Repository navigation
Kokino Forensic Toolkit 1.5.0
Kokino Forensic Toolkit 1.5.0: watchlists from STIX 2.1 and MISP with each sweep compared with the last, plugins for artifacts Kokino does not read itself, CD-R and DVD-RW discs, ESXi snapshots, JPEGs carved from two pieces, names of long-deleted files from the ext journal, more of SRUM, and dates shown day first.
Website: https://zeroscience.github.io/kokino-ftk/
Download
| System | Package |
|---|---|
| Windows 10/11 (x64) | kokino-1.5.0-windows-x64.msi (installer) or .zip |
| Linux (x86_64) | kokino_1.5.0_amd64.deb (Debian, Ubuntu, Kali) or .tar.gz |
| macOS 12+ (Intel and Apple Silicon) | kokino-1.5.0-macos-universal.dmg |
Check downloads against SHA256SUMS.txt, or verify the signed build provenance with gh attestation verify <file> --repo zeroscience/Kokino; kokino-1.5.0-sbom.cdx.json lists every crate in the build. The packages are not code-signed yet: on Windows choose "More info", then "Run anyway"; on macOS right-click "Start Kokino", choose Open, then Open again. The MSI upgrades an installed version in place; cases and accounts are kept.
Added
- Watchlist from STIX 2.1 and MISP. Paste or load a STIX 2.1 bundle (indicator patterns and observables) or a MISP event export (attributes, object attributes, composite types such as filename|sha256). IP networks in CIDR form work in any list. Each sweep is compared with the previous one: new hits are marked, with an "Only new" filter. Up to 50,000 indicators.
- Plugins. Separate programs, in any language, for artifacts Kokino does not read. A plugin gets a copy of every matching file (never the evidence itself) and prints JSON rows, shown on the evidence item's new Plugins page and with
kokino plugins. Off unless the server is started with--plugins <folder>; every run is in the audit log with the SHA-256 of the plugin's files. Example:plugins/internet-shortcut. - Written CDs and DVDs. UDF sparable partitions (DVD-RW, CD-RW) are read through their sparing table; virtual partitions (CD-R, DVD-R written in sessions) through the VAT. Files a later session removed are listed as deleted, from the earlier sessions' VATs.
- ESXi snapshots. VMFSSPARSE (-delta.vmdk) and SESPARSE (-sesparse.vmdk) snapshots with their parent disks.
- Carving. JPEGs split in two pieces across free space are joined again, kept only when the joined picture decodes exactly.
- ext3 and ext4. Names of files deleted long ago, from older copies of their folders in the journal, also when the inode now belongs to another file (704 more deleted names on NIST's ext-10, nothing else changed).
- SRUM. Per program, time in the foreground and with keyboard or mouse input; push notifications; battery charge and time on battery.
Changed
- Dates day first. dd-mm-yyyy by default in the GUI, the case reports, the analysis summaries (always UTC) and shadow copy names. ISO and US order and any time zone remain a choice under Time. Stored data, JSON and CSV exports and audit logs stay ISO 8601. Summaries of evidence analyzed before 1.5.0 keep their old wording until it is analyzed again.
- Golden results now cover 42 analyses; parsers fuzzed with 749 million inputs over 41 targets, 40 problems found and fixed.
Fixed
- SRUM per-program totals could overflow on a damaged database; a STIX pattern with a multi-byte character could stop the watchlist parser (both found by fuzzing).