Skip to content

v2026.4.1

Choose a tag to compare

View all tags
@Johann-PLW Johann-PLW released this 20 Sep 10:51
· 955 commits to main since this release
v2026.4.1
697333a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

DLEAPP v2026.4.1

Massive Windows artifact expansion: over 25 new parsers covering execution evidence (Prefetch, Amcache, AppCompatCache/Shimcache, BAM/DAM, UserAssist, Scheduled Tasks, Run/RunOnce autostart keys), user activity (ShellBags, Jump Lists with DestList MRU parsing, RecentDocs, LNK shortcuts, Explorer per-user MRU), system artifacts (SRUM, SAM local accounts, Services registry, Mounted Devices, Network Profiles, USB Storage Devices, Capability Access Manager, PCA), and Windows Event Log coverage (Security logons, service installations, Terminal Services sessions, power events, account management).

  • New Windows search and cache artifacts: WebCache, Windows Search index (both legacy Windows.edb and Windows 11 Windows.db), thumbnail cache, and Recycle Bin ($I) records, validated against a new "Lone Wolf" sample corpus.
  • New macOS parsers rounding out desktop coverage: KnowledgeC, Network Usage, TCC, InteractionC, Notes, and LaunchServices Quarantine.
  • Forensic input and performance improvements: NTFS and APFS images now read in one pass with qnxprobe 1.30, the LAVA database now commits once per artifact instead of once per staged file, and a new ArtifactResult streaming path added for handling large artifacts more efficiently.

Full Changelog: v2026.4.0...v2026.4.1

Assets 14
Loading