Skip to content
Pre-release
Pre-release

@ydkhatri ydkhatri released this Jul 20, 2019 · 18 commits to master since this release

Changes in this release

  • Transition to python3
  • New plugins - FSEVENTS, SPOTLIGHT, MSOFICE, UNIFIEDLOGS, AUTOSTART, IDEVICEINFO
  • Added ability to process VMDK disk images
  • RecentItems now reads SFL2 files
  • API for reading XATTR on APFS & HFS
  • mac_apt_singleplugin is renamed to mac_apt_artifact_only
  • Lots of changes under the hood for APFS handling,
    • enumerating files/folders is now several times faster
    • encrypted volumes are detected properly now
    • exporting or opening very large files is now supported
    • now handles dirty APFS volume mounting using checkpoint processing
    • disk processing is more robust now, less crash prone now!
  • Fixed Bash sessions bug, not retrieving data from .historynew files
  • Fixed a bug with MOUNTED mode
  • Basicinfo now gets vol info on vol-only images
  • Minor bug fixes to several plugins

Pre-compiled executables(no python needed) are available below. macOS compiled version coming soon.

Assets 6
You can’t perform that action at this time.