Kokino Forensic Toolkit 1.3.0

Kokino Forensic Toolkit 1.3.0: email, exports and older systems.

Download

System	Package
Windows 10/11 (x64)	kokino-1.3.0-windows-x64.msi (installer) or .zip
Linux (x86_64)	kokino_1.3.0_amd64.deb (Debian, Ubuntu, Kali) or .tar.gz
macOS 12+ (Intel and Apple Silicon)	kokino-1.3.0-macos-universal.dmg

Check downloads against SHA256SUMS.txt. The packages are not code-signed yet: on Windows choose "More info", then "Run anyway"; on macOS right-click "Start Kokino", choose Open, then Open again. The MSI upgrades an installed version in place; cases and accounts are kept. If you run 1.2.9, "Check for updates" on the About page (or kokino version --check) shows this release.

New: an Email page for mbox mailboxes (Thunderbird, /var/mail) and .eml files, with message text, headers and attachments, the messages Thunderbird deleted but still holds, email on the timeline and in full-text search; every list as CSV or JSON, from the GUI or with kokino export, each export hashed and audited; registry transaction logs applied as Windows would, identical to Windows' own recovery on public test hives (VALIDATION.md); text of Word, Excel and PowerPoint 97-2003, Outlook .msg and RTF in search; Windows XP and 2003 event logs (.evt); Internet Explorer cookies; and compressed journald fields. Parsers fuzzed with 567 million inputs, no new findings (SECURITY.md). Evidence analyzed with an earlier version needs a re-analysis to show the new artifacts; Kokino offers it. Next: Volume Shadow Copies, BitLocker with a recovery key and triage collection import (ROADMAP.md).

Changes

Email, exports and older systems: mbox and .eml mail, every list as CSV or JSON, registry transaction logs, text of legacy Office files, Windows XP event logs, Internet Explorer cookies and compressed journald fields.

Added

• Exports of every list as CSV or JSON: files (with $SI and $FN times and, after hash analysis, MD5, SHA-1 and SHA-256), the timeline, anti-forensics indicators, web visits, downloads, searches and the Internet Explorer cache, Windows programs run, files opened, ShellBags, the change journal, autostart entries, scheduled tasks, installed programs, USB devices, networks, accounts, notable events, deleted registry keys and values and SRUM, the Linux shell history, logons, events, packages and persistence, and carved files and Internet Explorer records. Times are ISO 8601 UTC and both formats have the same columns; CSV has a UTF-8 byte-order mark and puts an apostrophe before a cell that starts like a spreadsheet formula, JSON keeps every value exactly. Each export is saved in the case's exports folder and its SHA-256 recorded in the case audit log. In the GUI: "Export lists" on the evidence summary (every list with its row count), and CSV and JSON buttons on the Timeline, Web activity and Carved files pages; reviewers cannot export, as with files. On the command line: kokino export <case folder> [evidence] [list|all] [--fs N] [--format csv|json].

• Text of legacy Office files for full-text search (new module kokino_analysis::oletext): Word 97-2003 through the piece table (8-bit and UTF-16 pieces, field codes dropped and field results kept), Excel 97-2003 shared strings (including strings split over CONTINUE records), older LABEL cells and sheet names, PowerPoint 97-2003 text atoms, Outlook .msg text properties (subject, body, sender, recipients, attachment names), and the document properties of any OLE file (title, subject, author, keywords, comments, last saved by). RTF text, with 'hh and \u escapes decoded and font tables, pictures and other non-text groups skipped. Live, deleted and carved files alike; encrypted Word and Excel files are reported.

• Registry transaction logs (new module kokino_artifacts::reglog): a hive that was not cleanly saved gets the changes still in its .LOG1 and .LOG2 (.LOG on Windows XP) applied in memory before it is read, as Windows would on its next start. Both formats: Windows 8.1 and later (log entries checked with their Marvin32 checksums and applied in sequence order across both logs, the replay stopping at the first damaged or missing entry) and Windows XP to 8 (dirty sector bitmap). A damaged log is not used, and the Sources list says what was applied or why not. kokino artifact applies logs found next to a hive and reports it. Checked against Windows' own recovery on public test hives (VALIDATION.md): identical for the new format; for the old format identical apart from two fields Windows rewrites whenever it loads a hive.

• Fuzz target reglog (58,565,421 inputs) and a further round of doc with Word, Excel, PowerPoint, Outlook and RTF seeds (37,498,697 inputs): no problems found. Totals: 475,652,711 inputs over 28 targets, 29 problems found and fixed (SECURITY.md).

• Test image disk-win.img: alice's UsrClass.dat is left as Windows leaves a hive it has not flushed (the sector with the ShellBags root key only in UsrClass.dat.LOG1), so the ShellBags tests also test the log replay.

• Legacy Windows event logs (.evt, Windows NT to Server 2003; new module kokino_artifacts::evt): SecEvent.Evt, SysEvent.Evt and AppEvent.Evt are read like EVTX, including records left in the unused part of the circular log and records that wrap around its end. Security events of those Windows versions get the field names Vista and later use, so they appear under Events with their user, logon type and address and count for the indicators: logons (528, 540), failed logons (529 to 539), log cleared (517), process started (592, also under Programs run), accounts created, enabled, disabled, deleted and reset (624 to 630, 644), group changes (632, 636, 660), service installed (601), audit policy (612) and time changed (520). Windows XP profiles under Documents and Settings (NTUSER.DAT, UsrClass.dat, Recent shortcuts) and a Windows 2000 \WINNT folder are found. kokino artifact reads .evt files.

• Internet Explorer cookies: the Cookies folders' index.dat joined with each site's cookie text file (name, value, site and path, created, expires, flags, and from the index when the site's cookies were last used). Cookie files the index no longer lists and index entries whose file is gone are listed and marked. New "IE cookies" list in Web activity, CSV/JSON export. On Digital Detective's practice case: 222 cookies from 87 sites, and two deleted index entries whose cookie files are gone (VALIDATION.md).

• systemd journal: fields journald stored compressed are decoded (XZ and zstd with the pure-Rust lzma-rs and ruzstd crates, LZ4 by Kokino itself), instead of being counted and skipped.

• Email (new module kokino_analysis::mail): mbox mailboxes (Thunderbird and SeaMonkey mail folders, /var/mail and /var/spool/mail, .mbox and .mbx files) and .eml files, live and deleted. Every message with its date, sender, recipients, subject, attachments and the first words of its text; headers in encoded words, bodies in quoted-printable or base64 and in their character set, HTML without markup, attached messages and nested multiparts. Messages Thunderbird deleted but has not yet removed from the file (X-Mozilla-Status 0x0008) are marked. New Email page (mailboxes, filter, message text, all headers, attachments with audited export), email on the Timeline (source MAIL), a line in the impact summary, CSV/JSON export, and message text and document attachments in the full-text index.

• Fuzz targets evt (30,689,834 inputs), mail (7,542,816) and journalz (journald's XZ, LZ4 and zstd, 45,374,291), and a further round of linuxlogs with a journal holding compressed fields (7,898,202): no problems found. Totals: 567,157,854 inputs over 31 targets, 29 problems found and fixed (SECURITY.md).

Changed

• Analysis schema 10. Evidence analyzed by an earlier version is offered a re-analysis in the System summary, Web activity and the Email page.
• The anti-forensics rules evtx_cleared and log_cleared_event cover Windows XP and 2003 too: a SecEvent.Evt no larger than a reset log (64 KiB), and event 517.
• The Windows test image's carving sample draft.docx is now built with a fixed time, so the test images are the same every time they are built.
• The carving sample order on the test volume changed (the new log file took free clusters); the carving test was updated.