Forensic Evidence 0.3.10

Release 0.3.10

This maintenance release fixes macOS disk acquisition hanging after administrator
approval. The helper restores child-process exit notifications inherited from
the approval launcher, allowing completed diskutil commands to return normally.
Regression checks cover normal, blocked and ignored SIGCHLD states.

Acquisition now shows when administrator approval has completed and source and
destination checks are running. Startup failures and metadata-command timeouts
include more useful context. The acquisition form and scrollable status text
reserve space on the right so the vertical scrollbar does not overlap controls.
The macOS administrator prompt identifies the app as Forensic Evidence.

Packages include signed Windows x64 Desktop and MCP portable archives and a
desktop MSI, Linux x64 Desktop and MCP archives, and macOS ARM64 Desktop and MCP
app bundles. Linux requires Ubuntu 22.04 or a compatible environment with glibc
2.35 or later; macOS requires macOS 14 or later. Windows application files and
the MSI are Authenticode signed by BBSOFT LLC. macOS bundles are ad-hoc signed
and are not Developer ID signed or notarized.

Install the macOS app in Applications and grant Full Disk Access to that installed
copy before disk acquisition. Replacing an ad-hoc signed build can require
removing and re-adding its Full Disk Access entry. Acquisition remains experimental;
live acquisition does not provide an atomic snapshot, and completed output is
verified against the collected stream using SHA-256 read-back verification.

SHA-256 sidecars and an aggregate checksum file accompany the downloads.
Dependency sources and rebuild materials
are published separately. Application source, test evidence, AI model weights
and private protection maps are excluded from public binary packages.