Kokino Forensic Toolkit 1.3.2

Kokino Forensic Toolkit 1.3.2: the built-in wiki brought up to date with 1.3.1. No changes to analysis; if you run 1.3.1, this release only updates the help pages.

Download

System	Package
Windows 10/11 (x64)	kokino-1.3.2-windows-x64.msi (installer) or .zip
Linux (x86_64)	kokino_1.3.2_amd64.deb (Debian, Ubuntu, Kali) or .tar.gz
macOS 12+ (Intel and Apple Silicon)	kokino-1.3.2-macos-universal.dmg

Check downloads against SHA256SUMS.txt, or verify the signed build provenance with gh attestation verify <file> --repo zeroscience/Kokino; kokino-1.3.2-sbom.cdx.json lists every crate in the build. The packages are not code-signed yet: on Windows choose "More info", then "Run anyway"; on macOS right-click "Start Kokino", choose Open, then Open again. The MSI upgrades an installed version in place; cases and accounts are kept.

Changed

• Wiki: the macOS system summary (accounts, launchd persistence, quarantine downloads, KnowledgeC, FSEvents, Safari) is under Mac disks, which still said macOS artifacts were not read; carving of decrypted BitLocker volumes; the new validation images (dfvfs shadow copies and BitLocker To Go, the public PST and OST samples) with thanks to their authors; release integrity (SBOM and signed provenance) under Security; and the About page's description of what Kokino reads.

Everything new in the 1.3 line is in the 1.3.1 release notes and the changelog.