DFIRoscope Live 0.4.0

DFIRoscope Live 0.4.0

Highlights

• Investigate recorded endpoint activity in the Network workspace and pivot to related processes.
• Review Persistence Current and Changes views with baseline periods and configuration history.
• See results from explicit Agent live Prefetch analysis in the Artifacts workspace.
• Compare expected and actual application information using captured process and signature evidence.
• Configure your own AI provider for chats and investigations with checked evidence links. Cloud requests require your explicit consent.

Fixes in this build

• Services and drivers stay visible when a registration is malformed or unreadable. The incomplete entry and diagnostic remain available without a false removal.
• Test connection can test a newly entered AI provider key before you save it.
• At startup, the Viewer can offer to remove Zone.Identifier download markers from its portable Viewer and Agent binaries. Skip is the default. Removing markers changes how Windows treats file origin; it does not authenticate the files.
• New AI provider settings use a neutral localhost endpoint. Existing saved settings are preserved.
• Public build metadata and first-party notices point to the public repository and use neutral project-maintainer attribution.
• The Events context menu no longer offers AI actions that are not ready in that workspace.

Downloads and verification

• Self-contained Windows x64 ZIP: includes the .NET runtime.
• Framework-dependent Windows x64 ZIP: requires the .NET 10 Desktop Runtime.
• Source ZIP: complete buildable public product source, with provenance.
• SHA-256 inventory: compare the downloaded ZIP hashes before running a package.

Extract a binary ZIP and run Viewer/DFIRoscope.Live.exe. The local Agent requests administrator privileges when needed. This release is unsigned, so Windows may show an unknown-publisher or reputation warning. Checksums establish file integrity, not publisher authentication.

Configure your own AI provider before using AI features. No provider profiles, credentials, or investigation data are included in the release archives. Bug reports: app@dfiroscope.com.

DFIRoscope Live 0.3.0

DFIRoscope Live 0.3.0

DFIRoscope Live now uses semantic version numbers. Version 0.3.0 replaces the EDU/episode naming used by earlier releases.

Highlights

• Independent Processes and Events investigation workspaces with their own filters, selections and Details views. Open multiple investigations and pin workspaces to preserve their navigation scope.
• Windows event investigation with Identity, Provider, Channel and Event ID pivots; native event fields, profiles, presets, comparison and dataset statistics.
• Local Agent capture and supported monitoring configuration for Windows event sources. Source availability and acquisition coverage depend on the host and configuration; missing or ambiguous identities remain visible.
• Every shared value-filter popup includes sortable Value and Count columns. Counts reflect matching stored rows; sorting covers the full applicable value set before the unchanged 256-value display limit. Search and sorting retain checkbox selections.
• Missing ETW provider and channel metadata display as Event Tracing for Windows. Actual metadata and captured evidence remain unchanged.

Downloads

• Self-contained Windows x64 portable ZIP: includes the .NET runtime.
• Framework-dependent Windows x64 portable ZIP: requires the .NET 10 Desktop Runtime.
• Complete source ZIP, SHA-256 checksum inventory and build provenance.

Extract a binary ZIP and run Viewer/DFIRoscope.Live.exe. The local Agent requests administrator privileges when needed. New sessions are stored in the extracted package's Sessions directory; retain that directory when replacing or removing a portable installation.

This release is unsigned. It supplies no DFIRoscope publisher signature, and Windows may show an Unknown publisher or reputation warning. Verify downloads against the published SHA-256 inventory; checksums establish file integrity, not publisher authentication.

Original DFIRoscope material remains licensed under Apache-2.0. Availability is limited to the published groups recorded in PUBLIC-EDITION.json. No installer or Infrastructure deployment is included.

DFIRoscope Live 0.1.0-edu.2

DFIRoscope Live 0.1.0-edu.2

EDU Release 02 focuses on Windows Security monitoring and investigating Security events associated with processes.

Published capabilities:

• Agent-based capture
• Process listing
• Selected-process details
• Windows Security Events

Downloads

• Framework-dependent — Windows x64, 69.9 MiB: Requires Microsoft .NET 10 Desktop Runtime for Windows x64.
• Self-contained — Windows x64, 111.6 MiB: No separate .NET installation is required. This package includes its own .NET runtime. Use the newest DFIRoscope release to keep the bundled runtime current.
• Source: Complete buildable public source for this edition.

Lessons

1. Windows Security Monitoring: Practical Theory
2. Investigating Windows Security Events — Tool Walkthrough

Both lessons include reviewed English captions.

Integrity and provenance

These public binaries are not code-signed. Verify the SHA-256 checksums before running them.

Download DFIRoscope-Live-0.1.0-edu.2-SHA256.txt and DFIRoscope-Live-0.1.0-edu.2-PROVENANCE.json from the release assets. Source commit recorded by the release pipeline: 4621ede24619b7c3be5dc3397a617f339390519e.

Scope

DFIRoscope is an investigation and learning workspace. It is not an EDR or a replacement for enterprise security products. Test audit-policy changes only on systems you control and are authorized to configure.

Bug reports: app@dfiroscope.com

DFIRoscope Live 0.1.0-edu.s1e1

DFIRoscope Live 0.1.0-edu.s1e1

This release publishes the following bounded capabilities:

• Agent-based capture
• Process listing
• Selected-process details

Downloads

• Framework-dependent — Windows x64, 69.5 MiB: Requires Microsoft .NET 10 Desktop Runtime for Windows x64. Install the newest supported .NET 10 Desktop Runtime before running DFIRoscope.
• Self-contained — Windows x64, 111.1 MiB: No separate .NET installation is required. This package includes its own .NET runtime, making the download substantially larger. The bundled runtime may become outdated, so use the newest DFIRoscope release.
• Source: Complete buildable public source for this edition.

Integrity and provenance

These public binaries are not code-signed. Verify the SHA-256 checksums before running them.

Download DFIRoscope-Live-0.1.0-edu.s1e1-SHA256.txt and DFIRoscope-Live-0.1.0-edu.s1e1-PROVENANCE.json from the release assets. Source commit recorded by the release pipeline: 352109a071dc1d2c265dab3f392b518b6b901547.

Scope

DFIRoscope is an investigation and learning workspace. It is not presented as an EDR or as a replacement for enterprise security products.