Kokino Forensic Toolkit 1.2.8

Kokino Forensic Toolkit 1.2.8: deeper NTFS and Windows.

Download

System	Package
Windows 10/11 (x64)	kokino-1.2.8-windows-x64.msi (installer) or .zip
Linux (x86_64)	kokino_1.2.8_amd64.deb (Debian, Ubuntu, Kali) or .tar.gz
macOS 12+ (Intel and Apple Silicon)	kokino-1.2.8-macos-universal.dmg

Check downloads against SHA256SUMS.txt. The packages are not code-signed yet: on Windows choose "More info", then "Run anyway"; on macOS right-click "Start Kokino", choose Open, then Open again. The MSI upgrades an installed version in place; cases and accounts are kept. If you run 1.2.7, "Check for updates" on the About page (or kokino version --check) shows this release.

New: the NTFS change journal ($UsnJrnl) with every file created, renamed and deleted; names of deleted files whose MFT record was reused, from folder index slack and $LogFile; ShellBags; BAM/DAM; and SRUM (network and disk use per program, hour by hour), read with Kokino's own ESE database reader and checked against Windows' own esent.dll on a real Windows 10 database: all 310,255 rows the same (VALIDATION.md). Two new anti-forensics indicators (24 in all). Parsers fuzzed with 319 million inputs, no new findings (SECURITY.md). NTFS evidence analyzed with an earlier version needs a re-analysis to show the new artifacts; the System summary offers it. Next: Ex01, macOS artifacts and APFS snapshots (ROADMAP.md).

Changes

Deeper NTFS and Windows: the change journal, names of deleted files from folder index slack and $LogFile, ShellBags, BAM/DAM and SRUM with Kokino's own ESE database reader.

Added

• NTFS: names of deleted files whose MFT record was reused, recovered from folder index slack ($I30), the indexes of deleted folders, and $LogFile (which records every index change with the entry). Each is listed as a deleted, name-only entry with its $FILE_NAME times and size, the MFT record it had and a note saying where it was found and what that record holds now; earlier names of renamed or moved files are listed the same way. They have no content (reads say so) and are skipped by hashing. On the NIST CFReDS NTFS images the deleted files listed now match NIST's counts closely (case 08 exactly, VALIDATION.md); the missing names were mostly in $LogFile, not in index slack as VALIDATION.md had assumed. Hard links are recognized as second names of the same record.
• NTFS change journal ($Extend$UsnJrnl:$J, record versions 2 and 3, and $Max): every record read (sparse parts skipped), records of one round of changes combined into one change (created, data written, renamed with the old name, deleted, ...), paths rebuilt from today's folders or, for folders that are gone, from the journal itself, and each change linked to the file on the volume when its MFT reference and name match. New System summary page "Change journal" (filter by kind and path, paged), a journal summary on the overview (period covered, counts, when the journal was created), a "Change journal" section in the file details, and created, deleted and renamed files on the Timeline (source USN). Up to 250,000 changes are kept (the newest); the summary says when older ones were dropped.
• ShellBags: every folder a user opened in Explorer, from UsrClass.dat (Windows 7 and later) and NTUSER.DAT (BagMRU and ShellNoRoam), with full paths rebuilt from the shell items (drives, folders with long names, network shares, ZIP folders, known folders, URIs, delegate items), last opened time, the folder's own times and MFT reference, and a link to the folder when it is on this volume. New System summary page "Folders (ShellBags)"; opened folders on the Timeline.
• SRUM (System Resource Usage Monitor, Windows\System32\sru\SRUDB.dat): per program and user, hour by hour, bytes sent and received over which network and interface, disk bytes read and written and processor time, for the last 30 to 60 days, and network connections with their start and length. Program paths, services and user SIDs are resolved through SruDbIdMapTable and the accounts; Wi-Fi networks by name through WlanSvc's profile index and the profile XML files. New System summary page "Network use (SRUM)" (programs by data sent, each program's hours, connections), hours in which a program sent 100 MiB or more and connections on the Timeline, the top senders in the summary and the case report. A database that was not cleanly closed is reported (its newest hours may be only in the transaction logs, which are not read).
• ESE database reader (new module kokino_artifacts::ese, "Jet Blue", used by SRUM and later by other Windows databases): file header and state, 2 to 32 KiB pages with both page header and tag layouts, B+ trees, the catalog, fixed, variable, tagged, multi-valued and long values, and the column compression of Windows 8 and later (7-bit text and XPRESS). Tested on databases written by Windows' own esent.dll (scripts/make_srum_fixture.py, 4 KiB and 32 KiB pages, and a tree of three levels), and against a real Windows 10 22H2 SRUDB.dat: all 310,255 rows of its 16 tables, 2,800,979 values, read the same as through esent.dll (VALIDATION.md). That check found and fixed two problems before release: branch pages above the parents of leaves were not followed (Windows marks them with neither page flag), so large tables such as SRUM's id map read as empty; and UTF-16 text in columns declared as ANSI was cut after its first character. SRUM program ids of the form !!<file>!<date>!... are shown by their file name.
• BAM and DAM (SYSTEM hive, Windows 10 1709 and later): the last run of each program per user, under "Programs run" (sources BAM and DAM) and on the Timeline; SIDs are shown as account names, and a wiping tool found there counts for tool_execution_record.
• Two anti-forensics indicators (24 in total): usn_wipe_rename (the change journal shows files renamed AAAA.AAA to ZZZZ.ZZZ, SDelete's pattern; the journal keeps the original names) and usn_journal_recreated (the journal was created long after the volume, as when it is deleted and recreated).
• Fuzz targets indx (folder index records and $LogFile pages), usn, shellbags and ese (with SRUM on top), and more rounds of ntfs (now that it reads indexes and $LogFile) and registry: 87,410,557 inputs, no problems found. Totals: 319,500,138 inputs over 25 targets (SECURITY.md).
• Test image disk-win.img now also holds UsrClass.dat with ShellBags, a change journal, BAM and DAM entries, a SRUM database and a Wi-Fi profile (scripts/make_win_fixture.py); scripts/validate_cfreds.py counts names on NTFS too and can run one file system.

Changed

• An NTFS record that cannot be parsed now gets its name back from its folder's index when the index still lists it, with a note pointing at the unreadable record (the testfs1 fixture has one, a record split over two MFT runs).
• Hashing (and kokino files) skip name-only entries, which have no content.
• Analysis schema 6. On NTFS evidence analyzed by an earlier version, the System summary says that the change journal, ShellBags, BAM/DAM, SRUM and recovered names are missing until it is analyzed again, with a Re-analyze button.