Releases · sujayadkesar/connected-phone-forensics

Repository navigation

Release list

Latest

github-actions released this 21 Oct 03:05

v0.4.1

bb4098a

No changes to the program since 0.3.3; this release starts the 0.4 series. From 0.3.2 or
earlier, it brings 0.3.3's fix to the PDF summary: drawn phones now look the same in Chrome,
Edge and other PDF viewers built on PDFium.

Downloads

File	What it is
`ConnectedPhoneForensics-0.4.1-windows-x64.exe`	Desktop app for Windows 10/11. Download and run; nothing to install.
`cpf-0.4.1-windows-x64.exe`	Command-line tool for Windows (`cpf scan`, `cpf live`, `cpf demo`, ...).
`ConnectedPhoneForensics-0.4.1-windows-x64-portable.zip`	Both programs in one folder, for a USB drive and live acquisition: runs in place (nothing unpacked to the examined computer's temp folder) and keeps its settings next to it.
`connected_phone_forensics-0.4.1-py3-none-any.whl`	Python package (the same as `pip install connected-phone-forensics`) for Windows, macOS and Linux.
`connected_phone_forensics-0.4.1.tar.gz`	Source archive.

The Windows executables are not code-signed yet, so SmartScreen may show Windows protected your PC:
choose More info → Run anyway. Verify the download first against the checksums below
(certutil -hashfile <file> SHA256 on Windows, sha256sum <file> elsewhere).

e4361bb2fff7fa12d9476a4c61ef4957a25b0f96ebe4ac5b4614f7ca05415934  ConnectedPhoneForensics-0.4.1-windows-x64-portable.zip
ebd01f4d7e115e690bde794e42a30250f029dddf376a33849aa77570f902a85e  ConnectedPhoneForensics-0.4.1-windows-x64.exe
0abcb1e63bc5f0c962dc346bdc5a556dd240b172ae2852157bbcb1936d63fd5d  connected_phone_forensics-0.4.1-py3-none-any.whl
e1c241d39d61bd68fa5dae54db2bfbf5787ea0e323377d6a098f28026a4dd3d3  connected_phone_forensics-0.4.1.tar.gz
ce6f16671b83529cb3fa32d99045fc0f848d946a37324151c68edb2dce412929  cpf-0.4.1-windows-x64.exe

Assets 8

Connected Phone Forensics 0.3.3

github-actions released this 21 Oct 02:56

v0.3.3

aedfc36

Fixed

In Chrome, Edge and other PDF viewers built on PDFium, the PDF summary showed every drawn phone
with a blank white screen, and a recovered Phone Link wallpaper under solid black: they paint a
gradient's transparency as solid colour. A phone's screen is now drawn into the PDF as one
opaque image, so it looks the same in every viewer. The cover's soft circles no longer spill
below its band.

Downloads

File	What it is
`ConnectedPhoneForensics-0.3.3-windows-x64.exe`	Desktop app for Windows 10/11. Download and run; nothing to install.
`cpf-0.3.3-windows-x64.exe`	Command-line tool for Windows (`cpf scan`, `cpf live`, `cpf demo`, ...).
`ConnectedPhoneForensics-0.3.3-windows-x64-portable.zip`	Both programs in one folder, for a USB drive and live acquisition: runs in place (nothing unpacked to the examined computer's temp folder) and keeps its settings next to it.
`connected_phone_forensics-0.3.3-py3-none-any.whl`	Python package (the same as `pip install connected-phone-forensics`) for Windows, macOS and Linux.
`connected_phone_forensics-0.3.3.tar.gz`	Source archive.

5f6fc1304a04f1795ff6043eaa72600a1d3629b3007c90ab4b77f7c21f20c63a  ConnectedPhoneForensics-0.3.3-windows-x64-portable.zip
319f328d31a033b322088f9094d7f7f0c432dd15ecaaa701e57798b04989edad  ConnectedPhoneForensics-0.3.3-windows-x64.exe
0de293bb57686da004cf7da873ee8dca6d46c2eec73778fa40d6011a93b79006  connected_phone_forensics-0.3.3-py3-none-any.whl
13bae49c4b86cbe6e0faa7ee8d5492422792c80f376f9f49b13f4c0c7cb6ad03  connected_phone_forensics-0.3.3.tar.gz
55e1cd36bc7fa64280588548bdcaf712ad4d81e4e768faf507006daa0f17abf2  cpf-0.3.3-windows-x64.exe

Assets 8

Connected Phone Forensics 0.3.2

github-actions released this 21 Oct 02:04

v0.3.2

d318f92

Fixed

On the Devices page, a hotspot network's Connections table cut off its First joined and
Last joined times (0.3.1 made those columns narrower). The time and access point columns are
now sized from the font, so a full timestamp and BSSID always fit.

Downloads

File	What it is
`ConnectedPhoneForensics-0.3.2-windows-x64.exe`	Desktop app for Windows 10/11. Download and run; nothing to install.
`cpf-0.3.2-windows-x64.exe`	Command-line tool for Windows (`cpf scan`, `cpf live`, `cpf demo`, ...).
`ConnectedPhoneForensics-0.3.2-windows-x64-portable.zip`	Both programs in one folder, for a USB drive and live acquisition: runs in place (nothing unpacked to the examined computer's temp folder) and keeps its settings next to it.
`connected_phone_forensics-0.3.2-py3-none-any.whl`	Python package (the same as `pip install connected-phone-forensics`) for Windows, macOS and Linux.
`connected_phone_forensics-0.3.2.tar.gz`	Source archive.

553263b210bd5e6e4c9a6f1e8397a931c38e385616e8d940969feffa825d8b27  ConnectedPhoneForensics-0.3.2-windows-x64-portable.zip
cd8273065b6c5eef0dc78eb146519f6fc03ec38c501eec1f2003288c057f0e4d  ConnectedPhoneForensics-0.3.2-windows-x64.exe
e5f39f107eeef20475b33a46ddb8f349f77e844607318f1f14ae6ac9d805bb5a  connected_phone_forensics-0.3.2-py3-none-any.whl
82e47ced114964242c1b262d02be4603188fd91e5c81d498ddb3da1d41e343ef  connected_phone_forensics-0.3.2.tar.gz
a06d3749ef52ea08877e9e6abb50bc53188cbdf1ca5cf4c8d380567fcb04703c  cpf-0.3.2-windows-x64.exe

Assets 8

Connected Phone Forensics 0.3.1

github-actions released this 20 Oct 17:09

v0.3.1

7a736b3

Changed

A hotspot network now lists one row per connection (each Windows profile, or Mac known network)
with its own name, how it was joined (Wi-Fi, or cable or Bluetooth) and its own times, instead
of one row per access point. One access point saved under several names (an iPhone's hotspot
takes the phone's name, so renaming the phone renames the network) shows those names and
explains them, in the app, the PDF summary, the workbook and report.html.

Fixed

A network Windows reached through a phone by cable or Bluetooth (USB tethering; NameType other
than Wi-Fi) was reported as a hotspot, and its generic Windows name ("Local Area Connection")
was taken for one of the phone's names. It is now reported as USB tethering, and the name is not
attached to the phone.
A DHCP lease whose network name Windows kept with a trailing space, or kept no name with, became
a row of its own; it is now attached to the connection it belongs to.

Downloads

File	What it is
`ConnectedPhoneForensics-0.3.1-windows-x64.exe`	Desktop app for Windows 10/11. Download and run; nothing to install.
`cpf-0.3.1-windows-x64.exe`	Command-line tool for Windows (`cpf scan`, `cpf live`, `cpf demo`, ...).
`ConnectedPhoneForensics-0.3.1-windows-x64-portable.zip`	Both programs in one folder, for a USB drive and live acquisition: runs in place (nothing unpacked to the examined computer's temp folder) and keeps its settings next to it.
`connected_phone_forensics-0.3.1-py3-none-any.whl`	Python package (the same as `pip install connected-phone-forensics`) for Windows, macOS and Linux.
`connected_phone_forensics-0.3.1.tar.gz`	Source archive.

48899e0a09cdc8acb1dc47f68b83d953f46a88e17dac4d428a68011545a2a94b  ConnectedPhoneForensics-0.3.1-windows-x64-portable.zip
4dfeb3f5e5538913a4591255149ba38958d5353f173ade63a22c352b01b0059b  ConnectedPhoneForensics-0.3.1-windows-x64.exe
caf2edbc345699773365efa4868d1e03383acfe86b0661776df6a69682da8d7e  connected_phone_forensics-0.3.1-py3-none-any.whl
99739aa43b49554f3a4e2ab2d20ccb3a44978818a6787f0baf96620b8c588def  connected_phone_forensics-0.3.1.tar.gz
c2b925b97865db14e41af4f36f79d5404c95177c8c17665428534ea30f0064f9  cpf-0.3.1-windows-x64.exe

Assets 8

Connected Phone Forensics 0.3.0

github-actions released this 20 Oct 16:04

v0.3.0

da706b5

Added

Save files, verified. On the Recovered data page, Save files copies photos, attachments,
contact pictures and app icons (the selected items, everything shown, a whole kind, or every file
in the case) into a new folder: byte for byte, hashed (SHA-256 and MD5) while written and read
back from the disk, compared with the hash taken when the scan extracted each file, marked
read-only, and given the time its record holds. manifest.csv, manifest.json,
SHA256SUMS.txt and a Read me describe every file: phone, record time, deleted or present, the
database and record it came from, and its hashes. Nothing is ever overwritten. From the command
line: cpf save-files.
Column filters, as in Excel, on every column of Recovered data and the Timeline: sort, a
condition (contains, does not contain, equals, begins or ends with, a regular expression, empty;
greater or less than for numbers; on, before or after for times) and a checklist of the values
(times grouped by day). Right-click a cell to show only or hide its value, copy it, or save the
selected items' files. The filters in force show as chips above the table, and exports carry
them in their title.
A status filter on Recovered data: present (live records), deleted and recovered, or with a
saved file. Tables and the photo grid allow selecting several items.
Contact photos and app icons: Phone Link's contact pictures and app icons are saved by the
scan and shown in the tables and the detail panel (initials when there is no picture), with the
recently used apps. A photo saved only as a thumbnail says so.
Hotspot networks. Phones the computer knew only as a Wi-Fi hotspot are grouped by network
name: Android and recent iPhones use a new random address each time the hotspot is switched on,
so one phone appears as several access points. Each network lists its access points with when
they were first and last joined, the Windows profile and the DHCP addresses: on the Devices page
(Hotspots), in the PDF summary, in the workbook (a Hotspots sheet) and in report.html.
Wi-Fi location lookup, on request. On a hotspot's page, or with cpf locate BSSID, ask
Apple's Wi-Fi location service where an access point was seen. Nothing is sent without
confirmation, randomised addresses are never sent, and every query and answer is logged in the
case folder (online-lookups.jsonl).
Guide page (F1): how the tool works, where phones leave traces, what is recovered and when it
is not, how to read the results, hotspots and locations, saving and reports, the limitations,
and every parser with how it has been tested.
Phones named the way people know them. Android model codes become marketing names (CPH2585
is a OnePlus 12R) from Google Play's device list; USB vendor IDs name the maker (from the Linux
USB ID repository); phone names inside hotspot and device names are recognised ("Redmi 9i",
"Galaxy S22 5G"); and a phone's own name ("Sujay's iPhone") is preferred over generic ones
("Localhost").
New scan opens with an animated banner. The Overview shows the case name with its reports, and
a tile and a list for phone hotspots. The Devices page separates phones, hotspots and other
devices, with an icon for each kind of connection.
THIRD-PARTY-NOTICES.md lists the components and data the tool is built on, and their license
texts ship with the programs and the package.

Changed

Case reference is now Case name (for example ACME-Incident-EmpID39323): it titles the
Overview, the reports and the output folder.
The sidebar has a larger logo, larger and bolder navigation, and a Help section.
PDF summary: count tiles fit five-digit numbers; phones known only as hotspots are a table per
network instead of a page each of unknown fields.
The demo case adds a phone known only by its hotspot, joined on three days with three random
addresses.

Fixed

Switching from the dark to the light theme after working in the app restyled only some icons:
widgets the pages had replaced stopped the change part-way. Widgets now unregister themselves
when they are deleted, and the style sheet is applied first.
Long device names wrap in the device list instead of being cut off.
On Linux with Python 3.10 or 3.11, the app and the PDF summary could abort after enough drawing
("deallocating None"): PySide6 6.12.0's Linux builds drop a reference in every call that sets a
pen, brush or font. That combination now installs PySide6 6.11, and a test watches for the leak.
Times read from files (pair records, KDE Connect and Phone Link folders, BlueZ, iPhone
Mirroring) are converted from exact nanoseconds, so a copy of the evidence gives the same
microsecond as the original.

Downloads

File	What it is
`ConnectedPhoneForensics-0.3.0-windows-x64.exe`	Desktop app for Windows 10/11. Download and run; nothing to install.
`cpf-0.3.0-windows-x64.exe`	Command-line tool for Windows (`cpf scan`, `cpf live`, `cpf demo`, ...).
`ConnectedPhoneForensics-0.3.0-windows-x64-portable.zip`	Both programs in one folder, for a USB drive and live acquisition: runs in place (nothing unpacked to the examined computer's temp folder) and keeps its settings next to it.
`connected_phone_forensics-0.3.0-py3-none-any.whl`	Python package (the same as `pip install connected-phone-forensics`) for Windows, macOS and Linux.
`connected_phone_forensics-0.3.0.tar.gz`	Source archive.

b35bd03ebe074e872143eaa1fabaedaa8afe54f9e350aa896dbd33cedce9cc09  ConnectedPhoneForensics-0.3.0-windows-x64-portable.zip
d4a81f2056c57b3883cf42190fb8c42a03a6ad2e06024900359b4224681a50e7  ConnectedPhoneForensics-0.3.0-windows-x64.exe
3a8a347eb9ab99bc88c6c7c7edfaaa64ac727a550b5900f811a9addf684ca496  connected_phone_forensics-0.3.0-py3-none-any.whl
5b9bb3ba586ec26df03dfb96de66100a91af435d25f6a91921c21cc0ef5b0bc3  connected_phone_forensics-0.3.0.tar.gz
0c062f01f485833f8847df35363a0447db36ccad519aa8b459bdd48b529fc47b  cpf-0.3.0-windows-x64.exe

Assets 8

Connected Phone Forensics 0.2.0

github-actions released this 20 Oct 03:56

v0.2.0

9ad691b

Added

Live acquisition of the Windows computer the tool runs on (cpf live, and This computer
(live) on the app's New scan page), for examining a computer on site. As administrator, the
registry hives Windows keeps locked (SYSTEM, SOFTWARE, the NTUSER.DAT of signed-in users) are
saved through the registry API (RegSaveKeyEx, as reg save does); every other file the parsers
read is copied with the backup privilege (so folder permissions cannot hide it), hashed while it
is read and given its original times. The copy is then scanned like any collection.
acquisition.json, acquisition.sha256 and a timestamped acquisition.log record every item.
The output must be on another drive than the one examined (a USB drive or external disk):
writing to the examined drive would overwrite free space that may hold deleted evidence, so it
is refused unless explicitly allowed, and then recorded. The app can restart itself as
administrator, and suggests a folder on the drive it runs from. Scanning the running system's
drive as a plain folder now explains why that misses evidence and offers live acquisition.
Portable build (…-portable.zip): both programs in one folder that runs in place from a USB
drive, so nothing is unpacked to the examined computer's temporary folder. In portable mode the
app keeps its settings next to it and uses Qt's own folder dialogs, so nothing is added to the
examined user's registry (Windows' dialogs record folders in the user's recently-used lists).
Recovered data page: messages, calls, contacts, photos and files, notifications, apps and
connection records per phone, with tiles that count each kind for the phone, connection,
search and deleted, recovered only filters chosen; a sortable table (or a photo grid with
thumbnails); the selected item in full with a preview, its source file, record and SHA-256 and a
link to the timeline; and export of the rows shown to Excel or CSV. Contact names are filled in
from the phone's own address book.
PDF summary (summary.pdf, written by every scan): the case at a glance, every phone in one
table and the computers examined, then a page per phone with a drawing of it, its identity, its
identifiers decoded, how it connected and what was recovered, and a page on method and limits.
Text stays selectable and names in any script (for example Hindi or Cyrillic) are shaped
properly.
Excel workbook (workbook.xlsx, written by every scan): a summary sheet (case, recovered data
at a glance, the phones with links to their sheets, the computers) and one sheet per phone with
its identifiers, connections and a table per kind of recovered data. Every block is an Excel
table with sort and filter buttons; times are real date-times; evidence text that starts with
= stays text.
The device page draws the phone as it most likely looks (Dynamic Island, notch or Home button
from its model or the chip in its UDID; a punch-hole camera for Android), with the wallpaper
recovered from Phone Link on its screen, beside its identity and counts of what was recovered
from it.
Identifiers are decoded and shown in full everywhere: an iPhone UDID names its chip and model
family and its ECID, an IMEI its check digit and model code, a MAC address its maker (or that it
is randomised), a SIM or phone number its country, an Apple serial its format. Unnamed phones
are labelled by model family and full identifier instead of a shortened one.
New logo, app icon and colours; --no-pdf and --no-xlsx skip the new outputs.

Changed

report.html lists every identifier with what it tells, adds a recovered-data table per phone and
a live-acquisition section, and links to the PDF summary and the workbook.
The demo case has generated pictures (a photo, a photographed document, a floor plan, a
wallpaper) instead of 1-pixel placeholders.

Fixed

Notes and warnings show Windows errors readably ("PermissionError: Permission denied:
C:\Windows\System32\config\SYSTEM") instead of an escaped \\?\ path.
Coverage notes were cut off: the Coverage page now shows the selected file's full note and path.
Icons that did not exist in the icon font drew empty circles; a test now checks every name.
The executables now include the package's data files (logo, style images, the MAC vendor table).

Downloads

File	What it is
`ConnectedPhoneForensics-0.2.0-windows-x64.exe`	Desktop app for Windows 10/11. Download and run; nothing to install.
`cpf-0.2.0-windows-x64.exe`	Command-line tool for Windows (`cpf scan`, `cpf live`, `cpf demo`, ...).
`ConnectedPhoneForensics-0.2.0-windows-x64-portable.zip`	Both programs in one folder, for a USB drive and live acquisition: runs in place (nothing unpacked to the examined computer's temp folder) and keeps its settings next to it.
`connected_phone_forensics-0.2.0-py3-none-any.whl`	Python package (the same as `pip install connected-phone-forensics`) for Windows, macOS and Linux.
`connected_phone_forensics-0.2.0.tar.gz`	Source archive.

272d85f6017bd4645c074c83fcca20d020ed5d3ab7c0292584b1df8c75376f72  ConnectedPhoneForensics-0.2.0-windows-x64-portable.zip
fb2b0babebd815b7712777568309d644eb8378f4fa353d43bd81a79d460a2fea  ConnectedPhoneForensics-0.2.0-windows-x64.exe
c89a18180f73555b3d2a343a941f822c84a0760e4e56c72ea7a4bff4cc9c64af  connected_phone_forensics-0.2.0-py3-none-any.whl
79b353bbccc1d72159fbe819d278832ea49c2a5b4eb24554ceb8026f62ca09f4  connected_phone_forensics-0.2.0.tar.gz
f4ccd97f1bbebb668024f8e23fb85f93d6fa355f0bdae4a602578c6a1c2e987d  cpf-0.2.0-windows-x64.exe

Assets 8

Connected Phone Forensics 0.1.3

github-actions released this 18 Oct 18:51

v0.1.3

01255fb

Fixed

The project page on PyPI shows the logo, screenshots and diagram: the README now links images
and documents by absolute URLs, which PyPI needs, and the Mermaid flowchart (which PyPI cannot
render) is an image.

Downloads

File	What it is
`ConnectedPhoneForensics-0.1.3-windows-x64.exe`	Desktop app for Windows 10/11. Download and run; nothing to install.
`cpf-0.1.3-windows-x64.exe`	Command-line tool for Windows (`cpf scan`, `cpf demo`, ...).
`connected_phone_forensics-0.1.3-py3-none-any.whl`	Python package (the same as `pip install connected-phone-forensics`) for Windows, macOS and Linux.
`connected_phone_forensics-0.1.3.tar.gz`	Source archive.

e4777fd28b577547f83e74b264e59db85d00c06f6dfc80e694342c4af5e3ab24  ConnectedPhoneForensics-0.1.3-windows-x64.exe
e4c90a8c53e78ac55a0d8b5ea5de7bfcb10553c23b38feac49bb5970635b9686  connected_phone_forensics-0.1.3-py3-none-any.whl
a4211d65175aab91206146bc9a59aa66c76a0781c0d0f91b4529df3ba0a1daa8  connected_phone_forensics-0.1.3.tar.gz
73802466ec58f16c3ef6b21e51da90876fa3c71a6af6fcee2756f992fd06ec6e  cpf-0.1.3-windows-x64.exe

Assets 7

Connected Phone Forensics 0.1.2

github-actions released this 18 Oct 18:32

v0.1.2

ec40b85

Added

Found by scanning a live Windows 11 system with an Android phone linked in Phone Link:

Phone Link RCS messages (rcs_chat) and RCS file transfers (rcs_filetransfer) in phone.db
are reported like SMS: received/sent events, sender and thread recipients (rcs_conversation,
with the SMS/MMS thread it falls back to), the phone's own number from the SIM subscription,
attachments exported, and deleted or edited rows recovered from the WAL. Before, these tables
were only listed in a warning.
The Phone Link phone is labelled with the name, manufacturer, model and OS (for example
"Android 15") that Phone Link records in LocalCache\DeviceMetadataStorage.json, with the
registration and last-seen times. Before, it was labelled only by its profile id, such as
"Phone (Phone Link 3fdf7366)". The computer's own entry in that file is reported but never
becomes a phone.
The phone's wallpaper in deviceData.db is reported and exported.

Fixed

Recovery of deleted SQLite rows (Phone Link, Windows notifications) no longer reports rows of
another table as recovered messages or notifications. A row is now attributed to a table only
when its page belonged to that table's b-tree in the database state it was read from: the main
file, or the end of one committed WAL transaction. Before, any old image of a page the table uses
now was decoded as the table's rows, so a page that held conversation rows and was later reused
for messages produced fabricated "recovered" SMS.
Deleted rows on pages that are no longer part of the table (freed after a bulk delete, or a root
page that has since split) are recovered; before, they were silently missed.
Rows from a WAL transaction that never committed are no longer reported as recovered records; a
warning says how many frames were not searched.
When recovery could only read part of an earlier database state (for example because a
checkpoint overwrote the pages it needs), a warning says so. Page images that a checkpoint
replaced are never used for older states, including after a checkpoint interrupted part-way.
A recovered record with more fields than the table has columns is reported in a warning instead
of being cut to fit the columns.

Changed

continuity.db (phone browser history, app hand-off contexts) and sharedContent.db (links and
content shared from the phone) stay unrecognised because their value formats are not publicly
documented, but the coverage note now says what they hold and how many rows each table has.

Known issues

Still open from the October 2026 code review:

USB serials that vendors reuse across devices (for example 0123456789ABCDEF) are treated as
unique, so two different phones can merge into one device.
USB modems, MiFi devices and RNDIS gadgets can be counted as Android phones.
A # or ? in the temporary folder path makes a database open as empty.
Velociraptor's escaped folder names are not decoded, so files in such collections are missed.
Mail and Messages attachments can be reported as AirDrop receipts.
A symlinked /home (Fedora Silverblue and similar) hides Linux user profiles.
About 30 lower-severity findings: timestamp handling, coverage notes, report wording.

Downloads

File	What it is
`ConnectedPhoneForensics-0.1.2-windows-x64.exe`	Desktop app for Windows 10/11. Download and run; nothing to install.
`cpf-0.1.2-windows-x64.exe`	Command-line tool for Windows (`cpf scan`, `cpf demo`, ...).
`connected_phone_forensics-0.1.2-py3-none-any.whl`	Python package (the same as `pip install connected-phone-forensics`) for Windows, macOS and Linux.
`connected_phone_forensics-0.1.2.tar.gz`	Source archive.

d669759a5876345d61241eb3c1e6d0cf873d90b5b8578861fc365ae6268ee04c  ConnectedPhoneForensics-0.1.2-windows-x64.exe
5702081cba57552f7499e8666378b3377b71e9f9d1e6a41da41a1d4f266de6cb  connected_phone_forensics-0.1.2-py3-none-any.whl
5aae13c61f18a3e46dd6ba831fe952c4539d9759ace323f5aceeacd98c30136e  connected_phone_forensics-0.1.2.tar.gz
26ebf792f4ee42b19da1f02c2fe6fa15ac91b2a8ff0a8b24dffdd7d90ffb460d  cpf-0.1.2-windows-x64.exe

Assets 7

Connected Phone Forensics 0.1.1

github-actions released this 18 Oct 17:42

v0.1.1

ea764b0

Found by scanning a live Windows 11 system.

Fixed

Folders that cannot be listed (permissions, as on a live system or an image mounted with its ACLs
enforced) are reported as errors with a warning for every parser that needed them. Before, they
were treated as empty, so USB, Bluetooth and hotspot history silently came back with nothing.
Devices known only by an identifier get readable names, such as
"iPhone (UDID …3E46801C)" or "Android phone (USB serial E28E9340)".
macOS with older SQLite builds: OS build strings stored as numbers come back exactly.

Changed

pip install connected-phone-forensics installs the desktop app and the command line together.

Known issues

The same as for 0.1.0 in CHANGELOG.md,
except that unreadable folders are now reported.

Downloads

File	What it is
`ConnectedPhoneForensics-0.1.1-windows-x64.exe`	Desktop app for Windows 10/11. Download and run; nothing to install.
`cpf-0.1.1-windows-x64.exe`	Command-line tool for Windows (`cpf scan`, `cpf demo`, ...).
`connected_phone_forensics-0.1.1-py3-none-any.whl`	Python package (the same as `pip install connected-phone-forensics`) for Windows, macOS and Linux.
`connected_phone_forensics-0.1.1.tar.gz`	Source archive.

eea15745bdc008c3770a462e90be3e0e0843b4a7a6f2484096adf8dca2f1220e  ConnectedPhoneForensics-0.1.1-windows-x64.exe
90405756e27e45f997ca22dfb657dcc705074cfcf1368e038f495b8e2bd3c909  connected_phone_forensics-0.1.1-py3-none-any.whl
5f5222054db13b1c186afab3a3df3809a91c4c08cc5684fdac0b9e9a26cbef3b  connected_phone_forensics-0.1.1.tar.gz
b98135924f9374b80a09b2e4bd6f163b0d00a145802f82b60b23c0d997a8b62c  cpf-0.1.1-windows-x64.exe

Assets 7

Connected Phone Forensics 0.1.0

github-actions released this 18 Oct 14:56

v0.1.0

d9a4fd9

First public release.

Added

Desktop app for Windows, macOS and Linux (PySide6): New scan with a live preview of the
computers in the evidence, scan progress with cancel, Overview, Devices, Timeline (search,
filters, per-record provenance, CSV export), Coverage and Issues pages; light and dark themes;
reopening earlier results.
Windows executables: the desktop app and the cpf command line as single-file downloads,
with SHA-256 checksums.
pip install connected-phone-forensics installs both the desktop app (cpf-gui) and the
command line (cpf) on Windows, macOS and Linux.
23 parsers across Windows, macOS and Linux: USB, setupapi, Bluetooth, phone hotspots,
Phone Link, Windows notifications, Microsoft-account phones, iPhone pairing and backups, Biome,
Messages, call history, AirDrop, Notification Center, knowledgeC, iPhone Mirroring, BlueZ and
KDE Connect.
Device correlation through strong identifiers only, with merge reasons, possible matches and
examiner assertions (--assume-same).
Outputs: self-contained HTML report, Timesketch timeline (JSONL and CSV), devices.json,
coverage.csv and a manifest with the SHA-256 of every evidence file read.
KAPE and Velociraptor collection targets generated from the parsers (cpf targets), ground-truth
scoring (cpf validate) and a synthetic demo case (cpf demo).
Parsers run in parallel (--workers); output is identical to a single-threaded run.

Fixed

Registry transaction logs are replayed by the REGF rules: only for dirty hives, only
hash-verified entries that continue the hive's sequence, LOG1 and LOG2 in sequence order, grown
hives extended. Stale log entries no longer roll back USB, Bluetooth and hotspot times or the
computer name, and an incomplete recovery is reported instead of passing silently.
Evidence deeper than 260 characters is read on Windows (extended-length paths); before, such
files (often Phone Link databases) looked missing.

Known issues

Found by a code review in October 2026 and not fixed in this release:

Critical: recovery of deleted SQLite rows (Phone Link, Windows notifications) can report
rows of another table that reused a page as recovered messages or notifications.
USB serials that vendors reuse across devices (for example 0123456789ABCDEF) are treated as
unique, so two different phones can merge into one device.
USB modems, MiFi devices and RNDIS gadgets can be counted as Android phones.
Folders that cannot be read (permissions) are treated as empty, without a warning.
A # or ? in the temporary folder path makes a database open as empty.
Velociraptor's escaped folder names are not decoded, so files in such collections are missed.
Some deleted SQLite rows are not recovered.
Mail and Messages attachments can be reported as AirDrop receipts.
A symlinked /home (Fedora Silverblue and similar) hides Linux user profiles.
About 30 lower-severity findings: timestamp handling, coverage notes, report wording.

Downloads

File	What it is
`ConnectedPhoneForensics-0.1.0-windows-x64.exe`	Desktop app for Windows 10/11. Download and run; nothing to install.
`cpf-0.1.0-windows-x64.exe`	Command-line tool for Windows (`cpf scan`, `cpf demo`, ...).
`connected_phone_forensics-0.1.0-py3-none-any.whl`	Python package (the same as `pip install connected-phone-forensics`) for Windows, macOS and Linux.
`connected_phone_forensics-0.1.0.tar.gz`	Source archive.

72fa87480217ca6c13ae5de3a7a784d2fd365c70b59d8c06b2c8c13d8a6d630d  ConnectedPhoneForensics-0.1.0-windows-x64.exe
eb0e86a80a35019afc6e9f55e5824a6aff45aaa34fb3faa4b7ac9b4f10a5ab8e  connected_phone_forensics-0.1.0-py3-none-any.whl
4920c5983844fd083a6ab656facbe681dc0abdb2a4900ee8e70fe96b95cb8a49  connected_phone_forensics-0.1.0.tar.gz
987577e0fd4f7f0061113781d3549161a4127049d6c8dbf0976d6a54fd34b2fc  cpf-0.1.0-windows-x64.exe

Assets 7

Releases: sujayadkesar/connected-phone-forensics

Release list

Connected Phone Forensics 0.4.1

Downloads

Uh oh!

Connected Phone Forensics 0.3.3

Fixed

Downloads

Uh oh!

Connected Phone Forensics 0.3.2

Fixed

Downloads

Uh oh!

Connected Phone Forensics 0.3.1

Changed

Fixed

Downloads

Uh oh!

Connected Phone Forensics 0.3.0

Added

Changed

Fixed

Downloads

Uh oh!

Connected Phone Forensics 0.2.0

Added

Changed

Fixed

Downloads

Uh oh!

Connected Phone Forensics 0.1.3

Fixed

Downloads

Uh oh!

Connected Phone Forensics 0.1.2

Added

Fixed

Changed

Known issues

Downloads

Uh oh!

Connected Phone Forensics 0.1.1

Fixed

Changed

Known issues

Downloads

Uh oh!

Connected Phone Forensics 0.1.0

Added

Fixed

Known issues

Downloads

Uh oh!