Skip to content

v2.0.3 — Compliance Hardening (Chain of Custody · Digital Signature · WeChat DB Disclosure)

Choose a tag to compare

View all tags
@serenashenn3-art serenashenn3-art released this 01 Aug 19:12
· 25 commits to main since this release
v2.0.3
e68e795

v2.0.3 — Compliance Hardening (Chain of Custody · Digital Signature · WeChat DB Disclosure)

v2.0.3 — 2026-08-01

Highlights

  • 🔒 Chain of Custody — full ISO/IEC 27037:2012 template (case_id, evidence_id, write_blocking, transfer_chain, storage, disposal)
  • ✍️ Digital signature — HMAC-SHA256 (built-in) + RSA-PSS-SHA256 (optional, for judicial forensics)
  • 📋 Compliance framework — references ISO 27037 / 27042 / RFC 3227 / NIST SP 800-86
  • 📂 WeChat path table — macOS sandbox full path, iOS UDID note, Android 11+ Scoped Storage permission, EnMicroMsg.db SQLCipher disclosure
  • ⚖️ License clarification — MIT scope (code grant) separated from end-use (three independent layers)

What changed

File / Area Change
wechat_forensic/security.py New — Chain of Custody template, HMAC/RSA sign, write-blocking guide
wechat_forensic/report.py Rewritten — case_id / evidence_id params, compliance section, disclaimer section
wechat_forensic/config.py Full macOS sandbox path; iOS UDID note; Android 11+ permissions; EnMicroMsg.db SQLCipher key derivation
wechat_forensic/cli.py New flags: --case-id / --evidence-id / --sign
README.md Restructured into 5 sections (Quick Start / Install / Usage / Output / Limits)
LICENSE "SCOPE OF LICENSE" section — MIT code grant + end-use separation
CHANGELOG.md v2.0.3 entry
tests/ 29 cases, covering new report schema / signature / path table / config

Compliance

  • ISO/IEC 27037:2012 — Identification, collection, acquisition, preservation of digital evidence
  • ISO/IEC 27042:2015 — Analysis and interpretation of digital evidence
  • RFC 3227 — IETF best practices (Use copies, avoid contamination, record everything)
  • NIST SP 800-86 — Forensic process integration

Compatibility

  • CLI usage: 100% backward compatible (all new flags have defaults)
  • Report JSON schema: v2.0.1 → v2.0.3 BREAKING (tool moved from string to dict — readers must update from data["tool"] to data["tool"]["name"])
  • sign_report default HMAC mode (no new dependency); RSA mode requires pip install cryptography

Verification

pip install -e ".[all]"
pytest tests/ -q                  # 29 passed
wechat-forensic --version         # wechat-forensic 2.0.3

Legal

  • MIT license (code grant) — unchanged
  • end-use governed by AGENTS.md + local law — unchanged
  • Never use on unauthorized devices.

Full Changelog: https://github.com/serenashenn3-art/wechat-forensic-pro/blob/main/CHANGELOG.md

✨ Generated via GitHub API · 2026-08-02

Assets 2
Loading