Skip to content

@bcarrier bcarrier released this May 1, 2020 · 325 commits to develop since this release


  • Removed framework project. Use Autopsy instead if you need an analysis framework.
  • Various fixes from Google-based fuzzing.
  • Ensure all reads (even big ones) are sector aligned when reading from Windows device.
  • Ensure all command line tools support new pool command line arguments.
  • Create virtual files for APFS unallocated space
  • HFS fix to display type


  • More artifact helper methods
  • More artifacts and attributes for drones and GPS coordinates
  • Updated TimelineManager to insert GPS artifacts into events table
Assets 7
Jan 28, 2020
4.8.0 with build/packaging fixes

@bcarrier bcarrier released this Jan 24, 2020 · 573 commits to develop since this release

[NOTE: The .tar.gz file was updated after the initial release to fix some compiler errors related to maven and APFS on OS X. No logic changes were made though. Hashes are at the bottom of this note]


  • Pool layer was added to support APFS. NOTE: API is likely to change.
  • Limited APFS support added in libtsk and some of the command line tools.
    -- Encryption support is not complete.
    -- Black Bag Technologies submitted the initial PR. Basis Technology did some minor refactoring.
  • Refactoring and minor fixes to logical imager
  • Various bug fixes from Google fuzzing efforts and Jonathan B from Afarsec
  • Fixed infinite NTFS loop from cyclical attribute lists. Reported by X.
  • File system bug fixes from uckelman-sf on github


  • DB schema was updated to support pools
  • Added concept of JSON in Blackboard Attributes
  • Schema supports cascading deletes to enable data source deletion


  • Added Pool class and associated infrastructure
  • Added methods to support deleting data sources from database
  • Removed JavaFX as a dependency by refactoring the recently introduced timeline filtering classes.
  • Added attachment support to the blackboard helper package.

Hash of .tar.gz that would not compile on all systems: b5c081eb2cc92d2e56b8c470de37f890
Hash of fixed version: c7f9431bceae9b421b337d3c44af4ea9

Assets 7

@bcarrier bcarrier released this Oct 14, 2019 · 977 commits to develop since this release


  • DB schema was expanded to store tsk_events and related tables. Time-based data is automatically added when files and artifacts are created. Used by Autopsy timeline.
  • Logical Imager can save files as individual files instead of in VHD (saves space).
  • Logical imager produces log of results
  • Logical Imager refactor
  • Removed PRIuOFF and other macros that caused problems with signed/unsigned printing. For example, TSK_OFF_T is a signed value and PRIuOFF would cause problems as it printed a negative number as a big positive number.


  • Travis and Debian package use OpenJDK instead of OracleJDK
  • New Blackboard Helper packages (blackboardutils) to make it easier to make artifacts.
  • Blackboard scope was expanded, including the new postArtifact() method that adds event data to database and broadcasts an event to listeners.
  • SleuthkitCase now has an EventBus for database-related events.
  • New TimelineManager and associated filter classes to support new events table
Assets 7

@bcarrier bcarrier released this Aug 2, 2019 · 1539 commits to develop since this release

C/C++ Code:

  • First release of new logical imager tool
  • VHD image writer fixes for out of space scenarios


  • Expand Communications Manager API
  • Performance improvement for SleuthkitCase.addLocalFile()
Assets 6

@bcarrier bcarrier released this Apr 26, 2019 · 1819 commits to develop since this release

C/C++ Code:

  • Acquisition details are set in DB for E01 files
  • Fix NTFS decompression issue (from Joe Sylve)
  • Image reading fix when cache fails (Joe Sylve)
  • Fix HFS+ issue with large catalog files (Joe Sylve)
  • Fix free memory issue in srch_strings (Derrick Karpo)


  • Fix so that local files can be relative
  • More Blackboard artifacts and attributes for web data
  • Added methods to CaseDbManager to enable checking for and modifying tables.
  • APIs to get and set acquisition details
  • Added methods to add volume and file systems to database
  • Added method to add LayoutFile for allocated files
  • Changed handling of JNI handles to better support multiple cases
Assets 7

@bcarrier bcarrier released this Jan 15, 2019 · 1988 commits to develop since this release

C/C++ Code:

  • HFS boundary check fix

Java Code:

  • New artifacts and attributes defined
  • Fixed bug in SleuthkitCase.getContentById() for data sources
  • Fixed bug in that could allow reading past end of file

Case Database Schema

  • New fields for hash values and acquisition details in case database
  • Store "created schema version" in case database
Assets 7

@bcarrier bcarrier released this Nov 10, 2018 · 2065 commits to develop since this release

This release has no changes to the command line tools or C/C++ libraries. It is being done only to support the Autopsy 4.9.1 release.

Java Code:

  • Increase max statements in database to prevent errors under load
  • Have a max timeout for SQLite retries
Assets 7

@bcarrier bcarrier released this Oct 15, 2018 · 2070 commits to develop since this release

C/C++ Code:

  • Hashdb bug fixes for corrupt indexes and 0 hashes
  • New code for testing power of number in ExtX code

Java Code:

  • New class that allows generic database access
  • New methods that check for duplicate artifacts
  • Added caches for frequently used content

Database Schema:

  • Added Examiner table
  • Tags are now associated with Examiners
  • Changed parent_path for logical files to be consistent with FS files.
Assets 7

@bcarrier bcarrier released this Aug 8, 2018 · 2181 commits to develop since this release

C/C++ Code:

  • Various compiler warning fixes
  • Added small delay into image writer to not starve other threads


  • Added more locking to ensure that handles were not closed while other threads were using them.
  • Added APIs to support more queries by data source
  • Added memory-based caching when detecting if an object has children or not.
Assets 7
You can’t perform that action at this time.