OSF V1.2 Alpha / Beta release

[David (PassMark)]

V1.2 of OSF is now released.

Final list of changes can be found here,
http://www.osforensics.com/whatsnew.html

Download here,
http://www.osforensics.com/download.html

Thanks for the feedback during the last few weeks.

Should any new problems be found, please let us know.

[David (PassMark)]

You are correct, this is not ideal.
We'll fix it up.

[d8a4n6]

Same for emails. Double clicking opens up the regular internal viewer, not the email viewer.

[d8a4n6]

I don't think it is working quite right.

For instance, I have several lists saved in .html and .csv formats. Double clicking on the file opens the document in the internal viewer instead of a web browser or a spreadsheet program. There is no right click option to choose the application I want to use to open the list.

For "Files" the double click behavior is the same as for Lists = the internal viewer. However, I have the option in right click to choose to open the file with an external viewer.

[David (PassMark)]

Beta 3 has just be released.

The download link above has been updated. This was just a single bug fix.

Changes from the Beta 2 are,

• Bug fix in the case management window that prevented items in the case being opened. This was a new bug accidentally introduced in Beta 2.

[David (PassMark)]

Beta 2 has just be released.

The download link above has been updated. This mainly a collection of minor bug fixes on the new functionality introduced in V1.2

Changes from the Beta 1 are,

• New Indexer builds fixes bugs with indexing of filenames and titles when they are disabled in config. In Beta 1 file names were indexed even if the user asked for them not to be indexed.
• Fixed a number of bugs with adding bookmarked files to the case via right click on bookmark from the manage case window.
• Allowed multi-select when adding bookmarked files to case. Previously only 1 file could be done at a time.
• Allowed multi-select when changing bookmark colors. Previously only 1 bookmark could be done at a time.
• Added Export to CSV options to history tab in search index
• Changed list on search index history tab to allow multiple selection.
• Fixed a possible crash when switching to the search index / browse index tab after opening a case with no indexes, the previously open index could still be displayed.
• Fixed a crash when typing a letter when the listview in Browse Index tab had focus but the open case had no indexes.
• Fixed progress bar being at 100% when initializing indexing sessions after the first one (was not being initialized at start of indexing, only start of window creation)
• File system browser - sorting by column click now works for access date and any extra date fields (if applicable, depending on file system and mount method)
• Internal viewer - Added extra date fields to 'File Info' tab for "Attribute Modify Date" in HFS and NTFS MFT Modify Date.
• File Name Search - When results are filtered via timeline, the date filter used is displayed above the tabs.
• File Name Search - Configuration window now has filters for 'Access Date' and any extra date fields (if applicable)
• File Name Search - Added new sorting criteria (access date and extra date field) to combo box
• Added support for hidden "Attribute Modify Date" field in Apple Mac HFS file system.

[d8a4n6]

All very handy additions.

[David (PassMark)]

Beta 1 has just be released.

The download link above has been updated.

Changes from the Alpha are,

• Additional advanced indexing options to allow the user to select the type of content to be indexed. The user can now, for example, choose to just index document meta data without indexing the document content.
• Sector number and byte offset are now displayed in the list of caved files in the undeleted files module.
• Sorting by bookmarks is now available from the File name search function.
• The normally hidden NTFS MFT Modify Date field is now exposed. You can see it as an extra column in the File System browser for example. Note that this is a different value from the "Modified date" that is normally associated with a file and displayed in Windows Explorer.
• The time line function in the File Name Search module can now generate a timeline based on different sets of dates. e.g. you can do a time line on file creation date or modified date. Previously the timeline always used modified date.
• From the Manage Case module it is now possible to right click on a bookmark and add the bookmarked file directly to the case.
• In the drive imaging function there is now a new Restore Image tab. This tab allows a disk image to to restored back to a physical drive. This might be useful if you want to attempt to boot a disk image from a physical drive.
• From the search index module you can now right click on a word in the Browse Index tab and search for the word in the index and add it to the case in a single step.
• You can now export a list of words from the index as CSV via the Browse Index tab.

[David (PassMark)]

Alpha 3 has just be released.

The download link above has been updated.

Changes from the last Alpha are,

• Fix for stemming of German words in index. This bug prevented some German words with accents being searchable if stemming was enabled.
• Fixed crash bug with "type to find" in "Browse Index" tab. Previously scrolling the word list in the dictionary browse index function using key presses could cause a crash.
• Several fixes for OSX file system support, including mounting of physical OSX drives.
• Can now image drives to .E01, .AFF format, in addition to dd format. The compression level can now also be selected (None, Fast compression, Best compression).
• Can now image partitions without drive letters or without recognized file systems.

[David (PassMark)]

You can FTP upload the crash dump to us. It will be too big for E-mail.

We have anonymous ftp at,
ftp://www.passmark.com
You can drop things into the incoming folder.

Note that you can't list files or download files from the incoming folder, but you should still be able to upload when using a real FTP client (not a browser).

[David (PassMark)]

It is probably it yes. How big is it if you zip it up?

What type of file was it (.PST, .EML, .MBOX, etc..)?

What would be better however would be to get a copy of the E-mail archive file that didn't open. (e.g. inbox.pst). Reproducing the problem here with the original file if going to be a much more efficient debugging method than a crash dump. Crash dumps only help about 30% of the time, where as there is probably near 100% chance it can be fixed once we can reproduce the problem.

[d8a4n6]

Alpha 2 is crashing while opening and email message from an index search. The error indicated to send the dump file in the OSforensics folder. Is that the file you want? It's just shy of 90MB.

[David (PassMark)]

Alpha 2 is now available. Download details in the initial post (above) have been updated.

Differences from Alpha 1 are,
- Bug fix for indexing of drive images using direct access with multiple partitions where the 1st partition isn't being indexed.
- Changes to support WinPE for a up coming self boot option.

[David (PassMark)]

They have been supported for some time now, at least when they were using FAT32 or NTFS as the file system.

This release will add support for HFS+, EXT2/3/4 in .E01 and .AFF images (as well as raw dd images)

[FQuerceto]

No support for .E01 images yet ??