Tweet
Announcement:
We are pleased to announce the Beta release of V8 of OSForensics for community testing and feedback.
Download link:
https://downloads.passmark.com/osfor..._V8_Beta9.exe
Licence requirements:
Old keys from V7 will not work in V8.
You should be able to have V7 and V8 installed at the same time (if you select different installation folders).
The link above will work as a 30 day trial.
Free upgrades:
When the final V8 release is complete anyone will active support (including all purchases of V7 in the 12 months prior to V8 release) will get a free upgrade to V8.
Otherwise there will be discounted upgrades for older customers.
Final release date:
Date isn't fixed as yet. But expectation is for a release in the Aug / Sept 2020 time frame.
Is it complete:
No. We are still adding new functionality
Is it stable:
Probably not as stable as V7. But should be mostly OK. We aren't aware of any crash bugs at this time, but please tell us if it isn't stable.
What's new:
• Added New Face Detection module for still photographs & images
- "Detect Faces" button was added in the Image Viewer
- "Sort by Faces" in File Name Search module as added. Depending on the set of images, accuracy is around 80% at the moment. We are hoping to get closer to 95% before the final release. This can make sorting through large collections of images much much faster.
• Added new Web Server Log Viewer module
- Can load up log files from Apache, IIS and other web servers, then filter and sort the log data. A lot of effort was invested to support the loading of very large log files without having huge amounts of system RAM.
• Added new Python Scripting module
- Implemented new scripting engine, which allows access to internal OSF functions from Python scripting. Scripting commands such as osf.UserActivityGetResult(), osf.ReportGenerate() & osf.LogicalImageStart() are now available.
- Added support for built-in script Python templates installed under ProgramData\PassMark\OSForensics\ScriptTemplates. The template can be selected under the 'New Script' button dropdown.
- Added Python API reference for help file.
• Added new Cloud Imaging support for Forensic Imaging
- Added Cloud Download/Imaging for Google Drive, Microsoft OneDrive and Dropbox
- Cloud imaging will create empty files (0 byte files with ".deleted" extension) for deleted items from Dropbox. Dropbox includes deleted files in their directory listing.
• AmCache Viewer
- Improved performance of reading amcache hive
• Case Management
- Add support for opening tagged e-mails & attachments via double-click/right-click
• Create Index
- Added indexing for HEIC and HEIF image files (from Apple devices)
- Allowed indexing of memory dump files. .mem, Including .dmp, .mdmp (large file support does not apply if inside ZIP files)
- Improved speed of large binary file extraction indexing (by way of parallel / 2 thread concurrency)
- Fixed bytes progress status when indexing large binary file
- Added Email Attachment indexing options ("index attachments by file types")
- Fixed exiftool indexing issue (using the -fast3 parameter culled out alot of necessary meta information AND may incorrectly identify file type. Note removed -fast optimization will now be slower)
- Fixed indexing of some GPS meta information from exiftool
- Fixed issue with indexing OCR output from HEIC and HEIF files
• Create Signature
- Added support for SHA-256 hashes. This required changing the signature file format and incrementing the signature file version from 6 -> 7.
- Add support for comparing previous signature file version with v7 signature file
• Email Viewer
- Support opening single e-mails from PST/DBX/MBOX files for faster loading
- Added exporting e-mail messages to MSG file format
- Add checkboxes to e-mail messages for bulk operations
• File name search
- Changed configuration dialog to support modifying include/exclude folders for each preset. This allows for more accurate preset searches to be defined. Users can also define their own preset searches in the new advanced format.
- Preset searches are now fixed and cannot be modified inline
- Added 'User-defined Search' for fully customizable search criteria
• Forensic Imaging
- Add option to select between single/split files when creating Encase E01 image files
• Image Viewer
- Added support for HEIC and HEIF image files (from Apple devices)
- Added support for extracting meta data from HEIC and HEIF files
• Passwords
- Improved performance of reading Firefox, IE & Windows logins from registry
- Fix heap corruption when retrieving LSA secrets
- Fixed various memory leak issues
• Registry reading
- Improved performance of RegistryGetSubKeys() and RegistryGetKeyValues() methods for reading registry keys
- Improved performance of reading registry entries in User Activity. On a 160MB SOFTWARE hive, load times improved from >10min to 20s (as compared to v7)
- Added new registry function to read a single key in a hive for better performance without loading the entire registry file first
• ThumbCache Viewer (complete rewrite)
- Redesigned the interface allowing to load a single cache file, add multiple files by scanning drive or folder
- Added a tree view to show list of added cache files, folders and drives
- Added a new "All" option to the Thumbnail Size combo box to show all records in a cache index file
- Added a new feature to allow loading multiple cache files and viewing all of the records in them in a single list view
- Added Extended Information to show EXIF data of thumbnails retrieved from ESE Database
- Updated the thumbnail preview window to be resizable
- Improved the efficiency of loading ESE Database
• Thumbnail View of files in various modules.
- Added support for displaying thumbnails for video files
- Support for animated video thumbnails on mouse hover (how cool is this!!)
- Changes to thumbnail caching thread for better performance and robustness
- Added support for deleted video thumbnails
- Files that do not have thumbnails are cached and no longer reloaded
• User Activity
- Fixed bug in opening ARES registry key path
- Added more Windows Event IDs to extract more forensically interesting logs
- Added times to Browser Bookmarks and WLAN items
- Fixed Time Source display error for some items under All category
- Changed list-view default sorting as date and time descending order
- Improved column sorting speed. Sorting large data sets is now 50x faster.
- Updated column names for Autorun Commands and UserAssist
• Boot Virtual Machine
- Added the ability to select additional hard drives (data drives) when booting a VM from a disk image.
We are pleased to announce the Beta release of V8 of OSForensics for community testing and feedback.
Download link:
https://downloads.passmark.com/osfor..._V8_Beta9.exe
Licence requirements:
Old keys from V7 will not work in V8.
You should be able to have V7 and V8 installed at the same time (if you select different installation folders).
The link above will work as a 30 day trial.
Free upgrades:
When the final V8 release is complete anyone will active support (including all purchases of V7 in the 12 months prior to V8 release) will get a free upgrade to V8.
Otherwise there will be discounted upgrades for older customers.
Final release date:
Date isn't fixed as yet. But expectation is for a release in the Aug / Sept 2020 time frame.
Is it complete:
No. We are still adding new functionality
Is it stable:
Probably not as stable as V7. But should be mostly OK. We aren't aware of any crash bugs at this time, but please tell us if it isn't stable.
What's new:
• Added New Face Detection module for still photographs & images
- "Detect Faces" button was added in the Image Viewer
- "Sort by Faces" in File Name Search module as added. Depending on the set of images, accuracy is around 80% at the moment. We are hoping to get closer to 95% before the final release. This can make sorting through large collections of images much much faster.
• Added new Web Server Log Viewer module
- Can load up log files from Apache, IIS and other web servers, then filter and sort the log data. A lot of effort was invested to support the loading of very large log files without having huge amounts of system RAM.
• Added new Python Scripting module
- Implemented new scripting engine, which allows access to internal OSF functions from Python scripting. Scripting commands such as osf.UserActivityGetResult(), osf.ReportGenerate() & osf.LogicalImageStart() are now available.
- Added support for built-in script Python templates installed under ProgramData\PassMark\OSForensics\ScriptTemplates. The template can be selected under the 'New Script' button dropdown.
- Added Python API reference for help file.
• Added new Cloud Imaging support for Forensic Imaging
- Added Cloud Download/Imaging for Google Drive, Microsoft OneDrive and Dropbox
- Cloud imaging will create empty files (0 byte files with ".deleted" extension) for deleted items from Dropbox. Dropbox includes deleted files in their directory listing.
• AmCache Viewer
- Improved performance of reading amcache hive
• Case Management
- Add support for opening tagged e-mails & attachments via double-click/right-click
• Create Index
- Added indexing for HEIC and HEIF image files (from Apple devices)
- Allowed indexing of memory dump files. .mem, Including .dmp, .mdmp (large file support does not apply if inside ZIP files)
- Improved speed of large binary file extraction indexing (by way of parallel / 2 thread concurrency)
- Fixed bytes progress status when indexing large binary file
- Added Email Attachment indexing options ("index attachments by file types")
- Fixed exiftool indexing issue (using the -fast3 parameter culled out alot of necessary meta information AND may incorrectly identify file type. Note removed -fast optimization will now be slower)
- Fixed indexing of some GPS meta information from exiftool
- Fixed issue with indexing OCR output from HEIC and HEIF files
• Create Signature
- Added support for SHA-256 hashes. This required changing the signature file format and incrementing the signature file version from 6 -> 7.
- Add support for comparing previous signature file version with v7 signature file
• Email Viewer
- Support opening single e-mails from PST/DBX/MBOX files for faster loading
- Added exporting e-mail messages to MSG file format
- Add checkboxes to e-mail messages for bulk operations
• File name search
- Changed configuration dialog to support modifying include/exclude folders for each preset. This allows for more accurate preset searches to be defined. Users can also define their own preset searches in the new advanced format.
- Preset searches are now fixed and cannot be modified inline
- Added 'User-defined Search' for fully customizable search criteria
• Forensic Imaging
- Add option to select between single/split files when creating Encase E01 image files
• Image Viewer
- Added support for HEIC and HEIF image files (from Apple devices)
- Added support for extracting meta data from HEIC and HEIF files
• Passwords
- Improved performance of reading Firefox, IE & Windows logins from registry
- Fix heap corruption when retrieving LSA secrets
- Fixed various memory leak issues
• Registry reading
- Improved performance of RegistryGetSubKeys() and RegistryGetKeyValues() methods for reading registry keys
- Improved performance of reading registry entries in User Activity. On a 160MB SOFTWARE hive, load times improved from >10min to 20s (as compared to v7)
- Added new registry function to read a single key in a hive for better performance without loading the entire registry file first
• ThumbCache Viewer (complete rewrite)
- Redesigned the interface allowing to load a single cache file, add multiple files by scanning drive or folder
- Added a tree view to show list of added cache files, folders and drives
- Added a new "All" option to the Thumbnail Size combo box to show all records in a cache index file
- Added a new feature to allow loading multiple cache files and viewing all of the records in them in a single list view
- Added Extended Information to show EXIF data of thumbnails retrieved from ESE Database
- Updated the thumbnail preview window to be resizable
- Improved the efficiency of loading ESE Database
• Thumbnail View of files in various modules.
- Added support for displaying thumbnails for video files
- Support for animated video thumbnails on mouse hover (how cool is this!!)
- Changes to thumbnail caching thread for better performance and robustness
- Added support for deleted video thumbnails
- Files that do not have thumbnails are cached and no longer reloaded
• User Activity
- Fixed bug in opening ARES registry key path
- Added more Windows Event IDs to extract more forensically interesting logs
- Added times to Browser Bookmarks and WLAN items
- Fixed Time Source display error for some items under All category
- Changed list-view default sorting as date and time descending order
- Improved column sorting speed. Sorting large data sets is now 50x faster.
- Updated column names for Autorun Commands and UserAssist
• Boot Virtual Machine
- Added the ability to select additional hard drives (data drives) when booting a VM from a disk image.
Comment