Repository navigation
Kokino Forensic Toolkit 1.6.2: Ex01 images (EnCase 7 and later), PDF carving that also joins PDFs with cross-reference streams and linearized PDFs, and HashKeeper and hashdeep hash sets.
Website: https://zeroscience.github.io/kokino-ftk/
Download
| System | Package |
|---|---|
| Windows 10/11 (x64) | kokino-1.6.2-windows-x64.msi (installer) or .zip |
| Linux (x86_64) | kokino_1.6.2_amd64.deb (Debian, Ubuntu, Kali) or .tar.gz |
| macOS 12+ (Intel and Apple Silicon) | kokino-1.6.2-macos-universal.dmg |
Check downloads against SHA256SUMS.txt, or verify the signed build provenance with gh attestation verify <file> --repo zeroscience/Kokino; kokino-1.6.2-sbom.cdx.json lists every crate in the build. The packages are not code-signed yet: on Windows choose "More info", then "Run anyway"; on macOS right-click "Start Kokino", choose Open, then Open again. The MSI upgrades an installed version in place; cases and accounts are kept.
Added
- Ex01 images. EWF version 2, as EnCase 7 and later write it: compressed, uncompressed and pattern-filled chunks over any number of segments (.Ex01, .Ex02, ... found automatically). The MD5 and SHA-1 the imager stored are checked, and the case details, write-blocker and unreadable sectors it recorded are shown, as for E01. Checked on Ex01 files libewf made and on Ex01 written from Kokino's test disks by an independent writer: each reads byte for byte as the disk it came from. Encrypted Ex01 images are recognized and reported.
- More PDFs joined when carving. PDFs with compressed cross-reference streams (most newer PDFs), hybrid files and linearized PDFs split in two pieces are joined too, every cross-reference section followed; JPEG pictures inside a PDF are checked by decoding them exactly. On a public 5.4 MB PDF split at 149 places, 104 joins (76 before), none wrong.
- Hash sets. HashKeeper hash sets and hashdeep / md5deep output are recognized and read by their hash columns.
Parsers fuzzed with 952 million inputs over 43 targets; 43 problems found and fixed over Kokino's life, none in this release. Full details are in the changelog and the roadmap.