OpenForensic v2.0.3 — High-Precision Modern UI

OpenForensic v2.0.3 — High-Precision Modern UI

We are excited to announce OpenForensic v2.0.3, featuring a complete visual overhaul of the desktop interface to our "High-Precision Modern" Light Theme, alongside enterprise-grade features including a pure-Rust PGP digital chain of custody, headless CLI automation, SIEM streaming, and a dual-loader plugin architecture.

---

🎨 Complete Frontend Redesign (Stitch Design System)

The desktop application has been rebuilt from the ground up to prioritize visual clarity, high data density, and effortless forensic navigation:

• High-Precision Modern Light Theme: Replaced the dark glassmorphism theme with clean, high-contrast off-white surfaces (#f8f9fa), primary navy accents (#00488d), and subtle 1px structural borders (#c2c6d4) designed for long investigative sessions under bright laboratory lighting.
• Dedicated Left Sidebar Navigation (256px): Moved from horizontal top tabs to a persistent sidebar featuring Material Symbols icons, real-time admin privilege status, an active case tracking badge, and an IST clock display.
• Top App Bar (56px): Added a streamlined top navigation bar featuring global search, quick-action shortcuts, and prominent Export Log and Start Acquisition action buttons.
• Typography & Aesthetics: Integrated Inter for clean UI hierarchy and JetBrains Mono for sector addresses, file hashes, and terminal logs.
• Zero-Regression Architecture: Rewrote index.html and style.css using Tailwind CSS while preserving 100% of underlying DOM element IDs, event bindings, and Tauri IPC event listeners.

---

🔐 PGP Provenance & Digital Chain of Custody

Ensure court-admissible evidence integrity with embedded cryptographic signing:

• Pure-Rust Sequoia PGP Engine: Integrated sequoia-openpgp directly into the Tauri backend for zero-dependency, memory-safe cryptographic key generation, signing, and verification.
• Automated Evidence Signing: Automatically generates detached .asc PGP signatures for all acquired disk images (.dd, .e01, .aff), forensic manifests, and exported HTML/PDF case reports.
• One-Click Verification UI: Dedicated PGP Provenance tab allowing examiners to instantly verify detached signatures and inspect signer identity certificates (Examiner Name <email@dfir.local>) and RSA/Ed25519 fingerprints.

---

⚡ Headless CLI & Remote Automation Mode (--cli)

Run OpenForensic on headless servers, AWS EC2 Linux triage nodes, or remote SSH sessions without launching a GUI display server:

• Comprehensive Subcommand Suite:
  • openforensic list-devices: Enumerate physical block storage drives, geometry, and S/N.
  • openforensic list-volumes: List logical OS volumes, mount points, and filesystem types.
  • openforensic acquire: Execute physical or logical imaging with multi-threaded compression (zstd, gzip) and simultaneous 4-algorithm hashing (MD5, SHA-1, SHA-256, SHA-512).
  • openforensic triage: Execute rapid live system triage (volatile memory, network sockets, browser history, EVTX logs).
  • openforensic live: Capture physical RAM (winpmem) and locked files ($MFT, Registry hives) via Windows VSS snapshots.
  • openforensic ram: Execute Volatility 3 memory profiles with AbuseIPDB and VirusTotal IOC reputation enrichment.
• Win32 Console Restoration: Automatically attaches to the parent console (AttachConsole) on Windows to ensure seamless stdout/stderr pipe redirection in PowerShell and bash scripts.

---

🧩 Extensible Plugin Architecture

Transform OpenForensic into a modular digital forensics platform:

• OpenForensicPlugin Trait: Standardized lifecycle hooks (pre_acquisition, on_block, post_acquisition) allowing custom Rust inspection logic to stream across disk sectors in real time.
• Dual-Loader Engine:
  • Native Shared Libraries: Load compiled .so, .dll, or .dylib extensions via FFI symbols (libloading).
  • WebAssembly (WASM) Sandbox: Execute untrusted community forensic modules inside memory-isolated sandboxes powered by wasmtime.
• Report Integration: Custom plugin findings and IOC alerts are automatically embedded into generated PDF, HTML, and text case reports.

---

🛠️ Performance & Core Storage Enhancements

• Asynchronous Tokio MPSC Pipeline: Separates disk reading, hashing, scanning (YARA-X / keywords), and file writing into parallel non-blocking worker threads.
• Write-Blocking Enforcement: Hardware and OS-level write-blocking across Windows (GENERIC_READ), Linux (BLKROSET), and macOS (/dev/rdiskX).
• Acquisition Checkpointing: Automatically saves sector boundaries during multi-terabyte drive imaging, enabling pause and resume without data corruption after unexpected power loss or drive disconnection.

---

📦 Installation & Checksums

Windows

# Download and install via MSI or standalone executable
openforensic.exe

OpenForensic v1.0.0-alpha

OpenForensic : Forensic Software for Systems & Disk

1. Disk Imaging & Acquisition

• Physical sector-by-sector disk imaging
• Logical file-level acquisition
• Output formats: Raw (.dd), Expert Witness Format (.e01), Advanced Forensic Format (.aff)
• Automatic sparse zero-block skipping
• Multi-threaded compression: zstd, gzip
• Configurable block size (KB)
• Read-verification pass after imaging
• Acquisition checkpointing — pause/resume long imaging jobs without corruption
• Software write-blocking enforced at OS kernel boundary:
  • Windows: CreateFileW with GENERIC_READ only
  • Linux: BLKROSET / O_DIRECT
  • macOS: /dev/rdiskX read-only device access

2. Live & Volatile Acquisition

• Volume Shadow Copy Service (VSS) live acquisition (Windows) — zero-downtime snapshotting
• OS-locked artifact capture while system is running:
  • NTFS $MFT
  • Registry hives: SAM, SYSTEM, SECURITY, SOFTWARE
  • Windows Event Logs (EVTX)
• Physical RAM capture via winpmem (Windows), avml (Linux), LiME kernel modules (Linux, x86_64/aarch64)
• Auto-cleanup of VSS snapshots post-acquisition
• Optional VSS-backed physical image creation

3. Rapid System Triage

• One-click volatile state extraction:
  • Running processes
  • Network connections/sockets
  • Loaded kernel modules
• Chrome/Edge browser history database collection
• EVTX / syslog event record collection
• Skip-flags for selective collection (--no-volatile, --no-registry, --no-browsers, --no-eventlogs)

4. Headless CLI Mode

Full clap-based CLI (--cli flag) for scripted/SOAR/EC2 use, independent of GUI:

Command	Purpose
list-devices	Enumerate physical block devices
list-volumes	Enumerate logical OS volumes/mount points
acquire	Physical/logical imaging with format, compression, hash, YARA, keyword options
triage	Rapid live system collection with optional SIEM export
live	VSS live acquisition + RAM capture + locked-file collection
pgp-keygen	Generate RSA-4096/Ed25519 signing keypair
pgp-sign	Create detached signature for evidence/manifest
pgp-verify	Verify detached signature against evidence

Windows console auto-attach (AttachConsole) for clean stdin/stdout/stderr when invoked from a terminal.

5. Memory Forensics

• Native Volatility 3 integration (subprocess orchestration + real-time log streaming)
• Supported dump formats: .raw, .vmem, .dmp
• Cross-OS profile support: Windows, Linux, macOS
• Profiles: pslist, netstat, cmdline, filescan, malfind, printkey, etc.
• Threat intelligence enrichment during analysis:
  • AbuseIPDB IP reputation scoring
  • VirusTotal file/process hash lookups

6. Encryption Detection & Key Extraction

• Detection during acquisition (keep in OpenForensic):
  • BitLocker (-FVE-FS-)
  • LUKS v1 / v2
  • Apple FileVault (APFS/CoreStorage)
  • Android FBE (Ext4/F2FS fscrypt)

7. Timeline Generation

• Chronological artifact reconstruction from an already-acquired disk image
• Parses NTFS $MFT, $LogFile, Ext4 journal timestamps
• Exports unified master timeline as CSV / JSON

8. YARA & Keyword Scanning

• Pure-Rust YARA-X engine
• Real-time pattern matching against custom .yar rulesets
• Simultaneous regex keyword searching
• Runs inline in the broadcast pipeline during disk/memory streaming (acquisition-time alerting, not a separate analysis pass)

9. SIEM & SOC Integration

• Splunk HTTP Event Collector (HEC): structured JSON over HTTPS, HEC bearer token auth
• Wazuh Agent Socket / Syslog: TCP/UDP streaming (default port 1514) or local log queue append
• One-click IR triage: auto-enable SIEM emission during acquisition/triage without slowing collection
• Configurable index/sourcetype/tag, endpoint, and transport type
• Connection test + persisted SIEM config

10. Extensible Plugin Platform

• Native shared library loading: .so / .dll / .dylib via libloading + FFI symbol (_openforensic_plugin_create)
• Sandboxed WebAssembly modules via wasmtime (runtime + cranelift + component-model)
• Standardized lifecycle hooks:
  • pre_acquisition — inspect case metadata, volume geometry, init resources
  • on_block — invoked per data chunk, non-blocking dispatch to workers
  • post_acquisition — return custom metrics/hashes embedded into reports
• Plugin management commands: load, list, unload, scan-directory

11. Cryptographic Hashing

• Single-pass, simultaneous 4-algorithm hashing: MD5, SHA-1, SHA-256, SHA-512
• Computed in the same read pass as imaging (no double I/O)
• Checkpointed alongside acquisition state

12. PGP Cryptographic Manifests

• Built-in RFC 4880 OpenPGP engine (no GnuPG dependency) via sequoia-openpgp
• Keypair generation: RSA-4096, Ed25519
• Detached tamper-evident signatures (.manifest / .sig)
• Manifest contents: case metadata, device geometry, SHA-256/SHA-512 digests
• One-click verification: re-hashes evidence, validates against examiner public key

13. Case Management & Reporting

• SQLite case database: evidence tags, investigator notes, device metadata, hashes
• Historical acquisition job review
• Court-admissible report export: HTML and PDF (printpdf)
• Embedded cryptographic verification tables in reports

14. Platform Support

OS	Minimum Version	Privilege Required
Windows	(per README)	Administrator (UAC elevation)
Linux	—	root (sudo)
macOS	11.0 Big Sur+	root + Full Disk Access

Minimum hardware: 4+ cores (parallel SHA-512/YARA compilation), 4GB RAM (8GB+ for Volatility workloads — drops once Analysis Suite split happens), NVMe/SSD destination recommended.

---

Summary: Post-Split Feature Set

OpenForensic 3.0.0 (acquisition-only) retains: Disk imaging, live/VSS acquisition, RAM capture, triage collection, inline YARA/keyword scanning, SIEM streaming, plugin platform, 4-algorithm hashing, PGP manifests, case management/reporting, CLI (minus ram subcommand), encryption detection (not key extraction).

Migrates to Analysis Suite: Volatility 3 integration, AbuseIPDB/VirusTotal enrichment, RAM master-key extraction, timeline reconstruction, Triage SQL Workbench.