Repository navigation
Forensic Evidence 0.3.9
Release 0.3.9
This release adds local disk acquisition to the existing desktop application on
Windows x64, Linux x64 and macOS ARM64. Use Acquire → Acquire PC evidence…
and choose RAW IMG, compressed E01 or compressed physical AFF4. Collection uses
a read-only source handle and a separate administrator-approved helper. Choose
an existing destination folder on another physical disk. Completed images pass
SHA-256 read-back verification; cancelled or failed collections retain a manifest
and clearly marked partial output. Windows additionally supports physical-memory
capture using the bundled, checksum-pinned signed WinPmem driver. Linux and macOS
memory capture are unavailable. Actual driver compatibility and administrator
approval depend on the host's security policy.
Windows packages include a separate read-only BitLocker recovery-key reader.
Tools → Unlock BitLocker… accepts a 48-digit recovery key for a session-only
decrypted view. Physical acquisition retains encryption; E01/AFF4 compression
warnings are advisory. The application does not persist recovery keys.
FileVault and Apple hardware encryption can limit recovery from a macOS image;
macOS acquisition does not unlock or decrypt FileVault.
Email browsing includes formatted PST/OST messages and Exchange 2013+ EDB
mailboxes. Double-click a nested PST, OST or EDB in a directory or readable evidence
container to drill down. Evidence processing can index supported contained email
text for AI search. EDB support is experimental and depends on the database state
and schema; a complete mailbox recovery is not guaranteed.
Read-only Windows evidence volumes use the separately installed official Dokany
runtime. Btrfs filesystem browsing is supported by the experimental filesystem parser.
NTFS deleted-file recovery includes MFT scanning; the previous 500,000-record and
512 MiB default scan ceilings have been removed. Explicit limits and cancellation
remain available. Deleted-file bytes may be overwritten, zeroed or unavailable.
File, Case, Acquire, View, Tools and Help menus organize the desktop actions.
The release contains a signed Windows x64 desktop MSI and portable Desktop/MCP
archives, Linux x64 Desktop/MCP archives, and macOS ARM64 Desktop/MCP app bundles.
Windows application hosts, managed application assemblies and the MSI are Authenticode signed by BBSOFT LLC;
the unmodified WinPmem driver retains its upstream signature. macOS bundles are
ad-hoc signed and are not Developer ID signed or notarized. No Linux ARM64,
Windows ARM64 or Intel Mac packages are published in this release.
Acquisition is experimental: live disks are read over time without an atomic
snapshot, and verification confirms the saved stream rather than a second source
read. Disposable native Linux/macOS disk-image tests and protected-build tests
cover known bytes and all three output formats. Real hardware, administrator
prompts, memory-driver capture and installer upgrade/uninstall execution require
separate validation on the intended host.
SHA-256 sidecars and an aggregate checksum file accompany the downloads.
Corresponding dependency sources, notices and rebuild materials are published
separately under dependencies-v0.3.9. Application source, test evidence, AI model
weights and private protection maps are excluded from public binary packages.