Forensics++ v1.0.0-alpha.1

Forensics++ v1.0.0-alpha.1

中文

这是 v1.0.0 的首个预览版本。重点是把几个高频工具做成可以持续检查的工作区，并减少大文件分析期间的页面阻塞。

核心更新

• SQLite Browser 增加 WAL / SHM 关联加载、页面映射、WAL 帧来源和可复核的空闲空间片段查看。
• PCAP 增加双向 TCP 流重组，处理乱序、重传重叠、序列缺口、序列号回绕和端口复用。
• TCP 流支持文本 / Hex 查看、会话筛选、文本保存和完整单向原始字节导出。
• HTTP 响应可以跨 TCP 数据包解析，并在有明确文件名时提取附件。
• 图片、浏览器数据、EVTX、Office / PDF、邮件和 PCAP 的工作区可以在刷新后恢复。
• 统一工作区的保存、清空、版本校验和异步任务失效处理，选择新文件时不会被旧任务覆盖。
• 图片只保存原始文件字节，通道图、隐藏数据扫描和修复结果仍按需生成，避免缓存重复的 base64 预览。
• SQLite 取证页增加保守的敏感字段、常见标识和外部扩展动作提示，不对普通文本和 BLOB 强行判定。
• 新增案件记录 / 证据报告工作区，可把有实际输入或输出的工具结果加入报告，填写案件信息，查看完整性摘要、时间线并导出 Markdown / JSON。
• 布局审计增加隐藏文件选择器检查，避免不可见的文件控件进入键盘或读屏顺序。
• PCAP 展示阶段不再为每个数据包计算 SHA-256；仅在明确的证据或报告场景中计算摘要。
• 发布检查会对照 package.json 验证设置页的开源项目清单，并验证哈希工具必须点击后才计算、默认只选 SHA-256。
• 页面声明同时支持亮色和暗色原生控件，避免切换主题后浏览器下拉框仍使用错误配色。
• 窄屏下的强制确认弹窗保留稳定的左右边距，按钮仍保持清晰可操作。

验证

• 72 项自动测试全部通过。
• 36 个工具、17 个填充状态和 12 个文件加载状态通过 375 × 812、1366 × 900、1920 × 1080 响应式布局审计。
• 图片、浏览器数据、EVTX、Office / PDF 刷新恢复专项通过。
• PCAP TCP 流、邮件 HTML 和附件专项通过。
• TypeScript、版权头、生产构建和静态发布包边界检查通过。

下载

• ForensicsPP-v1.0.0-alpha.1-static.zip：构建好的纯静态网站。
• SHA256SUMS.txt：静态 ZIP 的 SHA-256 校验值。
• GitHub 同时提供完整源码 ZIP 和 tar.gz。

静态包应通过 GitHub Pages、Nginx、Apache、对象存储或其他静态服务器访问。现代浏览器通常会限制通过 file:// 直接运行 ES Module、Worker 和 WASM。

English

This is the first preview of v1.0.0. The release focuses on workspaces that can be continued after navigation or a refresh, with fewer UI stalls during large-file analysis.

Core changes

• SQLite Browser adds WAL / SHM loading, page mapping, WAL frame provenance, and reviewable free-space fragments.
• PCAP adds bidirectional TCP stream reassembly with out-of-order segments, retransmission overlap removal, sequence gaps, wraparound, and port reuse.
• TCP streams support text / Hex views, session filtering, text export, and raw-byte export for complete directions.
• HTTP responses can be parsed across TCP packet boundaries and attachments are extracted when a filename is available.
• Image, browser-artifact, EVTX, Office / PDF, email, and PCAP workspaces can be restored after a refresh.
• Workspace save, clear, version validation, and stale-task invalidation now share one lifecycle. Replacing a file cannot be overwritten by an older task.
• Images persist only the original file bytes. Channel previews, hidden-data scans, and repair results remain on demand instead of duplicating base64 previews in storage.
• SQLite triage adds conservative markers for sensitive columns, common identifiers, and external extension actions without labeling ordinary text or BLOB values.
• Adds a local Case Notes / Evidence Report workspace for meaningful tool snapshots, case metadata, integrity summaries, timeline review, and Markdown / JSON export.
• Adds a layout-audit check that keeps hidden file inputs out of keyboard and screen-reader order.
• Removes per-packet SHA-256 work from PCAP display serialization; digests are calculated only for explicit evidence or report outputs.
• Adds release checks for the open-source dependency inventory and the hash workflow: input changes stay idle until calculation is started, with SHA-256 as the only default algorithm.
• Declares both light and dark color schemes so native browser controls follow the selected theme.
• Keeps the mandatory confirmation dialog within stable margins on narrow screens while preserving clear actions.

Verification

• All 72 automated tests pass.
• Responsive audits pass for 36 tools, 17 populated states, and 12 file-loaded states at 375 × 812, 1366 × 900, and 1920 × 1080.
• Image, browser-artifact, EVTX, and Office / PDF restore-after-refresh audits pass.
• PCAP TCP stream and email HTML / attachment audits pass.
• TypeScript, copyright headers, production build, and static-package boundary checks pass.

Downloads

• ForensicsPP-v1.0.0-alpha.1-static.zip: pre-built static website files.
• SHA256SUMS.txt: SHA-256 checksum for the static ZIP.
• GitHub also provides the complete source as ZIP and tar.gz archives.

Serve the static package with GitHub Pages, Nginx, Apache, object storage, or another static server. Modern browsers commonly restrict ES modules, workers, and WASM under file://.