Sync 歷史版本列表
更新時間：2020-11-26
更新細節：
What's new in this version:
Case Manageent:
- Added a continue / stop option when a file copy fails (eg when creating a case report) rather than just stopping the current process
Cloud Mail Export:
- User can select which folder to export from account. An MBOX file will be created separately for each folder exported
Deleted Files:
- Added option in configuration to disable thumbnail creation as it may cause crashes in external windows libraries used to generate the thumbnails (eg media player) on poorly recovered / corrupt files
File Name Search:
- Added a new feature to allow for searching against image EXIF metadata
OSFExtract:
- Fixed issue where OSFExtract app would fail to install on older Android OS devices due to app signing issue
Subscription:
- Added deactivate seat option to the start page
User Activity:
- Event log, fixed a crash that could occur when reading a System log file caused by a very long file path in the event information
更新時間：2020-11-09
更新細節：
What's new in this version:
Auto Triage:
- Fixed a broken link to the Auto Triage section in the help file
Install to USB:
- Fixed an issue where a ket.dat file created by OSForensics would not be read correctly when OSForensics starts
Workflow:
- Started saving config file immediately after locking the workflow rather than when OSForensics was closed so changes made to the workflow will be applied when installing to USB
更新時間：2020-11-03
更新細節：
What's new in this version:
Cloud EMail:
- Fixed bug where VHD would run out of disk space while exporting email. Now when creating VHD, an additional overhead of 1KB per message for metadata used in MBOX will be added to the total VHD size
- Slow down the queries request rate (possibly hitting the queries limits from Google API)
File Name Search:
- Fixed 'Make Database Active' checkbox not setting hash set database active when checked
Subscription Licencing:
- WinPE, Will prompt user when subscription is expired to recreate WinPE image
- USB, Will prompt user that online connection is needed to check license when subscription is expired
Misc:
- Added "Image Analysis" chapter and content on Face Detect and Illicit Image Detection to help
更新時間：2020-10-22
更新細節：
What's new in this version:
Added New Face Detection module module for still photographs & images:
- "Detect Faces" button was added in the Image Viewer
- "Sort by Faces" in File Name Search
Added new Web Server Log Viewer module:
- Can load up log files from Apache, IIS and other web servers, then filter and sort the log data
Added new Python Scripting module:
- Implemented new scripting engine, which allows access to internal OSF functions from Python scripting. Scripting commands such as osf.UserActivityGetResult(), osf.ReportGenerate() & osf.LogicalImageStart() are now available
- Changed 'Run Python script' to 'OSF Script Player'
- Added support for built-in script templates installed under ProgramDataPassMarkOSForensicsScriptTemplates. The template can be selected under the 'New Script' button dropdown
- Added Python API reference for help file.
- Added script examples for charting via matplotlib
- Add right-click menu to enter user-defined parameters to 'pip install'
Added new Cloud Imaging support for Forensic Imaging:
- Added Cloud Download/Imaging for Google Drive, Microsoft OneDrive and Dropbox
- Cloud imaging will create empty files (0 byte files with ".deleted" extension) for deleted items from Dropbox. Dropbox includes deleted files in their directory listing
- Cloud Email Download support
- Added GMail export to MBOX format
- Added Microsoft Outlook (webmail) export to MBOX format
AmCache Viewer:
- Improved performance of reading amcache hive
Auto Triage:
- Turned off default options for including System hibernation and page files and registry files as part of the logical image configuration
- Started saving scan options and logical image options to config file
- Fixed display/gui bug where the background of the scan options was not being updated in WinPE
Boot Virtual Machine:
- Added the ability to select additional hard drives (data drives) when booting a VM from a disk image
Case Management:
- Added support for opening tagged e-mails & attachments via double-click/right-click
- Will now use Web Browser to open URL tags
- Added support for selecting multiple files when adding evidence images to case
- Add button to open 'Manage Devices' window, for managing the devices added to the case
- Multiple select enabled for Case Management. Can now delete or export multiple cases at a time
- Generate Report, updated to hide the categories that have no items
Create / Search Index:
- Added indexing for HEIC and HEIF image files
- Allowed indexing of memory dump files. .mem, Including .dmp, .mdmp (large file support does not apply if inside ZIP files)
- Improved speed of large binary file extraction indexing (by way of parallel / 2 thread concurrency)
- Fixed bytes progress status when indexing large binary file
- Added Email Attachment indexing options ("index attachments by file types")
- Fixed exiftool indexing issue (using the -fast3 parameter culled out alot of necessary meta information AND may incorrectly identify file type. Note removed -fast optimization will now be slower)
- Fixed indexing of some GPS meta information from exiftool
- Fixed issue with indexing OCR output from HEIC and HEIF files
- Added "Save to Disk" for checked items
Create/Compare Signature:
- Combined the create and compare into a single "Signatures" module with separate tabs
- Added support for SHA-256 hashes. This required changing the signature file format and incrementing the signature file version from 6 -> 7
- Add support for comparing previous signature file version with v7 signature file
- Added options to have two hashing options (e.g. MD5 and SHA-256) for OSFSig and file listing. Note: Will work with V7 OSFSig files but not previous OSFV8 Beta OSFSig files before this commit. When comparing signatures with different hashing options, only signatures with matching hash will be compared. E.g. Sig1.OSFSig was created with MD5 only and Sig2.OSFSig was created with MD5 + SHA-256. Only MD5 will be used for comparison. If both signature files use the same hashing options both checksums will be used for comparison
Deleted Files:
- Enabled right-click menu option, Show File Location dialog, for deleted files on FAT filesystem. Note: The file location dialog will only show the first cluster of the deleted file for FAT filesystems as only the starting cluster is known and the link-list FAT entries for subsequent clusters are removed once a file is deleted on FAT filesystems
Email Viewer:
- Support opening single e-mails from PST/DBX/MBOX files for faster loading (check if this was also backported to V7)
- Added exporting e-mail messages to MSG file
- Add checkboxes to e-mail messages
- Added right-click option to export e-mails to PDF
ESEDB Viewer:
- Fixed an issue where some values not displayed correctly in Windows 10 V2004
File and Hex Viewer:
- Added a drop down to allow track selection for playback for multi track video files
- Added "Analyze" button to Image Viewer to work with illicit image detection feature
- Fixed video player not working when opening video files via DirectAccess
- Fixed bug with video not playing when < 9 thumbnails were loaded
- Fixed a possible crash when extracting strings
- Video, Display duration of media along with current timestamp
File Name Search:
- Added "Illicit images" detection. File Name Search can now sort by "Illicit score"
- Changed configuration dialog to support modifying include/exclude folders for each preset. This allows for more accurate preset searches to be defined. Users can also define their own preset searches in the new advanced format
- Fixed bug in matching include/exclude folders in presets
- Fixed bug in saving custom preset include/exclude folders to XML file
- Preset searches now support included/excluded folders (currently, only by editing FileNameSearchPresets.cfg)
- Preset searches are now fixed and cannot be modified inline
- Added 'User-defined Search' for fully customizable search criteria
- Added right-click hash selected files option with option to create a Quick Hash Set from the results of the hashed files
- Added new preset for searching for large images + sort by face detection score
- Added new preset for searching for files modified since last month
- Added new preset for searching for files modified since yesterday
- Added colour backgrounds for results when sorting by Illicit or Face scores. Results are marked Red for likely illicit, Pink for probably illicit, and Green if Faces detected
- Minor UI layout updates
- Removed border from 'Config' text
- Increased width of preset/sorting combo box
File System Browser:
- File size units can be selected in the FSB options dialog. Defaults to “Auto” and will display in Human readable file size. File size units selectable are: Auto, Bytes, KB, MB, GB. Selection saved in OSFConfig file
- Fixed bug where the Analyze Shadow from the button within FSB was not working
- Consolidated filter text into single link control
- Changed timeline date type combo box to link control
- Removed 'Current Path' and added 'Scan Status' edit control
- Moved 'Thumbnail size' slider and 'timeline date' control to top
- Added 'Images + Illicit-detect AI' preset
- Added "Video files (sorted by # Tracks)" preset
- Added sort by "video tracks" option
- Moved sorting combo box to the top
Forensic Imaging:
- Added option to select between single/split files when creating Encase E01 image files
- Added support for creating AFF4 disk images
- Enabled SMART logging in SysInfoLog.txt
Hash Lookup:
- Fixed crash when attempting to export lookup results to text
Image Viewer:
- Added support for HEIC and HEIF image files
- Added support for extracting meta data from HEIC and HEIF files
- Added Analyze Results popup window, showing results from AI face detect, AI illicit image detect, MD5, SHA1, etc
Install PFX:
- Fixed broken help file link
Password Recovery:
- Improved performance of reading Firefox, IE & Windows logins from registry
- Fix heap corruption when retrieving LSA secrets
- Fixed various memory leak issues
- Updated to support new Edge Chromium-based version.
- Updated to support Chrome V80 and beyond
- Updated to support Opera V67 and beyond
- Fixed the Password Length column to display Not Available message when the password is not decrypted
- Decryption Tab, Added ability for users to select multiple files at a time
- Removed support for Opera Version 22 and earlier
- Removed support for FireFox Version 31 and earlier
- Removed support for Safari
- Fixed potential crash when running on Windows 10 V2004.
- Made some changes to enable recovery of chrome, edge and opera passwords in some cases where it was previously failing
Registry reading:
- Improved performance of RegistryGetSubKeys() and RegistryGetKeyValues() methods for reading registry keys
- Improved performance of reading registry entries in User Activity. On a 160MB SOFTWARE hive, load times improved from >10min to 20s (as compared to v7.1.1005)
- Added new registry function to read a single key in a hive for better performance without loading the entire registry file
Start:
- Add new 'Manage Devices' icon
System Information:
- Will now pick "System information from registry" as default when live acquisition is not selected for the case
- Will now skip commands that can't be run on the selected drive (eg live acquisition only and a drive letter is selected) and display a skipped message in the output
- Made some changes to allow user entered commands (eg regripper) to be run when live acquisition OR drive letter is selected (as most user entered commands will likely have a hard coded location)
ThumbCache Viewer:
- Redesigned the interface allowing to load a single cache file, add multiple files by scanning drive or folder
- Added a tree view to show list of added cache files, folders and drives
- Added a new "All" option to the Thumbnail Size combo box to show all records in a cache index file
- Added a new feature to allow loading multiple cache files and viewing all of the records in them in a single list view
- Added Extended Information to show EXIF data of thumbnails retrieved from ESE Database
- Updated the thumbnail preview window to be resizable
- Improved the efficiency of loading ESE Database
Thumbnail View:
- Added support for displaying thumbnails for video files
- Support for animated video thumbnails on mouse hover
- Changes to thumbnail caching thread for better performance and robustness
- Added support for deleted video thumbnails
- Files that do not have thumbnails are cached and no longer reloaded
User Activity:
- Added support for decrypting cookies value of the Chrome, Edge and Opera browsers
- Added support for decrypting form history value of the Edge browser
- Added Search Term to extract search keywords used in browsers
- Added Website Logins to obtain browser passwords
- Rearranged config dialog slightly to shrink height (previously unable to see OK button on 1080p laptop screen)
- P2P, added extra error information display for decoder error during P2P scan
- Fixed null pointer crash when scanning for USB devices only
- Fixed bug in opening ARES registry key path
- Added more Windows Event IDs to extract more forensically interesting logs
- Added times to Browser Bookmarks and WLAN items
- Fixed Time Source display error for some items under All category
- Changed list-view default sorting as date and time descending order
- Improved column sorting speed
- Updated column names for Autorun Commands and UserAssist
- Fixed an issue with Windows Search scan on Windows 10 V2004
- Updated Browser History, Downloads, Form, Bookmarks and Cookies to support the latest versions of Edge, Chrome and Opera browsers
- Updated Downloads to support Firefox latest versions
- Fixed and issue with Windows Search showing incorrect times in Windows 10 V2004
- Moved Top Sites items to Browser History category
- Removed support for Opera Version 22 and earlier
- Removed support for FireFox Version 31 and earlier
- Removed support for Safari
Web Browser:
- Fixed video download crash
Workflow:
- Workflow buttons and Start window icons now have 1-to-1 correspondence
- Removed extra 'button' slot
- Revised default workflow list
- Added separate checkbox column to show/hide icon in Start page, hiding workflow buttons no longer hide the corresponding Start page icon
WinPE:
- Fixed some bugs/crashes found during WinPE testing
- As SHBrowserForFolder() does not work in WinPE, updated to emulate the functionality when running in WinPE
- Custom case location can now be specified for Live Triage and Case Manager's Create Case option
Misc:
- Updated Volatility Workbench to v3.0.1001
- Updated exiftool to version 12.03
- Updated WinPEBuilder
- On exit, OSF will check the parent Temp folder to clean up orphaned temp directories. It will only delete the temp directories that are older than the oldest running/active osf32.exe or osf64.exe process
- Fixed a crash that could occur in the trial version in deleted files and file name search
更新時間：2020-05-28
更新細節：
What's new in this version:
Case Manager
- Fixed a crash that could occur when loading a case if a category name was longer than the max (63 characters)
- Fixed a bug allowing categories to be added with names longer than the max (63 characters)
Create Index:
- Fixed crash bug when indexing smaller binary files (<25MB) with multi-threads
- Fixed bug with 32-bit indexer failing to launch
Deleted Files:
- Carving, thread safety updates
- Carving, fixed bug (read a offset outside of buffer) causing possible crash when carving TIFF files
Mobile Artifacts:
- Potential stack overflow crash fix
更新時間：2020-04-30
更新細節：
What's new in this version:
- deps: upgrade openssl sources to 1.1.1g
- doc: add juanarbol as collaborator
- http: doc deprecate abort and improve do
- module: do not warn when accessing __esModule of unfinished exports
- n-api: detect deadlocks in thread-safe function
- src: deprecate embedder APIs with replacements
stream:
- don't emit end after close
- don't wait for close on legacy streams
- pipeline should only destroy un-finished streams
- vm: add importModuleDynamically option to compileFunction
更新時間：2020-04-30
更新細節：
What's new in this version:
- Add maxlength attribute to message input
- Add option to save image
- Reset message input height after it grows tall
- When viewing media messages, make close button always clickable
- Play video in carousel
- Stop playing video once it is closed
- Add option to auto launch IGdm on start up
- Add option to delete conversation
- Make auto-update optional
- Show cascading avatars in group chats
- Better handling of sending messages
- Indicate when users are "active" or "last seen"
- Render video messages
- Fix 2FA
- Fix image upload
- Upload audio, and video
更新時間：2020-04-30
更新細節：
更新時間：2020-04-30
更新細節：
What's new in this version:
Sync 2.0.13
Fixed:
- Improved error logging
- Possible Sync app crashing on Windows related to Unicode Usernames
- Various miscellaneous bug fixes as reported by customers
Sync 2.0.12
New:
- Automatic update notifications when new version is available, with ability to dismiss
- Search results to indicate if file is in Vault
Fixed:
- Improved multi-monitor support (Windows)
- Installer can recover account when the original Sync folder location has changed
- Improved network status checking
- Improved network status check
- Improved error handling
- Possible Read Only Conflict files on upgrade
Sync 2.0.11
New:
- Update notifications when new version is available
Fixed:
- Issues causing updates to fail
- Reduced memory footprint
- Improved UI performance
- Various bug fixes to improve stability
Sync 2.0.10
Fixed:
- Issue that would cause the Sync app to display a network usage exceeded error
- Multiple Sync startup items on macOS
- Issue that would cause the Recents list to stop loading
- Fallback menu for Windows versions that do not support the new UI
- Various other fixes
Sync 2.0.9
New:
- Windows minimum version 7 (we continue to support Windows XP via the Windows legacy installer)
Fixed:
- Issue that would cause older versions of files to become current in rare cases
- Various crashes that would otherwise require the app to be re-installed
Sync 2.0.7
New:
- Windows minimum version 7 (we continue to support Windows XP via the Windows legacy installer)
Fixed:
- Issue that would cause older versions of files to become current in rare cases
- Various crashes that would otherwise require the app to be re-installed
Sync 2.0.5
New:
- Search your files in the Sync folder and Vault
- Easy access to recently added or updated files
- High DPI support for Windows display mode scaling
Improved:
- Two factor authentication (2FA) integration on device attach improved
- Windows installer now standalone, does not require external download
- Light mode support on Windows 10
Fixed:
- Issues when installing Sync on a secondary computer user
- Various performance improvements and bug fixes
Sync 2.0.2
New:
- Search your files in the Sync folder and Vault
- Easy access to recently added or updated files
- High DPI support for Windows display mode scaling
- Mac app is officially notarized by Apple
Improved:
- Two factor authentication (2FA) integration on device attach improved
- Windows installer now standalone, does not require external download
- Dark mode support on macOS
Fixed:
- Issues when installing Sync on a secondary computer user
- Various performance improvements and bug fixes
Sync 1.3.11
Improved:
- Windows installer now standalone
- Optimized macOS app to use less CPU when scanning deep folder trees
Fixed:
- Delay when attaching new device and 2FA enabled
- Issues related to Sync paused on startup (Windows 10)
Sync 1.3.10
- Change log not available for this version
Sync 1.3.9
- Change log not available for this version
Sync 1.3.6
- Change log not available for this version
Sync 1.3.1
New:
- Network setting to allow Sync to work with Kaspersky (and similar AV applications that monitor SSL)
Improved:
- Network speed now reports in Mbit/sec
- Creating links more robust, less prone to failure
- Open Sync folder when starting Sync from Windows Start Menu
- Symbolic link recursion no longer followed
- Two-factor authentication notification when provisioning device
Fixed:
- Allow CMD-V password paste on Mac
- Possible memory leaks or crashes related to hundreds of thousands of files
- Crashing due to thumbnail creation
- Various GUI crashes
- Better handle constantly changing files
- Misc. share folder errors
Sync 1.3.0
New:
- Network setting to allow Sync to work with Kaspersky (and similar AV applications that monitor SSL)
Improved:
- Network speed now reports in Mbit/sec
- Creating links more robust, less prone to failure
- Open Sync folder when starting Sync from Windows Start Menu
- Symbolic link recursion no longer followed
- Two-factor authentication notification when provisioning device
Fixed:
- Allow CMD-V password paste on Mac
- Possible memory leaks or crashes related to hundreds of thousands of files
- Crashing due to thumbnail creation
- Various GUI crashes
- Better handle constantly changing files
- Misc. share folder errors
Sync 1.1.20
- Change log not available for this version
Sync 1.1.18
- Change log not available for this version
Sync 1.1.15
- Change log not available for this version
Sync 1.1.12
- Change log not available for this version
Sync 1.1.9
Fixed:
- Events sometimes being attributed to the wrong device on shares
- Less likely to create conflict files on error
- Network alarm less sensitive
- Automatic recovery from local database locking, errors or corruption
- The mighty tilde (~) character supported in file names again
- Various issues related to ._ files on external OS X volumes
- Delayed file issues if third-party app reverts a file modification time on a file
Improved:
- Utilizes less CPU with large file sets (millions of files)
- Less background scanning
- Reduced the likelihood of folders coming back to life when deleting or renaming folders on a share
更新時間：2020-04-29
更新細節：