DFIRoscope Live 0.3.0

DFIRoscope Live 0.3.0

DFIRoscope Live now uses semantic version numbers. Version 0.3.0 replaces the EDU/episode naming used by earlier releases.

Highlights

• Independent Processes and Events investigation workspaces with their own filters, selections and Details views. Open multiple investigations and pin workspaces to preserve their navigation scope.
• Windows event investigation with Identity, Provider, Channel and Event ID pivots; native event fields, profiles, presets, comparison and dataset statistics.
• Local Agent capture and supported monitoring configuration for Windows event sources. Source availability and acquisition coverage depend on the host and configuration; missing or ambiguous identities remain visible.
• Every shared value-filter popup includes sortable Value and Count columns. Counts reflect matching stored rows; sorting covers the full applicable value set before the unchanged 256-value display limit. Search and sorting retain checkbox selections.
• Missing ETW provider and channel metadata display as Event Tracing for Windows. Actual metadata and captured evidence remain unchanged.

Downloads

• Self-contained Windows x64 portable ZIP: includes the .NET runtime.
• Framework-dependent Windows x64 portable ZIP: requires the .NET 10 Desktop Runtime.
• Complete source ZIP, SHA-256 checksum inventory and build provenance.

Extract a binary ZIP and run Viewer/DFIRoscope.Live.exe. The local Agent requests administrator privileges when needed. New sessions are stored in the extracted package's Sessions directory; retain that directory when replacing or removing a portable installation.

This release is unsigned. It supplies no DFIRoscope publisher signature, and Windows may show an Unknown publisher or reputation warning. Verify downloads against the published SHA-256 inventory; checksums establish file integrity, not publisher authentication.

Original DFIRoscope material remains licensed under Apache-2.0. Availability is limited to the published groups recorded in PUBLIC-EDITION.json. No installer or Infrastructure deployment is included.