Forensic Evidence 0.3.14

Release 0.3.14

Location maps now show details when you hover over a pin and keep a larger
preview open when you click it. Photo GPS records load thumbnails directly from
the original evidence. The preview includes the filename, recorded capture time,
coordinates and Show source file. Previous and next buttons browse records
that overlap at the same point. Records without photos show their location
details. Map snapshots retain their original evidence source and filters.

Photo previews stay local, and pending reads are cancelled when the preview or
map closes. Unavailable evidence or pictures show an explicit message. Source
navigation supports iPhone backup manifest paths and can prompt to unlock a
locked volume. Map actions remain available while evidence indexing is running.

Artifact progress stays current while filtering saved results, and case-database
validation coordinates with SQLite during concurrent operations. The release
retains automatic clear-key BitLocker opening, recovery-key prompts, optional
IndexedDB parsing, artifact paging and exports, and verified application updates
from 0.3.13.

Packages include signed Windows x64 Desktop and MCP archives and a desktop MSI,
Linux x64 Desktop and MCP archives, and macOS ARM64 Desktop and MCP app bundles.
Windows packages are Authenticode signed by BBSOFT LLC. macOS bundles are ad-hoc
signed and not notarized. Linux requires Ubuntu 22.04 or a compatible environment
with glibc 2.35 or later; macOS requires macOS 14 or later. Dokany 2.x remains a
separate prerequisite for Windows read-only mounting.

SHA-256 sidecars and an aggregate checksum file accompany the downloads.
Dependency sources and rebuild materials
are published separately. Evidence, application source, signing keys, AI model
weights and private protection maps are excluded from the public binary packages.

Source revision: 3c471dce1cede74a9300122118ad9688944832fa.

Native release validation passed: Windows x64 1,849 tests passed / 30 skipped;
Linux x64 and macOS ARM64 each 1,779 passed / 100 skipped. Protected application
verification and relocated package checks passed on all three platforms. Final
payload hashes, corresponding reader sources, Windows signatures and timestamps,
and installer continuity were verified before publication.

Forensic Evidence 0.3.13

Release 0.3.13

BitLocker volumes with a usable clear-key protector now open automatically,
including supported Suspended / Waiting for Activation acquisitions. Other locked
volumes prompt for a recovery key when opened or accessed through an artifact
source link, address, or bookmark. Internet scans offer Unlock, Skip this volume,
or Cancel; skipped volumes are recorded as incomplete coverage. Keys remain masked
and session-only. Damaged decrypted NTFS metadata preserves access to raw and
decrypted volume bytes with an explicit warning.

Internet artifacts add supported Chromium IndexedDB, Local Storage and LevelDB
records, including compatible ChatGPT, Discord and Codex data, plus supported
Chromium block-cache records. Scan options → Parse IndexedDB is disabled by
default to reduce scan time and case size. The choice is saved with the case and
recorded in Coverage and exports; existing results remain available until a new
scan replaces them. Firefox and Safari IndexedDB and private mobile databases
remain outside the supported parsers.

Artifact tables page through all saved records with sorting, filtering and export
of provenance. Application updates can check the public release and verify download
size and SHA-256 before offering installation or showing a downloaded package.

Deleted-file recovery and carving panels are hidden by default. View → Recovery
controls shows them; starting a scan from Tools reveals the controls automatically.
Active progress and Cancel remain visible while a scan is running.

Packages retain signed Windows x64 Desktop and MCP archives and a desktop MSI,
Linux x64 Desktop and MCP archives, and macOS ARM64 Desktop and MCP app bundles.
Windows packages are Authenticode signed by BBSOFT LLC. macOS bundles are ad-hoc
signed and not notarized. Linux requires Ubuntu 22.04 or a compatible environment
with glibc 2.35 or later; macOS requires macOS 14 or later. Dokany 2.x remains a
separate prerequisite for Windows read-only mounting.

SHA-256 sidecars and an aggregate checksum file accompany the downloads.
Dependency sources and rebuild materials
are published separately. Evidence, application source, signing keys, AI model
weights and private protection maps are excluded from the public binary packages.

Source revision: 923569590ea35808b047f68f06bf8270b596b34a.

Native release validation passed: Windows x64 1,836 tests passed / 30 skipped; Linux x64 and macOS ARM64 each 1,766 passed / 100 skipped; no failures. Protected application verification and relocated package checks passed on all three platforms. Final payload hashes, corresponding reader sources, Windows signatures and timestamps, and installer continuity were verified before publication.

Forensic Evidence 0.3.12

Release 0.3.12

This release adds Internet artifacts and recorded locations. Scan Chromium/Edge,
Firefox and Safari visit history, Chromium Simple Cache, photo EXIF GPS and
supported Google Timeline JSON exports. Filter records, inspect their source
files, export provenance as JSON and display recorded locations together on a map.
Cached responses can contain useful text, but cache presence does not prove a visit
or authorship. IndexedDB, LevelDB and private mobile location databases are not
parsed in this release.

Scans default to user profiles and support editable folder exclusions, including
system and package trees. Progress shows discovery and parsing activity, candidate
counts and partial results. Live updates preserve table scrolling and selection;
text filtering runs in the background. Cancellation supports confirmation and a
saved preference. Saved case folders retain per-file checkpoints and derived
records in SQLite so interrupted work can resume without reparsing completed files.

Saved Internet artifacts, including partial scans, can be indexed for AI search.
Visited-site searches use recorded visit timestamps and exclude cache records.
The AI interprets date conditions; the application validates and applies them
before ranking results. Relative periods use the application's captured UTC clock,
with visible bounds and reference time. Search returns a ranked shortlist rather
than an exhaustive visit inventory; the Internet tab provides date filters for
reviewing all saved rows. Index again after further scan progress to include new
records while reusing unchanged embeddings.

The evidence browser adds editable path breadcrumbs: paste a folder path to
navigate, or a file path to open its parent and select the file. Row context menus
offer appropriate actions, including Unlock BitLocker for encrypted volumes.

Windows read-only mounting now includes BitLocker volumes unlocked in the current
viewer session. Unlock the desired volumes, then choose Read-only volume and mount
the selected evidence or all open sources. Windows Explorer can browse decrypted
files through Dokany. Recovery passwords remain in session memory and travel to
the isolated mount helper through its private pipe; they are not saved in cases or
process arguments. Original evidence remains encrypted and unchanged. Closing
evidence or reopening a case requires unlocking again. Dokany 2.x must be installed
separately; this release does not install its driver.

Packages include signed Windows x64 Desktop and MCP archives and a desktop MSI,
Linux x64 Desktop and MCP archives, and macOS ARM64 Desktop and MCP app bundles.
Linux requires Ubuntu 22.04 or a compatible environment with glibc 2.35 or later;
macOS requires macOS 14 or later. Windows application files and the MSI are
Authenticode signed by BBSOFT LLC. macOS bundles are ad-hoc signed and are not
Developer ID signed or notarized.

SHA-256 sidecars and an aggregate checksum file accompany the downloads.
Dependency sources and rebuild materials
are published separately. Application source, test evidence, AI model weights,
signing keys and private protection maps are excluded from public binary packages.

Forensic Evidence 0.3.11

Release 0.3.11

This release adds mobile acquisition and examination, with iPhone USB backups
on Windows and Android USB logical collection on Windows, Linux and macOS.
The mobile dialog reports transfer activity, collected bytes, verification
progress and estimated verification time when sufficient measurements exist.
Canceled or failed acquisitions retain their partial output and status.

iPhone backup examination includes messages, contacts, call history when present,
and a browsable backup file tree. Backup folders show recursive file counts;
empty folders can be hidden and name/path searches cover all folders beneath the
current location. Captured payload sizes that differ from the backup manifest
produce examination warnings without padding or truncating the captured files.
Apple device drivers/services are required for USB acquisition on Windows;
the Apple Devices window does not need to remain open.

Android collection copies accessible shared files and device information using
an installed Android SDK Platform-Tools adb. An optional, visibly installed
phone app collects messages, contacts and call history after the user grants
permissions and starts the export. It requires Android 8 or newer and does not
root the device or access private app storage. Provider-exposed SMS/MMS text
and message copies are preserved, including streamed text parts. RCS coverage
depends on what the messaging app exposes through those providers; a complete
RCS archive is not guaranteed.

The release bundles collector 0.2.0 with a persistent production signing
certificate. If the development collector is installed on your test phone,
uninstall it before installing this release's collector because its signing
certificate differs. Uninstalling removes the phone-side app's exports and
permissions; collections already saved on your computer remain available.

The evidence browser adds clickable path breadcrumbs and Back/Forward navigation
that restores previously visited folders and file selections. The exFAT reader
also accepts reserved attribute bits encountered in real macOS evidence.

Packages include signed Windows x64 Desktop and MCP portable archives and a
desktop MSI, Linux x64 Desktop and MCP archives, and macOS ARM64 Desktop and MCP
app bundles. Linux requires Ubuntu 22.04 or a compatible environment with glibc
2.35 or later; macOS requires macOS 14 or later. Windows application files and
the MSI are Authenticode signed by BBSOFT LLC. macOS bundles are ad-hoc signed
and are not Developer ID signed or notarized. Install the macOS app in Applications
and grant Full Disk Access to that installed copy before disk acquisition.

Acquisition remains experimental. Logical mobile collection includes only data
made available by the device and granted permissions. Completed output receives
SHA-256 read-back verification. Supported messages and files can be explicitly
processed for text/AI search; unavailable data cannot be reconstructed here.

SHA-256 sidecars and an aggregate checksum file accompany the downloads.
Dependency sources and rebuild materials
are published separately. Application source, test evidence, AI model weights,
signing keys and private protection maps are excluded from public binary packages.

Forensic Evidence 0.3.10

Release 0.3.10

This maintenance release fixes macOS disk acquisition hanging after administrator
approval. The helper restores child-process exit notifications inherited from
the approval launcher, allowing completed diskutil commands to return normally.
Regression checks cover normal, blocked and ignored SIGCHLD states.

Acquisition now shows when administrator approval has completed and source and
destination checks are running. Startup failures and metadata-command timeouts
include more useful context. The acquisition form and scrollable status text
reserve space on the right so the vertical scrollbar does not overlap controls.
The macOS administrator prompt identifies the app as Forensic Evidence.

Packages include signed Windows x64 Desktop and MCP portable archives and a
desktop MSI, Linux x64 Desktop and MCP archives, and macOS ARM64 Desktop and MCP
app bundles. Linux requires Ubuntu 22.04 or a compatible environment with glibc
2.35 or later; macOS requires macOS 14 or later. Windows application files and
the MSI are Authenticode signed by BBSOFT LLC. macOS bundles are ad-hoc signed
and are not Developer ID signed or notarized.

Install the macOS app in Applications and grant Full Disk Access to that installed
copy before disk acquisition. Replacing an ad-hoc signed build can require
removing and re-adding its Full Disk Access entry. Acquisition remains experimental;
live acquisition does not provide an atomic snapshot, and completed output is
verified against the collected stream using SHA-256 read-back verification.

SHA-256 sidecars and an aggregate checksum file accompany the downloads.
Dependency sources and rebuild materials
are published separately. Application source, test evidence, AI model weights
and private protection maps are excluded from public binary packages.

Forensic Evidence 0.3.9

Release 0.3.9

This release adds local disk acquisition to the existing desktop application on
Windows x64, Linux x64 and macOS ARM64. Use Acquire → Acquire PC evidence…
and choose RAW IMG, compressed E01 or compressed physical AFF4. Collection uses
a read-only source handle and a separate administrator-approved helper. Choose
an existing destination folder on another physical disk. Completed images pass
SHA-256 read-back verification; cancelled or failed collections retain a manifest
and clearly marked partial output. Windows additionally supports physical-memory
capture using the bundled, checksum-pinned signed WinPmem driver. Linux and macOS
memory capture are unavailable. Actual driver compatibility and administrator
approval depend on the host's security policy.

Windows packages include a separate read-only BitLocker recovery-key reader.
Tools → Unlock BitLocker… accepts a 48-digit recovery key for a session-only
decrypted view. Physical acquisition retains encryption; E01/AFF4 compression
warnings are advisory. The application does not persist recovery keys.
FileVault and Apple hardware encryption can limit recovery from a macOS image;
macOS acquisition does not unlock or decrypt FileVault.

Email browsing includes formatted PST/OST messages and Exchange 2013+ EDB
mailboxes. Double-click a nested PST, OST or EDB in a directory or readable evidence
container to drill down. Evidence processing can index supported contained email
text for AI search. EDB support is experimental and depends on the database state
and schema; a complete mailbox recovery is not guaranteed.

Read-only Windows evidence volumes use the separately installed official Dokany
runtime. Btrfs filesystem browsing is supported by the experimental filesystem parser.
NTFS deleted-file recovery includes MFT scanning; the previous 500,000-record and
512 MiB default scan ceilings have been removed. Explicit limits and cancellation
remain available. Deleted-file bytes may be overwritten, zeroed or unavailable.

File, Case, Acquire, View, Tools and Help menus organize the desktop actions.
The release contains a signed Windows x64 desktop MSI and portable Desktop/MCP
archives, Linux x64 Desktop/MCP archives, and macOS ARM64 Desktop/MCP app bundles.
Windows application hosts, managed application assemblies and the MSI are Authenticode signed by BBSOFT LLC;
the unmodified WinPmem driver retains its upstream signature. macOS bundles are
ad-hoc signed and are not Developer ID signed or notarized. No Linux ARM64,
Windows ARM64 or Intel Mac packages are published in this release.

Acquisition is experimental: live disks are read over time without an atomic
snapshot, and verification confirms the saved stream rather than a second source
read. Disposable native Linux/macOS disk-image tests and protected-build tests
cover known bytes and all three output formats. Real hardware, administrator
prompts, memory-driver capture and installer upgrade/uninstall execution require
separate validation on the intended host.

SHA-256 sidecars and an aggregate checksum file accompany the downloads.
Corresponding dependency sources, notices and rebuild materials are published
separately under dependencies-v0.3.9. Application source, test evidence, AI model
weights and private protection maps are excluded from public binary packages.

Dependency sources and rebuild materials.

Forensic Evidence 0.3.8

Forensic Evidence 0.3.8 is a signed Windows x64 release.

• Desktop MSI: installs the desktop app, bundled .NET runtime and evidence readers, with a Start menu shortcut and upgrades from earlier MSI versions.
• APFS fix: bundles the isolated APFS reader and fixes APFS navigation in protected builds. No separate Python installation is required. Plain and locked APFS images are checked against the actual release assemblies and helper.
• Read-only exFAT browsing.
• JPEG/PNG carving: scans decoded media, reports allocation where supported, and compares results with existing logical files. The desktop carving UI is disabled by default.
• Shared setting: enable carving by setting "EnableFileCarving": true in %LOCALAPPDATA%\ForensicEvidence\ai-server.json, keeping the file's other settings, then restart the app. Changing AI settings preserves the flag. Saved carved bookmarks remain readable with the feature disabled.
• FAT browsing fix: volume-label entries no longer break directory navigation.

Download desktop-win-x64-signed.msi for installation, desktop-win-x64-signed.zip for a portable desktop app, or mcp-win-x64-signed.zip for the separate MCP server. The MSI installs the desktop app only. For portable use, extract the complete ZIP and run the application inside its FE folder.

The Windows installer and first-party executables are Authenticode signed by BBSOFT LLC through Azure Artifact Signing in GitHub Actions. Signatures and trusted timestamps are verified before publication. MSI installation tables and all 3,962 embedded payload files are checked after signing. Installation, upgrade and uninstall execution have not been tested in a Windows VM. SHA-256 sidecars and SHA256SUMS.txt accompany the downloads; the MSI JSON report and each ZIP's BUILD-INFO.json record validation and source revision.

Windows 10 or later is required. This release publishes Windows x64 packages; other platforms retain their previous releases. APFS support is experimental: locked volumes show a warning, and unlocking, snapshots and deleted-entry recovery are unsupported. Carving recovers structurally valid contiguous JPEG/PNG files and may also find files already present in the filesystem. Allocation classification is unavailable for APFS.

Ollama, AI/OCR model weights and the SigLIP service require separate installation and configuration. Public downloads exclude application source and private protection maps.

Dependency corresponding sources and rebuild materials, including libfsapfs/APFS.

Forensic Evidence 0.3.6

Forensic Evidence 0.3.6 includes the desktop evidence viewer and separate MCP server.

Changes since 0.3.5:

• HEIC and camera RAW previews and picture indexing, with larger hover previews and image metadata.
• Paste pictures or documents into the AI search box and refer to them in scene, object, or document-content queries.
• Persistent literal text search and continued evidence browsing during indexing and AI searches.
• Separate picture-description model setting, defaulting to qwen3-vl:2b-instruct, and four concurrent picture requests. Existing saved model choices are retained.
• Bounded image preparation, duplicate reuse, optional request timing diagnostics, and picture-model benchmarks.
• Improved structured Gemma search requests to avoid affected Ollama draft-model runner crashes.
• Optional SigLIP 2 categories and visual search through a separately deployed service; disabled by default, with controls hidden when disabled.
• Per-file AI and text indexing status, plus recreation of a deleted case database so evidence can be reprocessed.
• Optional OvisOCR2 integration for picture and document text extraction; model weights and configuration are installed separately.

Download desktop for the graphical viewer or mcp for the Model Context Protocol server. Extract the complete archive and verify its SHA-256 checksum. Packages include .NET, evidence readers, license notices, and a file-hash inventory in BUILD-INFO.json.

Windows x64 requires Windows 10 or later. Windows ARM64 requires Windows 11 and x64 subprocess emulation; the ARM64 packages are cross-builds without runtime testing on ARM64 hardware. macOS ARM64 requires macOS 14 or later and is ad-hoc signed, not notarized. Linux x64 uses the Ubuntu 22.04/glibc 2.35 baseline. Linux ARM64 and macOS x64 packages are not included.

Ollama and model weights are installed separately, locally or on a remote server. Default AI setup uses nomic-embed-text, gemma4:12b, and qwen3-vl:2b-instruct. Ollama's OLLAMA_NUM_PARALLEL setting controls server-side inference separately from the desktop's request concurrency.

Public binary downloads exclude application source and private obfuscation maps. Dependency corresponding sources and rebuild materials are distributed separately. Each package records its source revision and validation status.

Dependency sources for 0.3.9

Corresponding dependency sources, notices, pinned requirements, reader bridges and rebuild materials for Forensic Evidence 0.3.9 on Windows x64, Linux x64 and macOS ARM64. Includes the native EWF, APFS, PST and BitLocker source inputs used by the release builds, EDB reader grammar notices and per-platform CI provenance. Application source, private protection maps, credentials, evidence and model weights are excluded. Preserve the included licenses and replacement/debugging rights.

Forensic Evidence 0.3.8 dependency sources

Corresponding native dependency sources, notices, provenance and rebuild materials for the Forensic Evidence 0.3.8 Windows x64 release.

Includes the exact libewf, zlib, bzip2, vstools and sqlite-vec inputs, plus libfsapfs-python 20260921 (APFS) and libpff-python 20260926 (PST) source archives. Reader bridges, pinned build requirements, PyInstaller specs, build/notice scripts and required tests are included so the separate readers can be rebuilt and replaced without application source.

Source archives and reader build materials are checked against the release CI inventories. The manifest records hashes, the application revision and current Windows build provenance. Older build examples are labeled as historical in the included README. Preserve the included notices and the LGPL modification, replacement and debugging rights. Application source, credentials, evidence and model weights are excluded.