20220614

Dev release - not extensively tested..

Changes in this release

• Add CSV support for output (old CSV was TSV, also supported)
• Add new plugins - TCC and XPROTECTDIAG by Minoru Kobayashi (@mnrkbys)
• Add SafariTabs.db parsing

Bug fixes

• Fix an issue with Spotlight parsing (prop_type 8)
• Fix a display issue with excel dates for utmpx plugin
• Fix a display issue with excel dates for cfurul_cache plugin
• Minor bugfix for fsevents and utmpx plugin

20210904

This is a dev release that fixes a few bugs

20210824

A temporary dev release that fixes a few identified bugs

20210722

Changes in this release

• Fix a silly bug in macinfo.py, that only affects ios_apt

20210717

Changes in this release

• Added Safari AppExtension & WebExtension parsing

20210716

Changes in this release

• Improved parsing of AccountInfo key in com.apple.loginwindow.plist
• Add parsing of /Users/*/Library/Application Support/com.apple.backgroundtaskmanagementagent/backgrounditems.btm to AUTOSTART
• Add new plugins UTMPX, FILESHARING, CFURL_CACHE
• Add ChunkedDataWriter for plugins that need to write millions of rows (faster and memory efficient now)

Many of the above contributions from Minoru Kobayashi (@mnrkbys).

Bug fixes

• Reading fsevents in the several millions now does not consume all your memory, and won't error out for that reason
• Now reading fsevents from /System/Volumes/Data for all disks
• Fix bugs in plugins - Safari, Wifi, BasicInfo, RecentItems

20210512

Changes in this release

• Fixes issue with ios_apt.exe, which caused a few problems.

20210509

Changes in this release

• Support for reading Axiom's targeted collection, which is not a full disk image, just a zip file containing a subset of the files on disk - The new input_type option is AXIOMZIP

20210506

Changes in this release

• Support for Graykey extracted filesystem (only /private/var)
• Add parsing of com.apple.wifi.known-networks.plist
• Add parsing of wifi backup plist com.apple.airport.preferences.plist.backup
• Add tab closed date to Safari LastSession output

• Fixed another bug that prevented APFS decryption in some disks due to not checking UUIDs when searching for Volume Keybag
• Fixed minor bug with Safari plugin for ios
• Fixed bug with ios_apt app_group parsing

20210228

Changes in this release

• Add option for specifying password in file (-pf), because passwords on command line that have special chars like \ or ^ have problems

• Fixed a bug that prevented APFS decryption in some disks
• Skip reading deleted apfs blocks to prevent stale/bad data
• Fixed a bug in iDeviceBackups plugin