Skip to content

Autopsy 4.9.0
Compare
Choose a tag to compare
@bcarrier bcarrier released this 15 Oct 12:33
· 15176 commits to develop since this release
autopsy-4.9.0
This tag was signed with the committer’s verified signature.
bcarrier Brian Carrier
GPG key ID: 38AD602EC7454C8B
Learn about vigilant mode.
e032ab6

New Features:

  • Removed data from table that are time intensive and can be found in content viewers (such as hash set hits)
  • Added ability to find common items (files, emails, etc.) between current case and past cases using the Central Repository.
  • Added ability to ignore common items that exist in a large number of cases by using Central Repository data.
  • Data is validated and normalized before being entered into the Central Repository.
  • Allow users to specify that an ad-hoc keyword search should not be saved to database
  • New “Annotations” content viewer that shows all tags and comments associated with an item
  • Added 2 icons to the table to show the item’s score (if it is notable or suspicious) and if it has a comment.
  • Added column to the table to show previous number of occurrences.
  • Tags are now associated with the user (in a multi-user environment) and you can hide other people’s tags
  • New Display options area that unifies various new settings.
  • Hash sets can be copied into the user’s config folder (AppData), which makes it easier to run Autopsy from a Live Triage USB and not care about what drive letter it gets.
  • Image Gallery stores its groups and seen status in Case DB instead of its own.
  • Image Gallery works better in multi-user setups and reloads the database when other nodes add data sources.
  • Image Gallery saves which user saw a group and gives user option of seeing only their unseen groups or all unseen groups.
  • Saves last export location and pre-populates that in the file picker
  • Provide feedback about why some right click options are disabled (ingest is running, not file content, etc.)

Bug Fixes:

  • Substring keyword search is more accurate (now uses regular expression)
  • New text extractor for SQLite that better deals with full text search tables
  • Better deal with Unicode text files that do not have Byte Order Marker
  • Embedded file extractor module is now faster because it uses a different 7ZIP API.
  • Fixed various HTML report bugs
  • Duplicate hash set hits are not created when you run the Hash Ingest Module twice.
  • Auto ingest (in Experimental) scan times of input folders is faster.
Assets 7