Kokino Forensic Toolkit 1.6.2

Kokino Forensic Toolkit 1.6.2: Ex01 images (EnCase 7 and later), PDF carving that also joins PDFs with cross-reference streams and linearized PDFs, and HashKeeper and hashdeep hash sets.

Website: https://zeroscience.github.io/kokino-ftk/

Download

System	Package
Windows 10/11 (x64)	kokino-1.6.2-windows-x64.msi (installer) or .zip
Linux (x86_64)	kokino_1.6.2_amd64.deb (Debian, Ubuntu, Kali) or .tar.gz
macOS 12+ (Intel and Apple Silicon)	kokino-1.6.2-macos-universal.dmg

Check downloads against SHA256SUMS.txt, or verify the signed build provenance with gh attestation verify <file> --repo zeroscience/Kokino; kokino-1.6.2-sbom.cdx.json lists every crate in the build. The packages are not code-signed yet: on Windows choose "More info", then "Run anyway"; on macOS right-click "Start Kokino", choose Open, then Open again. The MSI upgrades an installed version in place; cases and accounts are kept.

Added

• Ex01 images. EWF version 2, as EnCase 7 and later write it: compressed, uncompressed and pattern-filled chunks over any number of segments (.Ex01, .Ex02, ... found automatically). The MD5 and SHA-1 the imager stored are checked, and the case details, write-blocker and unreadable sectors it recorded are shown, as for E01. Checked on Ex01 files libewf made and on Ex01 written from Kokino's test disks by an independent writer: each reads byte for byte as the disk it came from. Encrypted Ex01 images are recognized and reported.
• More PDFs joined when carving. PDFs with compressed cross-reference streams (most newer PDFs), hybrid files and linearized PDFs split in two pieces are joined too, every cross-reference section followed; JPEG pictures inside a PDF are checked by decoding them exactly. On a public 5.4 MB PDF split at 149 places, 104 joins (76 before), none wrong.
• Hash sets. HashKeeper hash sets and hashdeep / md5deep output are recognized and read by their hash columns.

Parsers fuzzed with 952 million inputs over 43 targets; 43 problems found and fixed over Kokino's life, none in this release. Full details are in the changelog and the roadmap.

Kokino Forensic Toolkit 1.6.1

Kokino Forensic Toolkit 1.6.1: AFF4 disk images and AFF4-L and AccessData AD1 logical images, deleted Outlook messages from the PST's free space, and carving that joins Office documents, ZIP files and PDFs split in two pieces.

Website: https://zeroscience.github.io/kokino-ftk/

Download

System	Package
Windows 10/11 (x64)	kokino-1.6.1-windows-x64.msi (installer) or .zip
Linux (x86_64)	kokino_1.6.1_amd64.deb (Debian, Ubuntu, Kali) or .tar.gz
macOS 12+ (Intel and Apple Silicon)	kokino-1.6.1-macos-universal.dmg

Check downloads against SHA256SUMS.txt, or verify the signed build provenance with gh attestation verify <file> --repo zeroscience/Kokino; kokino-1.6.1-sbom.cdx.json lists every crate in the build. The packages are not code-signed yet: on Windows choose "More info", then "Run anyway"; on macOS right-click "Start Kokino", choose Open, then Open again. The MSI upgrades an installed version in place; cases and accounts are kept.

Added

• AFF4 disk images. The AFF4 Standard v1.0 that Evimetry and pyaff4 write: maps over image streams compressed with snappy, LZ4 or deflate, sparse images, and striped sets (pick any container; the others are found next to it). The Summary shows the case notes, the device and any read errors the imager recorded; unreadable parts read as the text UNREADABLEDATA, as the standard defines. Checked on the AFF4 reference images: every image stream matches its recorded hashes, and the same device imaged three ways reads the same.
• AD1 and AFF4-L logical images. FTK Imager custom content images (AD1 versions 3 and 4, any number of segments) and AFF4-L containers are read as file systems, with the names, times and hashes they recorded and the deleted files FTK captured. On the FTK Imager test image every file matches the MD5 FTK recorded. Encrypted AD1 images are recognized and refused.
• Deleted Outlook messages from free space. When nothing of a deleted message is left in the PST's index, Kokino finds its blocks by their trailers and brings it back, leaving out old copies of messages that still exist. On the public samples: two deleted messages in an Outlook 2013 OST, one with its attachments.
• Carving. Office documents, OpenDocument files and ZIP archives split in two pieces are joined through their central directory and the CRC of the entry the break falls in; PDFs with a cross-reference table through the table and their compressed streams. A join is kept only when exactly one break fits.

Changed

• The server's cases folder (its account name and folder layout) is shown to administrators only.

Parsers fuzzed with 942 million inputs over 43 targets; the two new targets (AD1 and AFF4) found three problems, all fixed before release (43 in all over Kokino's life). Full details are in the changelog and the roadmap.

Kokino Forensic Toolkit 1.6.0

Kokino Forensic Toolkit 1.6.0: plugin rows on the timelines and in the watchlist, kokino plugin-test with a guide for writing plugins, carving of JPEGs in three pieces and PNGs in two, deleted Outlook messages recovered from the PST's index, and the NIST CFReDS validation running every week on GitHub.

Website: https://zeroscience.github.io/kokino-ftk/

Download

System	Package
Windows 10/11 (x64)	kokino-1.6.0-windows-x64.msi (installer) or .zip
Linux (x86_64)	kokino_1.6.0_amd64.deb (Debian, Ubuntu, Kali) or .tar.gz
macOS 12+ (Intel and Apple Silicon)	kokino-1.6.0-macos-universal.dmg

Check downloads against SHA256SUMS.txt, or verify the signed build provenance with gh attestation verify <file> --repo zeroscience/Kokino; kokino-1.6.0-sbom.cdx.json lists every crate in the build. The packages are not code-signed yet: on Windows choose "More info", then "Run anyway"; on macOS right-click "Start Kokino", choose Open, then Open again. The MSI upgrades an installed version in place; cases and accounts are kept.

Added

• Plugin rows everywhere. Dated rows plugins report are on each evidence item's timeline and the case timeline (source PLUGIN, with a Plugins filter), and the watchlist searches every row's text and fields. A row opens the file it came from.
• For plugin authors. kokino plugin-test <plugin folder> <sample file> --as <path on the volume> runs a plugin on one file exactly as a real run does and reports whether the path matches, rows without a readable time and rows without "what". plugins/README.md walks through writing one, with templates in Python, PowerShell and sh.
• Carving. JPEGs split in three pieces are joined too (a run of JPEG data between the first and last piece as the middle one), and PNGs split in two pieces through their chunk CRCs: a join is kept only when the picture decodes exactly, or every PNG chunk checks out up to the end.
• Deleted Outlook messages. When Outlook deletes an item its entry often stays in an unused slot of the PST's node index; such messages whose data is still intact are listed as deleted ("[recovered deleted item]") and searched.
• Validation every week. A scheduled GitHub workflow downloads the 83 NIST CFReDS deleted-file-recovery images, analyzes them and compares every image's numbers with the recorded ones; its first run matched all 83.
• The website is linked from the About page and the wiki, with Zero Science Lab as developer.

Parsers fuzzed with 868 million inputs over 41 targets; 40 problems found and fixed over Kokino's life, none in this release. Full details are in the changelog and the roadmap.

Kokino Forensic Toolkit 1.5.0

Kokino Forensic Toolkit 1.5.0: watchlists from STIX 2.1 and MISP with each sweep compared with the last, plugins for artifacts Kokino does not read itself, CD-R and DVD-RW discs, ESXi snapshots, JPEGs carved from two pieces, names of long-deleted files from the ext journal, more of SRUM, and dates shown day first.

Website: https://zeroscience.github.io/kokino-ftk/

Download

System	Package
Windows 10/11 (x64)	kokino-1.5.0-windows-x64.msi (installer) or .zip
Linux (x86_64)	kokino_1.5.0_amd64.deb (Debian, Ubuntu, Kali) or .tar.gz
macOS 12+ (Intel and Apple Silicon)	kokino-1.5.0-macos-universal.dmg

Check downloads against SHA256SUMS.txt, or verify the signed build provenance with gh attestation verify <file> --repo zeroscience/Kokino; kokino-1.5.0-sbom.cdx.json lists every crate in the build. The packages are not code-signed yet: on Windows choose "More info", then "Run anyway"; on macOS right-click "Start Kokino", choose Open, then Open again. The MSI upgrades an installed version in place; cases and accounts are kept.

Added

• Watchlist from STIX 2.1 and MISP. Paste or load a STIX 2.1 bundle (indicator patterns and observables) or a MISP event export (attributes, object attributes, composite types such as filename|sha256). IP networks in CIDR form work in any list. Each sweep is compared with the previous one: new hits are marked, with an "Only new" filter. Up to 50,000 indicators.
• Plugins. Separate programs, in any language, for artifacts Kokino does not read. A plugin gets a copy of every matching file (never the evidence itself) and prints JSON rows, shown on the evidence item's new Plugins page and with kokino plugins. Off unless the server is started with --plugins <folder>; every run is in the audit log with the SHA-256 of the plugin's files. Example: plugins/internet-shortcut.
• Written CDs and DVDs. UDF sparable partitions (DVD-RW, CD-RW) are read through their sparing table; virtual partitions (CD-R, DVD-R written in sessions) through the VAT. Files a later session removed are listed as deleted, from the earlier sessions' VATs.
• ESXi snapshots. VMFSSPARSE (-delta.vmdk) and SESPARSE (-sesparse.vmdk) snapshots with their parent disks.
• Carving. JPEGs split in two pieces across free space are joined again, kept only when the joined picture decodes exactly.
• ext3 and ext4. Names of files deleted long ago, from older copies of their folders in the journal, also when the inode now belongs to another file (704 more deleted names on NIST's ext-10, nothing else changed).
• SRUM. Per program, time in the foreground and with keyboard or mouse input; push notifications; battery charge and time on battery.

Changed

• Dates day first. dd-mm-yyyy by default in the GUI, the case reports, the analysis summaries (always UTC) and shadow copy names. ISO and US order and any time zone remain a choice under Time. Stored data, JSON and CSV exports and audit logs stay ISO 8601. Summaries of evidence analyzed before 1.5.0 keep their old wording until it is analyzed again.
• Golden results now cover 42 analyses; parsers fuzzed with 749 million inputs over 41 targets, 40 problems found and fixed.

Fixed

• SRUM per-program totals could overflow on a damaged database; a STIX pattern with a multi-byte character could stop the watchlist parser (both found by fuzzing).

Full details are in the changelog and the roadmap.

Kokino Forensic Toolkit 1.4.0

Kokino Forensic Toolkit 1.4.0 works on a whole case at once: one timeline across every evidence item, a watchlist that sweeps every item for known indicators, and golden results that check what Kokino finds in every test image on every commit.

1.4 is the last feature release for a few months. Security reports and wrong results (an artifact read incorrectly, a crash on real evidence) are still fixed in 1.4.x releases; ROADMAP.md lists what comes after the pause, in order, with what each item needs.

Download

System	Package
Windows 10/11 (x64)	kokino-1.4.0-windows-x64.msi (installer) or .zip
Linux (x86_64)	kokino_1.4.0_amd64.deb (Debian, Ubuntu, Kali) or .tar.gz
macOS 12+ (Intel and Apple Silicon)	kokino-1.4.0-macos-universal.dmg

Check downloads against SHA256SUMS.txt, or verify the signed build provenance with gh attestation verify <file> --repo zeroscience/Kokino; kokino-1.4.0-sbom.cdx.json lists every crate in the build. The packages are not code-signed yet: on Windows choose "More info", then "Run anyway"; on macOS right-click "Start Kokino", choose Open, then Open again. The MSI upgrades an installed version in place; cases and accounts are kept.

Added

• Case timeline. A case page that merges the timelines of every analyzed evidence item and volume into one, in time order: file times, browser activity and system events. Each row names its item and volume and opens there. Filter by text, day range and kind.

• Watchlist. Paste a list of indicators and search every evidence item of the case at once:

  • MD5, SHA-1 and SHA-256 against Hash analysis;
  • file names and path fragments, deleted files included;
  • domains and URLs in web visits, downloads, cache, cookies and email addresses;
  • email addresses (From, To, Cc);
  • IP addresses in Windows and Linux events and logons.

  Comments and notes are kept, and defanged forms (hxxp://, [.], [@]) are read. Each hit opens where it was found. The list can be saved with the case; saves and sweeps are recorded in the audit log. Reviewers can run sweeps.

• Golden results. All the test images (38 analyses, BitLocker locked and unlocked) are checked on every commit, on Windows, Linux and macOS. Each check compares the volumes, file statistics, score, the size of every artifact list and a digest of the file listing.

• Fuzzing. A new fuzz target for the watchlist parser found that an IPv4-mapped indicator (::ffff:192.0.2.1) matched nothing; it was fixed before release. Totals: 670 million inputs over 40 targets, 38 problems found and fixed.

Changed

• Roadmap rewritten: done by area, then a prioritized list for after the pause. It starts with checks on real Mac disks, then APFS encryption, snapshots and LZFSE, Windows Search, XFS and Ex01. The About page has a What's next card.

Full details are in the changelog.

Kokino Forensic Toolkit 1.3.2

Kokino Forensic Toolkit 1.3.2: the built-in wiki brought up to date with 1.3.1. No changes to analysis; if you run 1.3.1, this release only updates the help pages.

Download

System	Package
Windows 10/11 (x64)	kokino-1.3.2-windows-x64.msi (installer) or .zip
Linux (x86_64)	kokino_1.3.2_amd64.deb (Debian, Ubuntu, Kali) or .tar.gz
macOS 12+ (Intel and Apple Silicon)	kokino-1.3.2-macos-universal.dmg

Check downloads against SHA256SUMS.txt, or verify the signed build provenance with gh attestation verify <file> --repo zeroscience/Kokino; kokino-1.3.2-sbom.cdx.json lists every crate in the build. The packages are not code-signed yet: on Windows choose "More info", then "Run anyway"; on macOS right-click "Start Kokino", choose Open, then Open again. The MSI upgrades an installed version in place; cases and accounts are kept.

Changed

• Wiki: the macOS system summary (accounts, launchd persistence, quarantine downloads, KnowledgeC, FSEvents, Safari) is under Mac disks, which still said macOS artifacts were not read; carving of decrypted BitLocker volumes; the new validation images (dfvfs shadow copies and BitLocker To Go, the public PST and OST samples) with thanks to their authors; release integrity (SBOM and signed provenance) under Security; and the About page's description of what Kokino reads.

Everything new in the 1.3 line is in the 1.3.1 release notes and the changelog.

Kokino Forensic Toolkit 1.3.1

Kokino Forensic Toolkit 1.3.1: encrypted, shadowed, collected and Mac.

Download

System	Package
Windows 10/11 (x64)	kokino-1.3.1-windows-x64.msi (installer) or .zip
Linux (x86_64)	kokino_1.3.1_amd64.deb (Debian, Ubuntu, Kali) or .tar.gz
macOS 12+ (Intel and Apple Silicon)	kokino-1.3.1-macos-universal.dmg

Check downloads against SHA256SUMS.txt. New in this release: kokino-1.3.1-sbom.cdx.json (CycloneDX SBOM: every crate with its version, checksum and license) and a signed build provenance attestation for every file, checked with gh attestation verify <file> --repo zeroscience/Kokino. The packages are not code-signed yet: on Windows choose "More info", then "Run anyway"; on macOS right-click "Start Kokino", choose Open, then Open again. The MSI upgrades an installed version in place; cases and accounts are kept. If you run 1.3.0, "Check for updates" on the About page (or kokino version --check) shows this release.

New

• BitLocker (Windows 7 and later, BitLocker To Go): each encrypted volume listed with its method and key protectors; unlock with the password, the 48-digit recovery password or the startup key (.BEK). The decrypted volume is analyzed like any other, its free space carved decrypted, its shadow copies read. Volumes with protection suspended open without asking. The volume key stays with the case, never the password; unlocks and failed attempts are audited. --bitlocker-password, --recovery-password and --startup-key on the command line.
• Volume Shadow Copies: every snapshot of an NTFS volume rebuilt and read as a volume of its own.
• Disk images inside evidence (E01, VHD, VHDX, VMDK, ISO, raw) listed and extracted as evidence of their own, verified and audited.
• Triage collections: Velociraptor and KAPE ZIPs, UAC tar and tar.gz, and collections copied out as plain folders (packed into the case with a manifest of every file's SHA-256), with artifacts read at the paths they had on the collected system.
• Outlook PST and OST (ANSI, Unicode, the compressed OST of Outlook 2013+; encrypted or not; any size, read in place): every message with its folder, recipients, attachments and text, including RTF-only bodies; Apple Mail (.emlx).
• macOS: version, computer name, setup date, accounts, launchd persistence, quarantine downloads, KnowledgeC app use, FSEvents (also on USB drives a Mac wrote to), Safari history and downloads, shell histories in /Users.
• WebCache of Internet Explorer 10 and 11 and the old Edge: history, cache, cookies, downloads.
• VHDX log replay: disks not shut down cleanly read with their log applied in memory.
• Correlation: a case page listing what its evidence items have in common (users, computers, email addresses, IPs, USB serials, Wi-Fi networks, web domains, identical files).

Checked on public test images (dfvfs vss.raw and BitLocker To Go, public PST and OST samples) and on test files written by Windows' own database engine; see VALIDATION.md. Parsers fuzzed with 656 million inputs in all; this release's new parsers found 8 problems, all fixed before release (SECURITY.md). Full list in the changelog.

Kokino Forensic Toolkit 1.3.0

Kokino Forensic Toolkit 1.3.0: email, exports and older systems.

Download

System	Package
Windows 10/11 (x64)	kokino-1.3.0-windows-x64.msi (installer) or .zip
Linux (x86_64)	kokino_1.3.0_amd64.deb (Debian, Ubuntu, Kali) or .tar.gz
macOS 12+ (Intel and Apple Silicon)	kokino-1.3.0-macos-universal.dmg

Check downloads against SHA256SUMS.txt. The packages are not code-signed yet: on Windows choose "More info", then "Run anyway"; on macOS right-click "Start Kokino", choose Open, then Open again. The MSI upgrades an installed version in place; cases and accounts are kept. If you run 1.2.9, "Check for updates" on the About page (or kokino version --check) shows this release.

New: an Email page for mbox mailboxes (Thunderbird, /var/mail) and .eml files, with message text, headers and attachments, the messages Thunderbird deleted but still holds, email on the timeline and in full-text search; every list as CSV or JSON, from the GUI or with kokino export, each export hashed and audited; registry transaction logs applied as Windows would, identical to Windows' own recovery on public test hives (VALIDATION.md); text of Word, Excel and PowerPoint 97-2003, Outlook .msg and RTF in search; Windows XP and 2003 event logs (.evt); Internet Explorer cookies; and compressed journald fields. Parsers fuzzed with 567 million inputs, no new findings (SECURITY.md). Evidence analyzed with an earlier version needs a re-analysis to show the new artifacts; Kokino offers it. Next: Volume Shadow Copies, BitLocker with a recovery key and triage collection import (ROADMAP.md).

Changes

Email, exports and older systems: mbox and .eml mail, every list as CSV or JSON, registry transaction logs, text of legacy Office files, Windows XP event logs, Internet Explorer cookies and compressed journald fields.

Added

• Exports of every list as CSV or JSON: files (with $SI and $FN times and, after hash analysis, MD5, SHA-1 and SHA-256), the timeline, anti-forensics indicators, web visits, downloads, searches and the Internet Explorer cache, Windows programs run, files opened, ShellBags, the change journal, autostart entries, scheduled tasks, installed programs, USB devices, networks, accounts, notable events, deleted registry keys and values and SRUM, the Linux shell history, logons, events, packages and persistence, and carved files and Internet Explorer records. Times are ISO 8601 UTC and both formats have the same columns; CSV has a UTF-8 byte-order mark and puts an apostrophe before a cell that starts like a spreadsheet formula, JSON keeps every value exactly. Each export is saved in the case's exports folder and its SHA-256 recorded in the case audit log. In the GUI: "Export lists" on the evidence summary (every list with its row count), and CSV and JSON buttons on the Timeline, Web activity and Carved files pages; reviewers cannot export, as with files. On the command line: kokino export <case folder> [evidence] [list|all] [--fs N] [--format csv|json].

• Text of legacy Office files for full-text search (new module kokino_analysis::oletext): Word 97-2003 through the piece table (8-bit and UTF-16 pieces, field codes dropped and field results kept), Excel 97-2003 shared strings (including strings split over CONTINUE records), older LABEL cells and sheet names, PowerPoint 97-2003 text atoms, Outlook .msg text properties (subject, body, sender, recipients, attachment names), and the document properties of any OLE file (title, subject, author, keywords, comments, last saved by). RTF text, with 'hh and \u escapes decoded and font tables, pictures and other non-text groups skipped. Live, deleted and carved files alike; encrypted Word and Excel files are reported.

• Registry transaction logs (new module kokino_artifacts::reglog): a hive that was not cleanly saved gets the changes still in its .LOG1 and .LOG2 (.LOG on Windows XP) applied in memory before it is read, as Windows would on its next start. Both formats: Windows 8.1 and later (log entries checked with their Marvin32 checksums and applied in sequence order across both logs, the replay stopping at the first damaged or missing entry) and Windows XP to 8 (dirty sector bitmap). A damaged log is not used, and the Sources list says what was applied or why not. kokino artifact applies logs found next to a hive and reports it. Checked against Windows' own recovery on public test hives (VALIDATION.md): identical for the new format; for the old format identical apart from two fields Windows rewrites whenever it loads a hive.

• Fuzz target reglog (58,565,421 inputs) and a further round of doc with Word, Excel, PowerPoint, Outlook and RTF seeds (37,498,697 inputs): no problems found. Totals: 475,652,711 inputs over 28 targets, 29 problems found and fixed (SECURITY.md).

• Test image disk-win.img: alice's UsrClass.dat is left as Windows leaves a hive it has not flushed (the sector with the ShellBags root key only in UsrClass.dat.LOG1), so the ShellBags tests also test the log replay.

• Legacy Windows event logs (.evt, Windows NT to Server 2003; new module kokino_artifacts::evt): SecEvent.Evt, SysEvent.Evt and AppEvent.Evt are read like EVTX, including records left in the unused part of the circular log and records that wrap around its end. Security events of those Windows versions get the field names Vista and later use, so they appear under Events with their user, logon type and address and count for the indicators: logons (528, 540), failed logons (529 to 539), log cleared (517), process started (592, also under Programs run), accounts created, enabled, disabled, deleted and reset (624 to 630, 644), group changes (632, 636, 660), service installed (601), audit policy (612) and time changed (520). Windows XP profiles under Documents and Settings (NTUSER.DAT, UsrClass.dat, Recent shortcuts) and a Windows 2000 \WINNT folder are found. kokino artifact reads .evt files.

• Internet Explorer cookies: the Cookies folders' index.dat joined with each site's cookie text file (name, value, site and path, created, expires, flags, and from the index when the site's cookies were last used). Cookie files the index no longer lists and index entries whose file is gone are listed and marked. New "IE cookies" list in Web activity, CSV/JSON export. On Digital Detective's practice case: 222 cookies from 87 sites, and two deleted index entries whose cookie files are gone (VALIDATION.md).

• systemd journal: fields journald stored compressed are decoded (XZ and zstd with the pure-Rust lzma-rs and ruzstd crates, LZ4 by Kokino itself), instead of being counted and skipped.

• Email (new module kokino_analysis::mail): mbox mailboxes (Thunderbird and SeaMonkey mail folders, /var/mail and /var/spool/mail, .mbox and .mbx files) and .eml files, live and deleted. Every message with its date, sender, recipients, subject, attachments and the first words of its text; headers in encoded words, bodies in quoted-printable or base64 and in their character set, HTML without markup, attached messages and nested multiparts. Messages Thunderbird deleted but has not yet removed from the file (X-Mozilla-Status 0x0008) are marked. New Email page (mailboxes, filter, message text, all headers, attachments with audited export), email on the Timeline (source MAIL), a line in the impact summary, CSV/JSON export, and message text and document attachments in the full-text index.

• Fuzz targets evt (30,689,834 inputs), mail (7,542,816) and journalz (journald's XZ, LZ4 and zstd, 45,374,291), and a further round of linuxlogs with a journal holding compressed fields (7,898,202): no problems found. Totals: 567,157,854 inputs over 31 targets, 29 problems found and fixed (SECURITY.md).

Changed

• Analysis schema 10. Evidence analyzed by an earlier version is offered a re-analysis in the System summary, Web activity and the Email page.
• The anti-forensics rules evtx_cleared and log_cleared_event cover Windows XP and 2003 too: a SecEvent.Evt no larger than a reset log (64 KiB), and event 517.
• The Windows test image's carving sample draft.docx is now built with a fixed time, so the test images are the same every time they are built.
• The carving sample order on the test volume changed (the new log file took free clusters); the carving test was updated.

Kokino Forensic Toolkit 1.2.9

Kokino Forensic Toolkit 1.2.9: scheduled tasks, Internet Explorer history and deleted registry keys.

Download

System	Package
Windows 10/11 (x64)	kokino-1.2.9-windows-x64.msi (installer) or .zip
Linux (x86_64)	kokino_1.2.9_amd64.deb (Debian, Ubuntu, Kali) or .tar.gz
macOS 12+ (Intel and Apple Silicon)	kokino-1.2.9-macos-universal.dmg

Check downloads against SHA256SUMS.txt. The packages are not code-signed yet: on Windows choose "More info", then "Run anyway"; on macOS right-click "Start Kokino", choose Open, then Open again. The MSI upgrades an installed version in place; cases and accounts are kept. If you run 1.2.8, "Check for updates" on the About page (or kokino version --check) shows this release.

New: scheduled tasks from the task files and the registry's TaskCache, with tasks hidden from the Task Scheduler flagged (the Tarrask technique); Internet Explorer 4 to 9 history, cache and downloads from index.dat, with deleted entries inside the files and records carved one by one from free space; and deleted registry keys and values recovered from the hives' free cells. Checked on Digital Detective's practice case: from the formatted disk, all 15 index.dat files and all 5,920 of their records come back, the same counts as the live files (VALIDATION.md). Two new anti-forensics indicators (26 in all). Parsers fuzzed with 380 million inputs; one new problem found and fixed before release (SECURITY.md). Evidence analyzed with an earlier version needs a re-analysis to show the new artifacts; the System summary and Web activity offer it, and the Carved files page suggests carving again. Next: Ex01, macOS artifacts and APFS snapshots (ROADMAP.md).

Changes

More Windows: scheduled tasks (hidden ones flagged), Internet Explorer history with records recovered from free space, and deleted registry keys and values.

Added

• Scheduled tasks (new module kokino_artifacts::task): every task file under Windows\System32\Tasks (author, registration date, account and privilege level, triggers in plain words, what it runs, hidden and disabled flags) joined with the registry's TaskCache (SOFTWARE), which adds when each task was created and last ran, the result of its last run, and a binary copy of its actions for tasks whose file is gone. Shown in a new "Scheduled tasks" card in the System summary (Windows' own tasks behind a toggle), with tasks that are not Windows' own, or run from unusual places, in the autostart list; task registrations and last runs on the Timeline; a table in the case report and lines in the impact summary. Tasks registered without a task file, and task files no longer registered, are marked. Checked on a real Windows 7 SOFTWARE hive (83 tasks, VALIDATION.md).
• Anti-forensics indicator task_hidden_sd (25 in total): a task whose TaskCache\Tree key lost its SD value, which hides it from schtasks and the Task Scheduler while it keeps running (the Tarrask technique). Only where the hive's other tasks have an SD value: Windows 7 writes none.
• Deleted registry keys and values (Hive::deleted in kokino_artifacts::registry): the free space of every hive bin is searched for key and value cells that Windows freed but did not clear. Each deleted key gets the path of the live key it belonged to (through deleted parents too), its last-written time and the values whose cells are still free; values whose data cell is in use again are marked. Older copies of keys that still exist (Windows leaves one when it moves a key) are recognized, and only the values they hold that the live key no longer has are reported, as deleted values of that key; values found on their own are listed without a key. New System summary page "Deleted registry" (filter, only keys that record user activity, details per key), deleted keys on the Timeline (source REG), a table in the case report, a line in the impact summary, and counts (--full: every key and value) in kokino artifact for a hive. Keys that record user activity (recent documents, the Run box, typed paths and addresses, dialog history, Explorer searches, UserAssist, ShellBags, mounted drives, Office recent files, Run, USB devices, networks, remote desktop, BAM) are named. Transaction logs (.LOG1/.LOG2) are still not applied.
• Anti-forensics indicator registry_traces_deleted (26 in total): a whole key that records user activity found deleted, which is what cleaners such as CCleaner do (Windows trims these lists one entry at a time).
• Fuzz target task (task XML, the Actions and DynamicInfo blobs, TaskCache in a hive): 19,733,957 inputs, no problems found.
• Test image disk-win.img now holds four scheduled tasks: one of Windows' own, one running from C:\Users\Public, one hidden Tarrask-style and one registered without a task file.
• Internet Explorer history (new module kokino_artifacts::iecache, the index.dat format of Internet Explorer 4 to 9): the main history, daily and weekly history files, protected-mode (Low) history, the cache (Content.IE5) and IE 9's download list are read into Web activity next to Chrome and Firefox. Visits with page titles and visit counts (local files opened through Explorer appear as file: visits), cached files with their cache folder and file name, content type and hits, downloads with source URL, referring page, saved path and bytes received, and search terms from visited search pages. Every 128-byte block is checked, so deleted entries still inside the file are listed too, marked "deleted entry"; LEAK entries (deleted, but the cached file was still in use) are marked. A last visit that the main file repeats from a daily file is shown once. Daily files keep each visit time also in local time, so the source card says what the computer's clock was set to while browsing. New "IE cache" list in Web activity; visits on the Timeline; IE sources in the case report and the impact summary.
• Carving recovers Internet Explorer records from free space: every 128-byte boundary of free clusters and unpartitioned space is checked for a history, cache, cookie, download or redirect record (records keep that alignment when index.dat is deleted), and whole index.dat files are carved as files. New "ie-records" list on the Carved files page; kokino carve lists the records after the files.
• kokino artifact reads an exported index.dat (counts by record type, deleted records, cache folders; --full for every record).
• Validation on Digital Detective's practice files (VALIDATION.md): all 16 index.dat files of the Windows 7 laptop read, and the formatted E01 of the same case gives back all 15 index.dat files whole and all 5,920 of their records from free space, the same counts as the live files. That check found and fixed two problems before release (records inside a carved file longer than the 1 MiB read window were skipped; the clock offset was truncated to UTC+02:45 instead of rounded to UTC+03:00).
• Fuzz target iecache (index.dat, the conversion of each kind of file, and records read from free space at every 128-byte boundary): 21,653,615 inputs; it found one problem before release (a record cut off by the end of the file, with its data offset past the bytes that exist, panicked), fixed and kept as a regression input. A further round of registry, which now also recovers deleted keys and values: 18,700,883 inputs, no problems found. Totals: 379,588,593 inputs over 27 targets, 29 problems found and fixed (SECURITY.md).
• Test image disk-win.img now holds deleted registry keys: in alice's NTUSER.DAT a TypedURLs key deleted with its Internet Explorer parent, the SDelete EULA key deleted with its Sysinternals parent, and an older copy of RunMRU that still holds an entry removed since; in her UsrClass.dat a value on its own.
• Test image disk-win.img now holds Internet Explorer files for alice (a daily history with a search, a visit seen again in the main file and a deleted entry; the main history with a local file opened; the cache with a LEAK entry; a download) and, after the volume, a deleted index.dat and two loose records for carving.

Changed

• Analysis schema 9 (7: scheduled tasks; 8: Internet Explorer; 9: deleted registry keys). NTFS evidence analyzed by an earlier version is offered a re-analysis in the System summary and in Web activity, which name what is missing.
• Carving results schema 2. Results from an earlier version still open; the Carved files page suggests carving again to look for Internet Explorer records.
• The browser_history_cleared indicator counts only Internet Explorer's main history files: cache and download lists hold no visits, and Windows deletes daily and weekly history files itself as they age. Searches such as "clear ie history" now count for antiforensic_web.
• The server test of session expiry no longer fails on a computer that has been up for less than the idle timeout (it could not move a time back past the system's start).
• The carving samples memo.doc and security.evtx-chunk moved from the test volume's free clusters to the unpartitioned space after it, to make room for the task files, the index.dat files and the larger SOFTWARE hive.

Kokino Forensic Toolkit 1.2.8

Kokino Forensic Toolkit 1.2.8: deeper NTFS and Windows.

Download

System	Package
Windows 10/11 (x64)	kokino-1.2.8-windows-x64.msi (installer) or .zip
Linux (x86_64)	kokino_1.2.8_amd64.deb (Debian, Ubuntu, Kali) or .tar.gz
macOS 12+ (Intel and Apple Silicon)	kokino-1.2.8-macos-universal.dmg

Check downloads against SHA256SUMS.txt. The packages are not code-signed yet: on Windows choose "More info", then "Run anyway"; on macOS right-click "Start Kokino", choose Open, then Open again. The MSI upgrades an installed version in place; cases and accounts are kept. If you run 1.2.7, "Check for updates" on the About page (or kokino version --check) shows this release.

New: the NTFS change journal ($UsnJrnl) with every file created, renamed and deleted; names of deleted files whose MFT record was reused, from folder index slack and $LogFile; ShellBags; BAM/DAM; and SRUM (network and disk use per program, hour by hour), read with Kokino's own ESE database reader and checked against Windows' own esent.dll on a real Windows 10 database: all 310,255 rows the same (VALIDATION.md). Two new anti-forensics indicators (24 in all). Parsers fuzzed with 319 million inputs, no new findings (SECURITY.md). NTFS evidence analyzed with an earlier version needs a re-analysis to show the new artifacts; the System summary offers it. Next: Ex01, macOS artifacts and APFS snapshots (ROADMAP.md).

Changes

Deeper NTFS and Windows: the change journal, names of deleted files from folder index slack and $LogFile, ShellBags, BAM/DAM and SRUM with Kokino's own ESE database reader.

Added

• NTFS: names of deleted files whose MFT record was reused, recovered from folder index slack ($I30), the indexes of deleted folders, and $LogFile (which records every index change with the entry). Each is listed as a deleted, name-only entry with its $FILE_NAME times and size, the MFT record it had and a note saying where it was found and what that record holds now; earlier names of renamed or moved files are listed the same way. They have no content (reads say so) and are skipped by hashing. On the NIST CFReDS NTFS images the deleted files listed now match NIST's counts closely (case 08 exactly, VALIDATION.md); the missing names were mostly in $LogFile, not in index slack as VALIDATION.md had assumed. Hard links are recognized as second names of the same record.
• NTFS change journal ($Extend$UsnJrnl:$J, record versions 2 and 3, and $Max): every record read (sparse parts skipped), records of one round of changes combined into one change (created, data written, renamed with the old name, deleted, ...), paths rebuilt from today's folders or, for folders that are gone, from the journal itself, and each change linked to the file on the volume when its MFT reference and name match. New System summary page "Change journal" (filter by kind and path, paged), a journal summary on the overview (period covered, counts, when the journal was created), a "Change journal" section in the file details, and created, deleted and renamed files on the Timeline (source USN). Up to 250,000 changes are kept (the newest); the summary says when older ones were dropped.
• ShellBags: every folder a user opened in Explorer, from UsrClass.dat (Windows 7 and later) and NTUSER.DAT (BagMRU and ShellNoRoam), with full paths rebuilt from the shell items (drives, folders with long names, network shares, ZIP folders, known folders, URIs, delegate items), last opened time, the folder's own times and MFT reference, and a link to the folder when it is on this volume. New System summary page "Folders (ShellBags)"; opened folders on the Timeline.
• SRUM (System Resource Usage Monitor, Windows\System32\sru\SRUDB.dat): per program and user, hour by hour, bytes sent and received over which network and interface, disk bytes read and written and processor time, for the last 30 to 60 days, and network connections with their start and length. Program paths, services and user SIDs are resolved through SruDbIdMapTable and the accounts; Wi-Fi networks by name through WlanSvc's profile index and the profile XML files. New System summary page "Network use (SRUM)" (programs by data sent, each program's hours, connections), hours in which a program sent 100 MiB or more and connections on the Timeline, the top senders in the summary and the case report. A database that was not cleanly closed is reported (its newest hours may be only in the transaction logs, which are not read).
• ESE database reader (new module kokino_artifacts::ese, "Jet Blue", used by SRUM and later by other Windows databases): file header and state, 2 to 32 KiB pages with both page header and tag layouts, B+ trees, the catalog, fixed, variable, tagged, multi-valued and long values, and the column compression of Windows 8 and later (7-bit text and XPRESS). Tested on databases written by Windows' own esent.dll (scripts/make_srum_fixture.py, 4 KiB and 32 KiB pages, and a tree of three levels), and against a real Windows 10 22H2 SRUDB.dat: all 310,255 rows of its 16 tables, 2,800,979 values, read the same as through esent.dll (VALIDATION.md). That check found and fixed two problems before release: branch pages above the parents of leaves were not followed (Windows marks them with neither page flag), so large tables such as SRUM's id map read as empty; and UTF-16 text in columns declared as ANSI was cut after its first character. SRUM program ids of the form !!<file>!<date>!... are shown by their file name.
• BAM and DAM (SYSTEM hive, Windows 10 1709 and later): the last run of each program per user, under "Programs run" (sources BAM and DAM) and on the Timeline; SIDs are shown as account names, and a wiping tool found there counts for tool_execution_record.
• Two anti-forensics indicators (24 in total): usn_wipe_rename (the change journal shows files renamed AAAA.AAA to ZZZZ.ZZZ, SDelete's pattern; the journal keeps the original names) and usn_journal_recreated (the journal was created long after the volume, as when it is deleted and recreated).
• Fuzz targets indx (folder index records and $LogFile pages), usn, shellbags and ese (with SRUM on top), and more rounds of ntfs (now that it reads indexes and $LogFile) and registry: 87,410,557 inputs, no problems found. Totals: 319,500,138 inputs over 25 targets (SECURITY.md).
• Test image disk-win.img now also holds UsrClass.dat with ShellBags, a change journal, BAM and DAM entries, a SRUM database and a Wi-Fi profile (scripts/make_win_fixture.py); scripts/validate_cfreds.py counts names on NTFS too and can run one file system.

Changed

• An NTFS record that cannot be parsed now gets its name back from its folder's index when the index still lists it, with a note pointing at the unreadable record (the testfs1 fixture has one, a record split over two MFT runs).
• Hashing (and kokino files) skip name-only entries, which have no content.
• Analysis schema 6. On NTFS evidence analyzed by an earlier version, the System summary says that the change journal, ShellBags, BAM/DAM, SRUM and recovered names are missing until it is analyzed again, with a Re-analyze button.