Forensic Evidence 0.3.11

Release 0.3.11

This release adds mobile acquisition and examination, with iPhone USB backups
on Windows and Android USB logical collection on Windows, Linux and macOS.
The mobile dialog reports transfer activity, collected bytes, verification
progress and estimated verification time when sufficient measurements exist.
Canceled or failed acquisitions retain their partial output and status.

iPhone backup examination includes messages, contacts, call history when present,
and a browsable backup file tree. Backup folders show recursive file counts;
empty folders can be hidden and name/path searches cover all folders beneath the
current location. Captured payload sizes that differ from the backup manifest
produce examination warnings without padding or truncating the captured files.
Apple device drivers/services are required for USB acquisition on Windows;
the Apple Devices window does not need to remain open.

Android collection copies accessible shared files and device information using
an installed Android SDK Platform-Tools adb. An optional, visibly installed
phone app collects messages, contacts and call history after the user grants
permissions and starts the export. It requires Android 8 or newer and does not
root the device or access private app storage. Provider-exposed SMS/MMS text
and message copies are preserved, including streamed text parts. RCS coverage
depends on what the messaging app exposes through those providers; a complete
RCS archive is not guaranteed.

The release bundles collector 0.2.0 with a persistent production signing
certificate. If the development collector is installed on your test phone,
uninstall it before installing this release's collector because its signing
certificate differs. Uninstalling removes the phone-side app's exports and
permissions; collections already saved on your computer remain available.

The evidence browser adds clickable path breadcrumbs and Back/Forward navigation
that restores previously visited folders and file selections. The exFAT reader
also accepts reserved attribute bits encountered in real macOS evidence.

Packages include signed Windows x64 Desktop and MCP portable archives and a
desktop MSI, Linux x64 Desktop and MCP archives, and macOS ARM64 Desktop and MCP
app bundles. Linux requires Ubuntu 22.04 or a compatible environment with glibc
2.35 or later; macOS requires macOS 14 or later. Windows application files and
the MSI are Authenticode signed by BBSOFT LLC. macOS bundles are ad-hoc signed
and are not Developer ID signed or notarized. Install the macOS app in Applications
and grant Full Disk Access to that installed copy before disk acquisition.

Acquisition remains experimental. Logical mobile collection includes only data
made available by the device and granted permissions. Completed output receives
SHA-256 read-back verification. Supported messages and files can be explicitly
processed for text/AI search; unavailable data cannot be reconstructed here.

SHA-256 sidecars and an aggregate checksum file accompany the downloads.
Dependency sources and rebuild materials
are published separately. Application source, test evidence, AI model weights,
signing keys and private protection maps are excluded from public binary packages.