v0.12.5

[Ghassan-elsman]

Crow-Eye 0.12.5 - Universal Import & Investigator Experience

Why did the open-source version jump from 0.12.0 to 0.12.5?

Our first priority has been the desktop (EXE) build — the packaged installer that most users actually run and that ships with an auto-updater. As issues came in, we fixed them fast and pushed those patches straight to the EXE version as interim releases 0.12.1, 0.12.2, 0.12.3, and 0.12.4 (installer-only bug-fix builds).

Those interim versions were never tagged as separate open-source releases, so the GitHub source stayed at 0.12.0 while the desktop build moved ahead.

With 0.12.5, the GitHub version catches up completely. This release folds in all of the patches that had gone out to the EXE build (0.12.1-0.12.4) and the new features and fixes below — so the open-source source is now fully in sync with, and ahead of, the desktop build. That's why the version number jumps straight from 0.12.0 to 0.12.5.

---

New - Universal Evidence Import

Bring third-party forensic data into a case and analyze it right next to the artifacts Crow-Eye already parsed.

• Two entry points: an "Add Evidence" button in the Eye AI top bar, and an "Import Evidence" action in Settings.
• Three formats: import a SQLite .db/.sqlite directly, or a CSV / JSON / JSONL that is auto-converted to SQLite (columns sanitized, nested JSON flattened, primary timestamp auto-detected & normalized). Large files convert on a background thread.
• Imports are auto-discovered — no manual registration.

New - The Eye analyzes imported evidence and finds correlations

• Imported databases are treated as first-class evidence; the Eye is directed to cross-reference them against native artifacts (corroborate / conflict / silent).
• New correlate_imported_evidence tool finds shared identities (filenames, users, IPs, hashes) and timestamp overlaps, returning database:table:rowid matches — proactively at case-open triage and on demand.
• The Eye now has full query access to the Correlation Engine results database (query_database / get_schema), on top of the existing correlation tool.

Timeline

• Imported events appear in the Artifacts lane and connect to native events via the existing shared-name + time-window correlation.
• Removed the non-functional browser right-click menu ("View page source" / "Save page").

Experience

• App-wide dark theme for dialogs — fixes unreadable black-on-dark popups.
• Emoji to designed icons across the Timeline, Eye, PyQt dialogs, and collector GUIs (clean inline-SVG iconography; the default/advanced markers redesigned as line icons).
• User Behavior Analytics (UBA) now opens reliably (fixes the "Build Missing" prompt).

Fixes & correctness

• Cross-database search fixed — the Eye's search_artifacts now searches every database in the case and tags each hit with its source (previously returned nothing).
• No duplicate evidence analysis — the Eye no longer double-counts the Correlation Engine's auto-generated feather copies of native artifacts.
• Fixed launch crashes in the Offline Importer and the Forensics Image Parsing dialog, plus the Eye AI first-run splash issue.
• Rolls up all interim desktop-build fixes from 0.12.1-0.12.4.

---

Full details: see RELEASE_NOTES.md | License: GPL-3.0
Full Changelog: 0.12.0...0.12.5

---

This discussion was created from the release v0.12.5.