Skip to content

Forensics++ v0.6.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 12 Jul 11:39
· 48 commits to main since this release
v0.6.0
6809354

Forensics++ v0.6.0

中文

v0.6.0 是 Forensics++ 完整源码公开后的第一轮大型工具与界面更新。本版本重点不是增加大量按钮，而是让常用取证工具更稳定、更清楚，并能处理真实文件。

新增工具

  • 浏览器数据解析：读取 Chromium / Firefox 的历史记录、下载、Cookie、登录、自动填充和扩展信息。
  • Windows 事件日志：解析 EVTX / BinXML，支持字段筛选、原始 XML 和本地 Sigma 规则匹配。
  • Office / PDF 文档取证：检查 PDF 元数据与附件、OOXML 外部关系与嵌入对象、OLE 流和宏工程。

主要改进

  • SQLite 浏览器改为固定表列表，以及“浏览、结构、SQL、修改”四个主要页面。
  • 邮件解析支持隔离的 HTML 正文预览和完整原始 EML 查看。
  • AndroidManifest、PCAP、IOC 和字符串解析移入 Worker，降低大文件卡住页面的概率。
  • 压缩包先读取目录，选择条目后再解压，避免一次展开整个压缩包。
  • 图片、JSON、IOC 和字符串工具改为明确点击后处理。
  • 后台密码中，bcrypt 和 Django PBKDF2 只显示本次生成结果；“生成常用哈希”继续批量生成。
  • 设置页重新整理外观、项目信息、本地数据和开源项目。
  • 统一上传区、表格、展开区域和桌面端工具布局。

修复

  • 修复邮件 HTML 无法预览、原始 EML 显示不完整的问题。
  • 修复 SQLite 宽表挤压、下拉菜单透明、侧栏折叠后焦点残留和隐藏文件输入可访问性问题。
  • 减少将原始输入写入 localStorage 的情况。
  • 调整邮件认证等功能中过强、容易误导的判断表述。

下载

  • ForensicsPP-v0.6.0-static.zip：已经构建完成的静态网站，可直接部署到静态网站服务。
  • SHA256SUMS.txt：静态 ZIP 的 SHA-256 校验值。
  • GitHub 会同时提供源码 ZIP 和 tar.gz。

验证

  • 31 项自动测试全部通过。
  • 34 个工具页面、17 种填写状态和 12 种真实文件状态通过桌面布局审计。
  • 生产构建检查必需文件、源码泄漏、版权头和体积限制。

工具输出仅供辅助分析，请结合原始检材和经过验证的取证流程复核。

English

v0.6.0 is the first major tool and interface update since Forensics++ moved to a complete source release. The focus is practical use: clearer workflows, safer handling of large inputs, and better support for real files.

New tools

  • Browser Data Parser for Chromium and Firefox history, downloads, cookies, logins, autofill, and extensions.
  • Windows Event Log parsing for EVTX / BinXML with field filters, raw XML, and local Sigma matching.
  • Office / PDF Forensics for PDF metadata and attachments, OOXML relationships and embedded objects, and OLE streams and macro projects.

Major improvements

  • SQLite Browser now uses persistent table navigation with Browse, Structure, SQL, and Changes views.
  • Email parsing now includes an isolated HTML preview and complete raw EML display.
  • AndroidManifest, PCAP, IOC, and string parsing run in Workers to reduce UI freezes on large inputs.
  • Archives are listed first and entries are extracted only when selected.
  • Image, JSON, IOC, and string processing now starts from explicit user actions.
  • bcrypt and Django PBKDF2 show only the requested result, while common hashes remain available as a batch.
  • Settings has been reorganized around Appearance, About, Local Data, and Open-source Projects.
  • Upload areas, tables, expandable sections, and desktop tool layouts now follow one shared design.

Fixes

  • Fixed missing email HTML previews and incomplete raw EML display.
  • Fixed SQLite wide-table compression, transparent select popups, collapsed-sidebar focus, and hidden file-input accessibility.
  • Reduced persistence of raw input in localStorage.
  • Replaced overly strong or ambiguous authentication wording with factual output.

Downloads

  • ForensicsPP-v0.6.0-static.zip: pre-built static website files ready for static hosting.
  • SHA256SUMS.txt: SHA-256 checksum for the static ZIP.
  • GitHub also provides the source code as ZIP and tar.gz archives.

Verification

  • All 31 automated tests pass.
  • Desktop layout audit passes for 34 tool pages, 17 populated states, and 12 file-loaded states.
  • Production verification checks required files, source leakage, copyright banners, and size limits.

Tool output is intended for supporting analysis and should be reviewed against the original evidence and validated forensic procedures.

Assets 4
Loading