Kokino Forensic Toolkit 1.4.0

Kokino Forensic Toolkit 1.4.0 works on a whole case at once: one timeline across every evidence item, a watchlist that sweeps every item for known indicators, and golden results that check what Kokino finds in every test image on every commit.

1.4 is the last feature release for a few months. Security reports and wrong results (an artifact read incorrectly, a crash on real evidence) are still fixed in 1.4.x releases; ROADMAP.md lists what comes after the pause, in order, with what each item needs.

Download

System	Package
Windows 10/11 (x64)	kokino-1.4.0-windows-x64.msi (installer) or .zip
Linux (x86_64)	kokino_1.4.0_amd64.deb (Debian, Ubuntu, Kali) or .tar.gz
macOS 12+ (Intel and Apple Silicon)	kokino-1.4.0-macos-universal.dmg

Check downloads against SHA256SUMS.txt, or verify the signed build provenance with gh attestation verify <file> --repo zeroscience/Kokino; kokino-1.4.0-sbom.cdx.json lists every crate in the build. The packages are not code-signed yet: on Windows choose "More info", then "Run anyway"; on macOS right-click "Start Kokino", choose Open, then Open again. The MSI upgrades an installed version in place; cases and accounts are kept.

Added

• Case timeline. A case page that merges the timelines of every analyzed evidence item and volume into one, in time order: file times, browser activity and system events. Each row names its item and volume and opens there. Filter by text, day range and kind.

• Watchlist. Paste a list of indicators and search every evidence item of the case at once:

  • MD5, SHA-1 and SHA-256 against Hash analysis;
  • file names and path fragments, deleted files included;
  • domains and URLs in web visits, downloads, cache, cookies and email addresses;
  • email addresses (From, To, Cc);
  • IP addresses in Windows and Linux events and logons.

  Comments and notes are kept, and defanged forms (hxxp://, [.], [@]) are read. Each hit opens where it was found. The list can be saved with the case; saves and sweeps are recorded in the audit log. Reviewers can run sweeps.

• Golden results. All the test images (38 analyses, BitLocker locked and unlocked) are checked on every commit, on Windows, Linux and macOS. Each check compares the volumes, file statistics, score, the size of every artifact list and a digest of the file listing.

• Fuzzing. A new fuzz target for the watchlist parser found that an IPv4-mapped indicator (::ffff:192.0.2.1) matched nothing; it was fixed before release. Totals: 670 million inputs over 40 targets, 38 problems found and fixed.

Changed

• Roadmap rewritten: done by area, then a prioritized list for after the pause. It starts with checks on real Mac disks, then APFS encryption, snapshots and LZFSE, Windows Search, XFS and Ex01. The About page has a What's next card.

Full details are in the changelog.