Kokino Forensic Toolkit 1.6.0

Kokino Forensic Toolkit 1.6.0: plugin rows on the timelines and in the watchlist, kokino plugin-test with a guide for writing plugins, carving of JPEGs in three pieces and PNGs in two, deleted Outlook messages recovered from the PST's index, and the NIST CFReDS validation running every week on GitHub.

Website: https://zeroscience.github.io/kokino-ftk/

Download

System	Package
Windows 10/11 (x64)	kokino-1.6.0-windows-x64.msi (installer) or .zip
Linux (x86_64)	kokino_1.6.0_amd64.deb (Debian, Ubuntu, Kali) or .tar.gz
macOS 12+ (Intel and Apple Silicon)	kokino-1.6.0-macos-universal.dmg

Check downloads against SHA256SUMS.txt, or verify the signed build provenance with gh attestation verify <file> --repo zeroscience/Kokino; kokino-1.6.0-sbom.cdx.json lists every crate in the build. The packages are not code-signed yet: on Windows choose "More info", then "Run anyway"; on macOS right-click "Start Kokino", choose Open, then Open again. The MSI upgrades an installed version in place; cases and accounts are kept.

Added

• Plugin rows everywhere. Dated rows plugins report are on each evidence item's timeline and the case timeline (source PLUGIN, with a Plugins filter), and the watchlist searches every row's text and fields. A row opens the file it came from.
• For plugin authors. kokino plugin-test <plugin folder> <sample file> --as <path on the volume> runs a plugin on one file exactly as a real run does and reports whether the path matches, rows without a readable time and rows without "what". plugins/README.md walks through writing one, with templates in Python, PowerShell and sh.
• Carving. JPEGs split in three pieces are joined too (a run of JPEG data between the first and last piece as the middle one), and PNGs split in two pieces through their chunk CRCs: a join is kept only when the picture decodes exactly, or every PNG chunk checks out up to the end.
• Deleted Outlook messages. When Outlook deletes an item its entry often stays in an unused slot of the PST's node index; such messages whose data is still intact are listed as deleted ("[recovered deleted item]") and searched.
• Validation every week. A scheduled GitHub workflow downloads the 83 NIST CFReDS deleted-file-recovery images, analyzes them and compares every image's numbers with the recorded ones; its first run matched all 83.
• The website is linked from the About page and the wiki, with Zero Science Lab as developer.

Parsers fuzzed with 868 million inputs over 41 targets; 40 problems found and fixed over Kokino's life, none in this release. Full details are in the changelog and the roadmap.