v0.3.0 (beta)

Features

• Ransomware: each Windows host is checked for ransomware from its MFT and USN journal: added extension, ransom note, and when encryption started and finished. Results per host on a new Analysis page and in the case report, with overrides to confirm or correct a host.
• Setup: at full screen the Setup page uses the extra width, with module chips per category in List view and options edited in place in Rail view.
• Memory: each tool's peak memory is recorded in the run manifest, and the run ends by naming the three biggest users.
• EvtxECmd: event logs are split across several processes (Parts option) and joined into one CSV, so large log sets parse faster.
• Keep free: a new setting (1 GB by default) holds back new modules while free memory is low, so a busy PC works through the batch instead of paging.

Changes

• Memory-heavy modules now share the free memory instead of always running one at a time, and the longest one starts first. MFTECmd_MFT is now memory-heavy; ChainsawGaps no longer is.
• Faster zip extraction (checks run alongside, several files at a time on multi-core PCs).
• Faster IOC sweep, RDP trace and IP history, and a more responsive window during long runs. Tools run at below normal priority.
• In a multi-host run, each host's post-run steps (IP history, RDP trace, ransomware check, IOC sweep) start as soon as that host's modules finish.

Bug fixes

• Run options: Workers, Heavy IO, Keep free and Zips at once are checked and brought into range when a run starts, in the app and on the command line, instead of quietly using a default.

---

Install: extract the zip anywhere; it needs the .NET 9 Desktop Runtime. Third-party tools are not included - put the EZ Tools (and Hayabusa and Chainsaw, if wanted) in Tools\, then run ArtefactForgeCli tools to check. An existing install can update itself from Settings > Check for updates.

This is a beta: please report problems in Issues.

v0.2.1 (beta)

Bug fixes

• Registry: a dirty hive collected without its .LOG1/.LOG2 files is read as last written to disk instead of being skipped in silence, and the module is flagged for review, as recent entries may be missing. Re-run Amcache, ShimCache, ShellBags and RECmd on affected collections.
• Updates: the release notes shown by Check for updates fill the width of the panel.

---

Install: extract the zip anywhere; it needs the .NET 9 Desktop Runtime. Third-party tools are not included - put the EZ Tools (and Hayabusa and Chainsaw, if wanted) in Tools\, then run ArtefactForgeCli tools to check. An existing install can update itself from Settings > Check for updates.

This is a beta: please report problems in Issues.

v0.2.0 (beta)

Features

• Analysis tab: one tab for working on a processed case, with pages for IOCs, RDP trace, IP history and the evidence list.
• Case report: an offline HTML page per case that leads with what needs attention, then covers hosts, detections, IOC hits, RDP traces and IP history.
• Evidence list: an Excel list of every collection in the case, rebuilt after each run and keeping the columns you fill in.
• IOC sweep: a per-case IOC list searched across every host's parsed output, with hits saved per host.
• RDP trace: follows an RDP session back host by host until it leaves the case, rating each hop and flagging gaps and conflicts.
• IP history: works out which machine had which IP address and when, from a domain controller's Kerberos events, DHCP and DNS logs.
• DHCP server logs: a new module parses the DHCP server's audit logs.
• CLI: new report, evidence-list, ioc, rdp and ip commands.

Bug fixes

• Hayabusa and Chainsaw show their installed version when checking for updates.
• Collection zips extract when the output folder is on a network share.

---

Install: extract the zip anywhere; it needs the .NET 9 Desktop Runtime. Third-party tools are not included - put the EZ Tools (and Hayabusa and Chainsaw, if wanted) in Tools\, then run ArtefactForgeCli tools to check. An existing 0.1.x install can update itself from Settings > Check for updates.

RDP trace has so far been tested on sample data only. If a trace looks wrong, please report it in Issues.

This is a beta: please report problems in Issues.

v0.1.1 (beta)

Bug fixes

• Cleaning up extracted zips no longer reports a failed delete when two zips finish at the same time.
• tools checks the tool folders given with --tools, the same ones a run uses.

---

Install: extract the zip anywhere; it needs the .NET 9 Desktop Runtime. Third-party tools are not included - put the EZ Tools (and Hayabusa and Chainsaw, if wanted) in Tools\, then run ArtefactForgeCli tools to check.

This is a beta: please report problems in Issues.

v0.1.0 (beta)

First public release, a beta. ArtefactForge was developed privately up to 1.6.0; this repository starts its history and version numbers afresh, under the MIT licence.

Features

• Collection inputs: CyLR, Velociraptor offline and UAC collections are processed straight from their zip or tar.gz, or already unpacked.
• Batch: a folder of collections and zips is processed together, two zips at a time, and a re-run picks up where the last one stopped.
• Linux: new modules for UAC live response, the audit log, syslog, persistence points, other tools' history, executable hashes, chkrootkit and a bodyfile timeline.
• Per-user output: each user's registry, LNK files, jump lists, timeline, ShellBags and user files sit in their own folder.
• Live systems: the system summary and ShellBags work on a live system, and admin-only modules are skipped with a reason when not elevated.
• Mounted images: a mounted Windows drive is named after the host in its own registry.
• Setup: a redesigned module selector with two layouts, a Windows / Linux switch, a Collections tab, and remembered output folders and run options.
• Settings: a Settings tab with dark mode, updates and About.
• Updates: ArtefactForge checks this repository's releases for a newer version, and Hayabusa and Chainsaw can be updated from the Tools tab.
• Zip cleanup: an option to delete each zip's extracted data once it is parsed.

Changes

• ChainsawSrum no longer runs by default; SrumECmd already parses the same database.
• ChainsawShimcache is withdrawn for now, as Chainsaw fails on current Windows 11 Amcache hives.

Bug fixes

• SRUM from Velociraptor collections is parsed, and SrumECmd no longer changes the SRUM database in the evidence.
• A tool that writes only empty files is reported as no output instead of Completed.
• Output that cannot be moved into place fails its module instead of being lost.
• A module that cannot create its folders fails on its own instead of ending the run.
• A full disk while writing a tool's log fails that module instead of closing ArtefactForge.
• Hayabusa and Chainsaw run one at a time, so they no longer run a workstation out of memory.
• The Default and Public profiles are no longer flagged for review.
• RHEL's dated log rotation is read by the authentication parser.
• Hayabusa's error log and Chainsaw's progress are kept with the run.
• Encrypted zips are reported as encrypted.
• The "Open release page" buttons open the release.
• Screen readers can reach the contents of each tab.

---

Install: extract the zip anywhere; it needs the .NET 9 Desktop Runtime. Third-party tools are not included - put the EZ Tools (and Hayabusa and Chainsaw, if wanted) in Tools\, then run ArtefactForgeCli tools to check.

This is a beta: please report problems in Issues.