析结果，保留预览、元数据、通道、结构检查和恢复等实际操作。
• 邮件、压缩包、文档、流量包和时间戳工具重新整理操作顺序与结果展示。
• Windows、Registry、Plist、浏览器记录和 EVTX 改为更紧凑的浏览、筛选和详情布局。
• 删除多个工具中未实际计算的空 SHA-256 和重复字段。
• 限制容易占用大量内存的文件大小，并优化大结果集筛选。
• 产品联系邮箱改为 toolab@digiforensics.cn。

修复

• 修复 HTML 邮件预览、MSG 正文解码和无效文件残留旧结果的问题。
• 修复部分表格溢出、结果选择不一致和展开区域不清晰的问题。
• 增加流量包解析及通用解析器回归测试。

下载

• ForensicsPP-v0.8.0-static.zip：构建好的静态版本，解压后打开 index.html。
• SHA256SUMS.txt：静态 ZIP 的校验值。
• GitHub 同时提供完整源码 ZIP 和 tar.gz。

English

This release focuses on the existing core tools instead of adding more tools. Common actions are more direct, results are easier to inspect, and large files are less likely to stall the browser.

Changed

• SQLite Browser now supports resizable columns, double-click editing, and a clearer separation between browse and edit modes.
• Image analysis was reduced to practical preview, metadata, channel, structure, and recovery operations.
• Email, archive, document, packet capture, and timestamp workflows have clearer action and result order.
• Windows, Registry, Plist, browser artifact, and EVTX tools now use compact browsing, filtering, and detail layouts.
• Empty SHA-256 and duplicate fields were removed from several tools.
• Large-file limits and result filtering were adjusted to reduce browser stalls.
• The product contact address is now toolab@digiforensics.cn.

Fixed

• Fixed HTML email preview, MSG body decoding, and stale results after invalid file selection.
• Fixed several table overflows, inconsistent result selection states, and unclear expandable sections.
• Added packet-capture and parser regression coverage.

Downloads

• ForensicsPP-v0.8.0-static.zip: built static version; extract it and open index.html.
• SHA256SUMS.txt: checksum for the static ZIP.
• GitHub also provides complete source ZIP and tar.gz archives.

Forensics++ v0.7.1

Forensics++ v0.7.1

中文

修改

• 缩短“关于项目”页面，版本、协议、更新时间和仓库信息改为紧凑排列。
• 调整“本地数据”页面，常见桌面尺寸下不再需要滚动。
• 当前会话中的工具改为双列排列，关闭工具更直接。

修复

• 重做图片工作台的 EXIF 表格，长字段和复杂值不再撑出页面。
• EXIF 区域限制高度并在区域内滚动，手机端改为上下排列。
• 布局审计加入真实 EXIF 和连续长字段样本。

下载

• ForensicsPP-v0.7.1-static.zip：构建好的静态网站。
• SHA256SUMS.txt：ZIP 校验值。
• GitHub 自动提供源码 ZIP 和 tar.gz。

English

Changed

• Shortened the About page and arranged version, license, update date, and repository details in one compact row.
• Adjusted Local Data to fit common desktop viewports without page scrolling.
• Open tools in the current session now use a compact two-column layout.

Fixed

• Rebuilt the EXIF table so long fields and structured values no longer overflow the page.
• Bounded the EXIF area with local scrolling and stacked rows on small screens.
• Added real EXIF and long-value fixtures to the layout audit.

Downloads

• ForensicsPP-v0.7.1-static.zip: built static website files.
• SHA256SUMS.txt: checksum for the ZIP file.
• GitHub also provides source ZIP and tar.gz archives.

Forensics++ v0.7.0

Forensics++ v0.7.0

中文

新增

• Registry Hive 浏览器：读取 NTUSER.DAT、SOFTWARE、SYSTEM、SAM 和 SECURITY。
• Plist 浏览器：支持 XML Plist 和二进制 bplist00。
• 邮件工具支持 Outlook MSG，按文件后缀和文件头自动识别 EML / MSG。
• SQLite 可同时打开数据库、WAL 和 SHM 文件。
• 设置页显示本站占用、localStorage 占用和浏览器配额。
• 设置页可查看并关闭当前会话中已经打开的工具。

修改

• 切换工具时保留已经打开页面的输入和结果。
• SQLite 表格支持拖动列宽；双击单元格后原位编辑。
• 编辑模式关闭时，双击单元格会提示先开启编辑模式。
• 默认主题色改为 #4457A6，并增加更多可选颜色。
• 使用条款恢复为必须确认的遮罩弹窗。
• 精简设置页和项目文案。
• 浏览器持久存储与当前标签页内存分开说明。

修复

• 修复 GitHub Actions Node.js 22 环境缺少 Promise.try 时 PDF 测试超时的问题。
• 修复 Ant Design Switch 被全局按钮样式覆盖的问题。
• 修复部分工具切换后状态丢失的问题。
• WAL 合并增加文件头与逐帧校验；损坏尾帧不会覆盖最后一次完整提交。
• MSG 和 Registry Hive 增加格式校验，减少把其他 OLE / REGF 文件误判为有效数据的情况。

下载

• ForensicsPP-v0.7.0-static.zip：构建好的静态网站。
• SHA256SUMS.txt：ZIP 校验值。
• GitHub 自动提供源码 ZIP 和 tar.gz。

English

Added

• Registry Hive Browser for NTUSER.DAT, SOFTWARE, SYSTEM, SAM, and SECURITY.
• Plist Browser for XML Plist and binary bplist00 files.
• Outlook MSG support in the Email tool with automatic EML / MSG detection.
• SQLite database, WAL, and SHM group loading.
• Storage usage, localStorage usage, and browser quota in Settings.
• Settings can list and close tools retained in the current tab.

Changed

• Open tool pages keep their input and results when switching tools.
• SQLite columns are resizable and cells can be edited in place with a double-click.
• Double-clicking a cell while edit mode is off now shows a clear prompt.
• The default accent color is now #4457A6, with additional color choices.
• The terms prompt is once again a blocking confirmation dialog.
• Settings and project copy have been shortened.
• Persistent browser storage is described separately from current-tab memory.

Fixed

• Fixed PDF test timeouts on GitHub Actions with Node.js 22 where Promise.try is unavailable.
• Fixed global button CSS overriding the Ant Design Switch.
• Fixed tool state being lost after navigating to another tool.
• WAL merge now verifies header and frame checksums and ignores corrupt tail frames after the last complete commit.
• MSG and Registry Hive validation now reject unrelated or structurally invalid containers more reliably.

Downloads

• ForensicsPP-v0.7.0-static.zip: built static website files.
• SHA256SUMS.txt: checksum for the ZIP file.
• GitHub also provides source ZIP and tar.gz archives.

Forensics++ v0.6.0

Forensics++ v0.6.0

中文

v0.6.0 是 Forensics++ 完整源码公开后的第一轮大型工具与界面更新。本版本重点不是增加大量按钮，而是让常用取证工具更稳定、更清楚，并能处理真实文件。

新增工具

• 浏览器数据解析：读取 Chromium / Firefox 的历史记录、下载、Cookie、登录、自动填充和扩展信息。
• Windows 事件日志：解析 EVTX / BinXML，支持字段筛选、原始 XML 和本地 Sigma 规则匹配。
• Office / PDF 文档取证：检查 PDF 元数据与附件、OOXML 外部关系与嵌入对象、OLE 流和宏工程。

主要改进

• SQLite 浏览器改为固定表列表，以及“浏览、结构、SQL、修改”四个主要页面。
• 邮件解析支持隔离的 HTML 正文预览和完整原始 EML 查看。
• AndroidManifest、PCAP、IOC 和字符串解析移入 Worker，降低大文件卡住页面的概率。
• 压缩包先读取目录，选择条目后再解压，避免一次展开整个压缩包。
• 图片、JSON、IOC 和字符串工具改为明确点击后处理。
• 后台密码中，bcrypt 和 Django PBKDF2 只显示本次生成结果；“生成常用哈希”继续批量生成。
• 设置页重新整理外观、项目信息、本地数据和开源项目。
• 统一上传区、表格、展开区域和桌面端工具布局。

修复

• 修复邮件 HTML 无法预览、原始 EML 显示不完整的问题。
• 修复 SQLite 宽表挤压、下拉菜单透明、侧栏折叠后焦点残留和隐藏文件输入可访问性问题。
• 减少将原始输入写入 localStorage 的情况。
• 调整邮件认证等功能中过强、容易误导的判断表述。

下载

• ForensicsPP-v0.6.0-static.zip：已经构建完成的静态网站，可直接部署到静态网站服务。
• SHA256SUMS.txt：静态 ZIP 的 SHA-256 校验值。
• GitHub 会同时提供源码 ZIP 和 tar.gz。

验证

• 31 项自动测试全部通过。
• 34 个工具页面、17 种填写状态和 12 种真实文件状态通过桌面布局审计。
• 生产构建检查必需文件、源码泄漏、版权头和体积限制。

工具输出仅供辅助分析，请结合原始检材和经过验证的取证流程复核。

---

English

v0.6.0 is the first major tool and interface update since Forensics++ moved to a complete source release. The focus is practical use: clearer workflows, safer handling of large inputs, and better support for real files.

New tools

• Browser Data Parser for Chromium and Firefox history, downloads, cookies, logins, autofill, and extensions.
• Windows Event Log parsing for EVTX / BinXML with field filters, raw XML, and local Sigma matching.
• Office / PDF Forensics for PDF metadata and attachments, OOXML relationships and embedded objects, and OLE streams and macro projects.

Major improvements

• SQLite Browser now uses persistent table navigation with Browse, Structure, SQL, and Changes views.
• Email parsing now includes an isolated HTML preview and complete raw EML display.
• AndroidManifest, PCAP, IOC, and string parsing run in Workers to reduce UI freezes on large inputs.
• Archives are listed first and entries are extracted only when selected.
• Image, JSON, IOC, and string processing now starts from explicit user actions.
• bcrypt and Django PBKDF2 show only the requested result, while common hashes remain available as a batch.
• Settings has been reorganized around Appearance, About, Local Data, and Open-source Projects.
• Upload areas, tables, expandable sections, and desktop tool layouts now follow one shared design.

Fixes

• Fixed missing email HTML previews and incomplete raw EML display.
• Fixed SQLite wide-table compression, transparent select popups, collapsed-sidebar focus, and hidden file-input accessibility.
• Reduced persistence of raw input in localStorage.
• Replaced overly strong or ambiguous authentication wording with factual output.

Downloads

• ForensicsPP-v0.6.0-static.zip: pre-built static website files ready for static hosting.
• SHA256SUMS.txt: SHA-256 checksum for the static ZIP.
• GitHub also provides the source code as ZIP and tar.gz archives.

Verification

• All 31 automated tests pass.
• Desktop layout audit passes for 34 tool pages, 17 populated states, and 12 file-loaded states.
• Production verification checks required files, source leakage, copyright banners, and size limits.

Tool output is intended for supporting analysis and should be reviewed against the original evidence and validated forensic procedures.

Forensics++ v0.5.0

Forensics++ v0.5.0

This release publishes the complete React and TypeScript source tree.

Highlights

• Complete open-source React 19 and Ant Design 5 application source
• Browser-local forensic workbench with 30 tool entries
• Automated parser tests, TypeScript checks, CI and GitHub Pages deployment
• Release artifact validation, security policy and contribution documentation
• Source-built deployment for https://www.forensicspp.com/
• Attached pre-built ZIP package v0.5.0_build.zip in release assets, ready for direct deployment and usage without local compilation

See CHANGELOG.md and docs/RELEASE.md for full details.

---

本次版本完整开源 React + TypeScript 全套源代码。

核心亮点

• 完整开源基于 React 19、Ant Design 5 的前端应用源码
• 浏览器本地电子取证工作台，内置 30 款取证工具模块
• 自动化解析器单元测试、TypeScript 类型校验、CI 流水线与 GitHub Pages 自动部署
• 发布产物校验机制、安全规范文档与项目贡献指南齐全
• 支持源码编译部署，线上站点：https://www.forensicspp.com/
• 发布附件 v0.5.0_build.zip 已编译打包 ZIP 压缩包，无需本地构建，可直接部署使用

完整更新详情可查阅 CHANGELOG.md 与 docs/RELEASE.md