Kokino Forensic Toolkit 1.6.1

Kokino Forensic Toolkit 1.6.1: AFF4 disk images and AFF4-L and AccessData AD1 logical images, deleted Outlook messages from the PST's free space, and carving that joins Office documents, ZIP files and PDFs split in two pieces.

Website: https://zeroscience.github.io/kokino-ftk/

Download

System	Package
Windows 10/11 (x64)	kokino-1.6.1-windows-x64.msi (installer) or .zip
Linux (x86_64)	kokino_1.6.1_amd64.deb (Debian, Ubuntu, Kali) or .tar.gz
macOS 12+ (Intel and Apple Silicon)	kokino-1.6.1-macos-universal.dmg

Check downloads against SHA256SUMS.txt, or verify the signed build provenance with gh attestation verify <file> --repo zeroscience/Kokino; kokino-1.6.1-sbom.cdx.json lists every crate in the build. The packages are not code-signed yet: on Windows choose "More info", then "Run anyway"; on macOS right-click "Start Kokino", choose Open, then Open again. The MSI upgrades an installed version in place; cases and accounts are kept.

Added

• AFF4 disk images. The AFF4 Standard v1.0 that Evimetry and pyaff4 write: maps over image streams compressed with snappy, LZ4 or deflate, sparse images, and striped sets (pick any container; the others are found next to it). The Summary shows the case notes, the device and any read errors the imager recorded; unreadable parts read as the text UNREADABLEDATA, as the standard defines. Checked on the AFF4 reference images: every image stream matches its recorded hashes, and the same device imaged three ways reads the same.
• AD1 and AFF4-L logical images. FTK Imager custom content images (AD1 versions 3 and 4, any number of segments) and AFF4-L containers are read as file systems, with the names, times and hashes they recorded and the deleted files FTK captured. On the FTK Imager test image every file matches the MD5 FTK recorded. Encrypted AD1 images are recognized and refused.
• Deleted Outlook messages from free space. When nothing of a deleted message is left in the PST's index, Kokino finds its blocks by their trailers and brings it back, leaving out old copies of messages that still exist. On the public samples: two deleted messages in an Outlook 2013 OST, one with its attachments.
• Carving. Office documents, OpenDocument files and ZIP archives split in two pieces are joined through their central directory and the CRC of the entry the break falls in; PDFs with a cross-reference table through the table and their compressed streams. A join is kept only when exactly one break fits.

Changed

• The server's cases folder (its account name and folder layout) is shown to administrators only.

Parsers fuzzed with 942 million inputs over 43 targets; the two new targets (AD1 and AFF4) found three problems, all fixed before release (43 in all over Kokino's life). Full details are in the changelog and the roadmap.