ENGRAM 0.7.0 — Media gallery & guided backups

ENGRAM 0.7 adds a media gallery and a guided workflow for inspecting local iPhone backups. The desktop app and CLI run locally against the sources you explicitly select.

What’s new

• Media gallery: browse image files, thumbnail paths, Photos catalogue rows and recorded relationships in a seventh workspace view.
• Source-verified image viewing: explicitly open PNG/JPEG files from a current-session scan. ENGRAM rechecks the recorded SHA-256, applies supported JPEG orientation and generates a bounded PNG without source metadata. Viewing changes no source files or saved-case bytes.
• Guided iPhone backup inspection: choose a local backup through the native picker, review its index and encryption state, then explicitly start analysis. Cancellation or failure keeps the current case and review.
• Repeatable testing: engram fixture DEST --iphone-backup creates a clearly synthetic backup with generated DEMO images. Existing schema-1 cases, review annotations and Markdown/CSV reports remain supported.

The image is an unedited native capture. Its exact capture provenance is recorded separately from release-package verification.

Download

Platform	Desktop app + CLI	Runtime
Windows x64	Portable ZIP	Microsoft Edge WebView2
macOS Apple Silicon	App archive	macOS 11 or later, arm64
Linux x64	Binary archive	GTK 3 and WebKitGTK 4.1

Extract the archive before launching the desktop. Packages have no trusted publisher signatures; the macOS application is not notarized. Each archive includes the CLI, usage instructions, documentation, a payload checksum manifest and BUILD-INFO.json.

Verification

The source checks and package build use the same source revision. Verification includes 100 frontend tests, cross-platform Rust tests and Clippy, real Linux native backup/media/report workflows, and independent archive, checksum, executable-architecture and bundle-metadata checks.

The copied package CLI is executed on Windows and Linux. The copied Linux release desktop loads its embedded frontend and completes the native IPC handshake in the Trace map and Media gallery. The Apple Silicon app and CLI are cross-built on Intel and checked as arm64 binaries; ARM64 runtime execution and Windows/macOS GUI interaction are outside this verification.

Use SHA256SUMS.txt to verify the downloads. BUILD-INFO.txt records the exact source, build, artifacts and execution scope.

Image viewing currently supports PNG and JPEG. HEIC/video retain inventory metadata; OCR, deleted-record reconstruction and encrypted-backup reading remain separate work. ENGRAM is a desktop application for supplied files and backups; it does not connect directly to a phone.

ENGRAM 0.6.0 — Evidence reports

ENGRAM 0.6.0 — Evidence reports

Export the findings you are reviewing as a Markdown report or CSV table, directly from the Trace desk or CLI.

• Choose the complete filtered queue, bookmarked findings or the entire open case. An empty scope cannot silently export everything.
• Keep reports minimal by default; full recorded paths, evidence details and analyst notes are three separate opt-ins.
• Save through the native destination picker and keep a receipt with the finding count, byte count and SHA-256 checksum.
• Export the current review while preserving Unsaved review. Use Save case to retain a restorable observation.
• Use engram export for saved cases, with explicit finding IDs, bookmarked selection and optional JSON receipts.

engram export ./sample.engram.json --out ./findings.report.md
engram export ./sample.engram.json --bookmarked --format csv --out ./bookmarks.report.csv

Reports are bounded to 10,000 known findings and 16 MiB. Markdown escapes imported markup. CSV uses a UTF-8 BOM, quoted fields, CRLF records and formula protection; identifiers that cannot be preserved safely in CSV require Markdown. Field selection is not universal anonymization: reports remain sensitive local artifacts.

Verification records cross-platform Rust/backend checks and frontend validation. Native Linux evidence includes six startup views and a separate real-picker Markdown/CSV exercise. Platform package build provides fresh Windows x64, macOS Apple Silicon and Linux x64 archives. Exact source identities, checksum verification and evidence scope are recorded in BUILD-INFO.txt.

Windows requires WebView2; Linux requires GTK 3 and WebKitGTK 4.1. These packages are unsigned; the macOS app is not notarized. Extract the archive before opening the app.

Case schema remains 1 and existing saved cases open without conversion. Reports are separate output artifacts. Reader coverage and recovery capabilities are unchanged.

ENGRAM 0.5.0 — Review workspace

Find what remains. ENGRAM 0.5.0 brings bookmarks, review states and notes into the Atlas Focus desktop workspace, with structured search and an evidence map you can pan and zoom.

Review the findings

• Bookmark a finding, mark it Unreviewed, Needs review or Reviewed, and keep plain-text notes in the evidence inspector.
• Save validated review annotations with a new local case file. Cases created before review annotations existed open with an empty review; the optional review map retains schema version 1.
• Focus the queue with bookmark/review filters, quoted phrases, exclusions and literal field searches, including notes.
• Pan the map background, zoom with the controls or Ctrl/⌘ + scroll, reset the view and fit the selected finding.
• Use search/workspace shortcuts and receive unsaved-review prompts before replacing the open case or closing the desktop.

Review states are analyst metadata. They preserve the engine's Observed / Linked / Candidate confidence labels, source evidence and evidence-comparison results. Baseline review annotations are read-only.

Download and run

• Windows x64: extract the ZIP and run engram-desktop.exe. Microsoft Edge WebView2 Runtime is required.
• macOS Apple Silicon: extract the archive and open ENGRAM.app.
• Linux x64: extract the archive and run engram-desktop in a graphical session with GTK 3, WebKitGTK 4.1 and compatible system runtime libraries.

Each archive includes the engram CLI, USAGE.txt and payload checksums. Release-level SHA256SUMS.txt records the archive hashes; BUILD-INFO.txt records the exact source and build evidence. Packages are unsigned; the macOS app is not notarized.

The app starts with a labelled synthetic case. Use Choose source for an explicitly selected local folder or supported unencrypted iPhone backup, Open case for a saved observation, and Save case to keep the current findings and review in a new file outside the source.

Keep the review

Review changes remain unsaved until Save case succeeds. Cancelled or failed saves keep them unsaved. The browser demonstration keeps review changes in the current tab only.

Notes are stored as the plain text you enter in the case JSON and are not automatically redacted. Keep cases private and avoid entering credentials into notes.

Build and capture evidence

• Successful main-branch verification: frontend, Rust and platform checks on the exact release tree.
• Windows, macOS and Linux package build from exact package source c3a1ab3.
• Six successful native Tauri/IPC captures from capture source 023d641.
• Native screenshot provenance and review, search and navigation guide.

The six unedited 1440 × 940 screenshots show the actual Linux Tauri application with a synthetic case generated by the shared Rust engine. All six capture logs report ENGRAM_TAURI_SMOKE_OK. They establish native launch and initial IPC; persistence and stale/cancelled saves have separate Rust regression coverage. Original design illustrations and historical release captures retain their own provenance.

Supported iPhone, Photos, browser and message readers remain experimental. Deleted-record reconstruction, protected Keychain recovery, OCR and application-access attribution remain planned; encrypted backups are unavailable. See the supported-data matrix for exact coverage.

ENGRAM 0.4.0 — Atlas Focus

Find what remains. ENGRAM 0.4.0 brings Atlas Focus to the working desktop app.

What changed

• A graphite-and-cobalt workspace with compact source controls and a transparent lightning mascot.
• All six views: Trace map, Findings, Timeline, Connections, Compare cases and Modules.
• Shared search and filters, an evidence inspector, a compact findings dock, and keyboard selection on the map.
• Category clusters and connections drawn from actual recorded evidence.
• The existing Rust analysis engine, guarded native operations and schema-1 cases are preserved.

Download and run

Windows x64: extract the ZIP and open engram-desktop.exe (WebView2 Runtime required). macOS Apple Silicon: extract and open ENGRAM.app. Linux x64: extract and run engram-desktop in a graphical session with GTK 3 and WebKitGTK 4.1.

Each archive includes the CLI, USAGE.txt and payload checksums. SHA256SUMS.txt verifies the downloads; BUILD-INFO.txt records their exact source and build evidence. Packages are unsigned; the macOS app is not notarized.

The app starts with a labelled synthetic demonstration. Use Choose source for a selected local folder or supported unencrypted iPhone backup, Open case for a saved observation, and Save case to preserve a new observation.

Verification

Cross-platform tests and all six native Tauri/IPC views · Native packages · Exact release source · Screenshot provenance.

Packages come unchanged from successful build source b7e7e9f. The release tag adds final documentation and native screenshots; runtime sources, configuration and dependency lockfiles are byte-identical. See BUILD-INFO.txt for the exact revisions.

Supported iPhone and SQLite readers remain experimental. Deleted-record reconstruction, protected Keychain recovery, OCR and application-access attribution remain planned. See supported data for coverage.

ENGRAM 0.3.0 — Desktop app

Find what remains. ENGRAM is a local desktop app for inspecting the traces preserved in selected files and supported offline backups. Search findings, follow their evidence, save a case and compare observations over time.

What's in 0.3.0

• Refined Trace desk typography, navigation, evidence-map contrast, findings rows, timeline cards and inspector details.
• Clear application and synthetic-demonstration labels throughout the desktop and CLI.
• An expanded illustrated guide with six real native application views and a complete source-to-case workflow.
• The shared Rust analysis engine, schema-1 cases and existing readers, with explicit Ready, Experimental and Planned states.

Download and run

• Windows x64: extract the ZIP and run engram-desktop.exe. Requires Microsoft Edge WebView2 Runtime.
• macOS Apple Silicon: extract the archive and open ENGRAM.app.
• Linux x64: extract the archive and run engram-desktop. Requires GTK 3, WebKitGTK 4.1 and a compatible graphical runtime.

Each archive also contains the engram CLI, usage instructions and payload checksums. SHA256SUMS.txt verifies the release archives; BUILD-INFO.txt records the exact source and checks. Distribution binaries are unsigned; the macOS app is not notarized.

The app opens a synthetic demonstration. Use Choose source to select a real local folder or supported unencrypted iPhone backup, Open case to reopen an observation, and Save case to store a new local case outside the source.

Verification and coverage

• Cross-platform Rust and frontend checks, plus six native Tauri/IPC captures.
• Windows, macOS and Linux application packages.
• Verified package source.
• App tour and supported-data matrix.

The release tag includes fresh native captures and documentation; runtime files and dependency lockfiles match the verified package source. Supported iPhone and SQLite readers remain experimental. Deleted-record reconstruction, Keychain recovery, OCR and application-access attribution remain on the roadmap.

ENGRAM 0.2 — Cobalt Identity Preview

ENGRAM adopts the approved cobalt lightning character, warm paper and charcoal ink. The desktop is now the Trace desk, with an angular Trace map and the slogan Find what remains. The README banner, native icons, navigation, filters and evidence views share the new identity.

This release changes the visual identity and branding text. The Rust analysis engine, supported readers, case schema, evidence rules, IPC permissions and source-preserving operations retain their behavior. Existing schema-1 cases remain compatible. The application version stays 0.2.0; this release is preview.2.

Downloads

• Windows x64: portable ZIP with engram-desktop.exe and the CLI. Requires Microsoft Edge WebView2 Runtime.
• macOS Apple Silicon: tar archive with ENGRAM.app and the CLI.
• Linux x64: native desktop and CLI archive. Requires GTK 3, WebKitGTK 4.1 and a compatible system runtime.
• SHA256SUMS.txt verifies the archives; BUILD-INFO.txt records their exact source and checks.

The packages are unsigned Developer Preview builds. The macOS app is not notarized. The app starts with clearly marked synthetic data; select a local source through the native dialog to inspect real files.

Verification

• Cross-platform Rust checks, frontend tests and actual Tauri/IPC captures.
• Native package build for Windows, macOS and Linux.
• Verified build source.

The release tag also includes fresh native screenshots and documentation. Runtime files and dependency lockfiles match the verified package source. Earlier release artifacts retain their original appearance.

Reader coverage remains unchanged: supported iPhone backup and SQLite activity readers are experimental; protected Keychain recovery, deleted-record carving, OCR and application-access attribution remain planned.

ENGRAM 0.2 — Tauri + React Developer Preview

ENGRAM 0.2 brings the memory desk to Tauri 2 + React + TypeScript, with the existing Rust analysis engine and CLI underneath.

The native application includes an interactive evidence brain map, shared search and filters, a persistent inspector, source chronology, recorded connections, saved-case comparison and explicit module coverage. Native dialogs select the source and case files; the Rust session owns analysis, validation and persistence.

Downloads

• Windows x64: portable ZIP containing engram-desktop.exe and the engram.exe CLI. Microsoft Edge WebView2 Runtime is required.
• macOS Apple Silicon: tar archive containing ENGRAM.app and the CLI.
• Linux x64: tar archive containing the native desktop and CLI. GTK 3, WebKitGTK 4.1 and a compatible system runtime are required; this archive is not an AppImage.
• SHA256SUMS.txt verifies the package archives. BUILD-INFO.txt records the exact build source and verification runs.

Open the desktop to start with a clearly labelled synthetic case. Choose a source explicitly to inspect real files. Save case files outside the selected source. Existing schema-1 cases remain compatible.

Verification

The release is published after frontend formatting, TypeScript, 15 frontend tests, Rust core/CLI/backend tests and strict Clippy checks pass. Linux CI also launches the actual Tauri window and verifies the React-to-Rust command bridge in four views. Build provenance links accompany the packages.

• Cross-platform checks and real native captures
• Native package build
• Binary source commit

The binary source tree is identical to the fully verified tree; the release tag also includes the published screenshot gallery and documentation updates. The runtime source and dependency lockfiles match the package build.

The packages are unsigned Developer Preview builds; the macOS app is not notarized. Existing reader coverage is unchanged: supported iPhone backup and activity readers remain experimental, while protected Keychain recovery, deleted-record carving, OCR and application-access attribution remain planned. A candidate is not a verified working credential or proof of deletion.

ENGRAM 0.1.0 — Developer Preview

ENGRAM is a native Rust workspace for investigating the traces preserved in explicitly selected offline files and backups.

This first Developer Preview includes an interactive memory map, searchable findings, an evidence inspector, source chronology, recorded connections, case comparison, and a CLI using the same analysis engine.

Downloads

• Windows x64: engram-windows-x86_64-pc-windows-msvc.zip — desktop, CLI, documentation and native captures. Open START-HERE.txt after extraction.
• macOS Apple Silicon: engram-macos-aarch64-apple-darwin.tar.gz.
• Linux x64: engram-linux-x86_64-unknown-linux-gnu.tar.gz.
• SHA256SUMS.txt verifies the release packages. BUILD-INFO.txt records source and verification details.

The desktop opens with a clearly labelled synthetic case. Choose a source explicitly to inspect real files. Save cases outside the source.

Implemented

• Bounded folder inventory and exact-content relationships.
• Masked secret candidates with matching within a case; credentials are not tested against services.
• Experimental unencrypted iPhone backup indexing and supported Photos, browser-history and message-metadata readers.
• Source-preserving case output, validated imports, explicit coverage notes and confidence labels.

Protected Keychain recovery, deleted-record carving, OCR and application-access attribution remain planned. An unmatched thumbnail is not proof of permanent deletion. These are unsigned preview builds.

Verified

Core and CLI tests, formatting, native checks and Clippy passed on Windows, macOS and Linux. The Linux desktop was launched and captured in four views.

• Cross-platform verification and real native captures
• Native package builds
• Binary source commit

The release tag also includes the capture gallery and documentation updates; executable source and the dependency lockfile match the verified builds.