Kokino Forensic Toolkit 1.3.1

Kokino Forensic Toolkit 1.3.1: encrypted, shadowed, collected and Mac.

Download

System	Package
Windows 10/11 (x64)	kokino-1.3.1-windows-x64.msi (installer) or .zip
Linux (x86_64)	kokino_1.3.1_amd64.deb (Debian, Ubuntu, Kali) or .tar.gz
macOS 12+ (Intel and Apple Silicon)	kokino-1.3.1-macos-universal.dmg

Check downloads against SHA256SUMS.txt. New in this release: kokino-1.3.1-sbom.cdx.json (CycloneDX SBOM: every crate with its version, checksum and license) and a signed build provenance attestation for every file, checked with gh attestation verify <file> --repo zeroscience/Kokino. The packages are not code-signed yet: on Windows choose "More info", then "Run anyway"; on macOS right-click "Start Kokino", choose Open, then Open again. The MSI upgrades an installed version in place; cases and accounts are kept. If you run 1.3.0, "Check for updates" on the About page (or kokino version --check) shows this release.

New

• BitLocker (Windows 7 and later, BitLocker To Go): each encrypted volume listed with its method and key protectors; unlock with the password, the 48-digit recovery password or the startup key (.BEK). The decrypted volume is analyzed like any other, its free space carved decrypted, its shadow copies read. Volumes with protection suspended open without asking. The volume key stays with the case, never the password; unlocks and failed attempts are audited. --bitlocker-password, --recovery-password and --startup-key on the command line.
• Volume Shadow Copies: every snapshot of an NTFS volume rebuilt and read as a volume of its own.
• Disk images inside evidence (E01, VHD, VHDX, VMDK, ISO, raw) listed and extracted as evidence of their own, verified and audited.
• Triage collections: Velociraptor and KAPE ZIPs, UAC tar and tar.gz, and collections copied out as plain folders (packed into the case with a manifest of every file's SHA-256), with artifacts read at the paths they had on the collected system.
• Outlook PST and OST (ANSI, Unicode, the compressed OST of Outlook 2013+; encrypted or not; any size, read in place): every message with its folder, recipients, attachments and text, including RTF-only bodies; Apple Mail (.emlx).
• macOS: version, computer name, setup date, accounts, launchd persistence, quarantine downloads, KnowledgeC app use, FSEvents (also on USB drives a Mac wrote to), Safari history and downloads, shell histories in /Users.
• WebCache of Internet Explorer 10 and 11 and the old Edge: history, cache, cookies, downloads.
• VHDX log replay: disks not shut down cleanly read with their log applied in memory.
• Correlation: a case page listing what its evidence items have in common (users, computers, email addresses, IPs, USB serials, Wi-Fi networks, web domains, identical files).

Checked on public test images (dfvfs vss.raw and BitLocker To Go, public PST and OST samples) and on test files written by Windows' own database engine; see VALIDATION.md. Parsers fuzzed with 656 million inputs in all; this release's new parsers found 8 problems, all fixed before release (SECURITY.md). Full list in the changelog.