Kokino Forensic Toolkit 1.2.9

Kokino Forensic Toolkit 1.2.9: scheduled tasks, Internet Explorer history and deleted registry keys.

Download

System	Package
Windows 10/11 (x64)	kokino-1.2.9-windows-x64.msi (installer) or .zip
Linux (x86_64)	kokino_1.2.9_amd64.deb (Debian, Ubuntu, Kali) or .tar.gz
macOS 12+ (Intel and Apple Silicon)	kokino-1.2.9-macos-universal.dmg

Check downloads against SHA256SUMS.txt. The packages are not code-signed yet: on Windows choose "More info", then "Run anyway"; on macOS right-click "Start Kokino", choose Open, then Open again. The MSI upgrades an installed version in place; cases and accounts are kept. If you run 1.2.8, "Check for updates" on the About page (or kokino version --check) shows this release.

New: scheduled tasks from the task files and the registry's TaskCache, with tasks hidden from the Task Scheduler flagged (the Tarrask technique); Internet Explorer 4 to 9 history, cache and downloads from index.dat, with deleted entries inside the files and records carved one by one from free space; and deleted registry keys and values recovered from the hives' free cells. Checked on Digital Detective's practice case: from the formatted disk, all 15 index.dat files and all 5,920 of their records come back, the same counts as the live files (VALIDATION.md). Two new anti-forensics indicators (26 in all). Parsers fuzzed with 380 million inputs; one new problem found and fixed before release (SECURITY.md). Evidence analyzed with an earlier version needs a re-analysis to show the new artifacts; the System summary and Web activity offer it, and the Carved files page suggests carving again. Next: Ex01, macOS artifacts and APFS snapshots (ROADMAP.md).

Changes

More Windows: scheduled tasks (hidden ones flagged), Internet Explorer history with records recovered from free space, and deleted registry keys and values.

Added

• Scheduled tasks (new module kokino_artifacts::task): every task file under Windows\System32\Tasks (author, registration date, account and privilege level, triggers in plain words, what it runs, hidden and disabled flags) joined with the registry's TaskCache (SOFTWARE), which adds when each task was created and last ran, the result of its last run, and a binary copy of its actions for tasks whose file is gone. Shown in a new "Scheduled tasks" card in the System summary (Windows' own tasks behind a toggle), with tasks that are not Windows' own, or run from unusual places, in the autostart list; task registrations and last runs on the Timeline; a table in the case report and lines in the impact summary. Tasks registered without a task file, and task files no longer registered, are marked. Checked on a real Windows 7 SOFTWARE hive (83 tasks, VALIDATION.md).
• Anti-forensics indicator task_hidden_sd (25 in total): a task whose TaskCache\Tree key lost its SD value, which hides it from schtasks and the Task Scheduler while it keeps running (the Tarrask technique). Only where the hive's other tasks have an SD value: Windows 7 writes none.
• Deleted registry keys and values (Hive::deleted in kokino_artifacts::registry): the free space of every hive bin is searched for key and value cells that Windows freed but did not clear. Each deleted key gets the path of the live key it belonged to (through deleted parents too), its last-written time and the values whose cells are still free; values whose data cell is in use again are marked. Older copies of keys that still exist (Windows leaves one when it moves a key) are recognized, and only the values they hold that the live key no longer has are reported, as deleted values of that key; values found on their own are listed without a key. New System summary page "Deleted registry" (filter, only keys that record user activity, details per key), deleted keys on the Timeline (source REG), a table in the case report, a line in the impact summary, and counts (--full: every key and value) in kokino artifact for a hive. Keys that record user activity (recent documents, the Run box, typed paths and addresses, dialog history, Explorer searches, UserAssist, ShellBags, mounted drives, Office recent files, Run, USB devices, networks, remote desktop, BAM) are named. Transaction logs (.LOG1/.LOG2) are still not applied.
• Anti-forensics indicator registry_traces_deleted (26 in total): a whole key that records user activity found deleted, which is what cleaners such as CCleaner do (Windows trims these lists one entry at a time).
• Fuzz target task (task XML, the Actions and DynamicInfo blobs, TaskCache in a hive): 19,733,957 inputs, no problems found.
• Test image disk-win.img now holds four scheduled tasks: one of Windows' own, one running from C:\Users\Public, one hidden Tarrask-style and one registered without a task file.
• Internet Explorer history (new module kokino_artifacts::iecache, the index.dat format of Internet Explorer 4 to 9): the main history, daily and weekly history files, protected-mode (Low) history, the cache (Content.IE5) and IE 9's download list are read into Web activity next to Chrome and Firefox. Visits with page titles and visit counts (local files opened through Explorer appear as file: visits), cached files with their cache folder and file name, content type and hits, downloads with source URL, referring page, saved path and bytes received, and search terms from visited search pages. Every 128-byte block is checked, so deleted entries still inside the file are listed too, marked "deleted entry"; LEAK entries (deleted, but the cached file was still in use) are marked. A last visit that the main file repeats from a daily file is shown once. Daily files keep each visit time also in local time, so the source card says what the computer's clock was set to while browsing. New "IE cache" list in Web activity; visits on the Timeline; IE sources in the case report and the impact summary.
• Carving recovers Internet Explorer records from free space: every 128-byte boundary of free clusters and unpartitioned space is checked for a history, cache, cookie, download or redirect record (records keep that alignment when index.dat is deleted), and whole index.dat files are carved as files. New "ie-records" list on the Carved files page; kokino carve lists the records after the files.
• kokino artifact reads an exported index.dat (counts by record type, deleted records, cache folders; --full for every record).
• Validation on Digital Detective's practice files (VALIDATION.md): all 16 index.dat files of the Windows 7 laptop read, and the formatted E01 of the same case gives back all 15 index.dat files whole and all 5,920 of their records from free space, the same counts as the live files. That check found and fixed two problems before release (records inside a carved file longer than the 1 MiB read window were skipped; the clock offset was truncated to UTC+02:45 instead of rounded to UTC+03:00).
• Fuzz target iecache (index.dat, the conversion of each kind of file, and records read from free space at every 128-byte boundary): 21,653,615 inputs; it found one problem before release (a record cut off by the end of the file, with its data offset past the bytes that exist, panicked), fixed and kept as a regression input. A further round of registry, which now also recovers deleted keys and values: 18,700,883 inputs, no problems found. Totals: 379,588,593 inputs over 27 targets, 29 problems found and fixed (SECURITY.md).
• Test image disk-win.img now holds deleted registry keys: in alice's NTUSER.DAT a TypedURLs key deleted with its Internet Explorer parent, the SDelete EULA key deleted with its Sysinternals parent, and an older copy of RunMRU that still holds an entry removed since; in her UsrClass.dat a value on its own.
• Test image disk-win.img now holds Internet Explorer files for alice (a daily history with a search, a visit seen again in the main file and a deleted entry; the main history with a local file opened; the cache with a LEAK entry; a download) and, after the volume, a deleted index.dat and two loose records for carving.

Changed

• Analysis schema 9 (7: scheduled tasks; 8: Internet Explorer; 9: deleted registry keys). NTFS evidence analyzed by an earlier version is offered a re-analysis in the System summary and in Web activity, which name what is missing.
• Carving results schema 2. Results from an earlier version still open; the Carved files page suggests carving again to look for Internet Explorer records.
• The browser_history_cleared indicator counts only Internet Explorer's main history files: cache and download lists hold no visits, and Windows deletes daily and weekly history files itself as they age. Searches such as "clear ie history" now count for antiforensic_web.
• The server test of session expiry no longer fails on a computer that has been up for less than the idle timeout (it could not move a time back past the system's start).
• The carving samples memo.doc and security.evtx-chunk moved from the test volume's free clusters to the unpartitioned space after it, to make room for the task files, the index.dat files and the larger SOFTWARE hive.