Winnow 0.1.0

First tagged release.

Winnow is a local viewer for the very large CSVs that DFIR triage produces — EvtxECmd, MFTECmd, Amcache, whole KAPE output folders — with the row-tagging workflow Timeline Explorer gets right. A 1.2M-row CSV imports in about 8 seconds, filtering it takes milliseconds, and scrolling stays smooth at any depth.

Everything runs locally: one Python server, no cloud, no CDN, no build step, and it works on an airgapped analysis box. Your work lives in a single SQLite case file you can hand to another analyst, and the evidence files themselves are never modified.

Install

pip install fastapi "uvicorn[standard]" python-multipart openpyxl
python server.py --case case.db --open timeline.csv

It opens in an app window — no address bar, its own taskbar entry — using Edge on Windows or Chrome elsewhere, falling back to a normal tab if neither is present.

Updating

python update.py            # check for and install the next release
python update.py --rollback # undo it

Your saved filters, tags, installed plugins, case list and case files are never touched by an update, and the previous version is backed up first. On a machine with no network, download the release elsewhere and apply it with python update.py --from <file>.zip.

Beta testers tracking unreleased work can use python update.py --dev.