Forensic Evidence 0.3.12

Release 0.3.12

This release adds Internet artifacts and recorded locations. Scan Chromium/Edge,
Firefox and Safari visit history, Chromium Simple Cache, photo EXIF GPS and
supported Google Timeline JSON exports. Filter records, inspect their source
files, export provenance as JSON and display recorded locations together on a map.
Cached responses can contain useful text, but cache presence does not prove a visit
or authorship. IndexedDB, LevelDB and private mobile location databases are not
parsed in this release.

Scans default to user profiles and support editable folder exclusions, including
system and package trees. Progress shows discovery and parsing activity, candidate
counts and partial results. Live updates preserve table scrolling and selection;
text filtering runs in the background. Cancellation supports confirmation and a
saved preference. Saved case folders retain per-file checkpoints and derived
records in SQLite so interrupted work can resume without reparsing completed files.

Saved Internet artifacts, including partial scans, can be indexed for AI search.
Visited-site searches use recorded visit timestamps and exclude cache records.
The AI interprets date conditions; the application validates and applies them
before ranking results. Relative periods use the application's captured UTC clock,
with visible bounds and reference time. Search returns a ranked shortlist rather
than an exhaustive visit inventory; the Internet tab provides date filters for
reviewing all saved rows. Index again after further scan progress to include new
records while reusing unchanged embeddings.

The evidence browser adds editable path breadcrumbs: paste a folder path to
navigate, or a file path to open its parent and select the file. Row context menus
offer appropriate actions, including Unlock BitLocker for encrypted volumes.

Windows read-only mounting now includes BitLocker volumes unlocked in the current
viewer session. Unlock the desired volumes, then choose Read-only volume and mount
the selected evidence or all open sources. Windows Explorer can browse decrypted
files through Dokany. Recovery passwords remain in session memory and travel to
the isolated mount helper through its private pipe; they are not saved in cases or
process arguments. Original evidence remains encrypted and unchanged. Closing
evidence or reopening a case requires unlocking again. Dokany 2.x must be installed
separately; this release does not install its driver.

Packages include signed Windows x64 Desktop and MCP archives and a desktop MSI,
Linux x64 Desktop and MCP archives, and macOS ARM64 Desktop and MCP app bundles.
Linux requires Ubuntu 22.04 or a compatible environment with glibc 2.35 or later;
macOS requires macOS 14 or later. Windows application files and the MSI are
Authenticode signed by BBSOFT LLC. macOS bundles are ad-hoc signed and are not
Developer ID signed or notarized.

SHA-256 sidecars and an aggregate checksum file accompany the downloads.
Dependency sources and rebuild materials
are published separately. Application source, test evidence, AI model weights,
signing keys and private protection maps are excluded from public binary packages.