TRACE 2.3.0
New
- Panels you can arrange: Listing, Registry, Search, Triage, Activity
and Timeline are docks. Put two side by side, tab them, or move one to
another monitor. View ▸ Panels reopens a closed panel; Reset Layout puts
them back. Triage and Activity group their tabs in two rows. - More file systems, read in pure Python:
- ReFS 3.x
- ZFS: pools, datasets and snapshots; mirror, raidz and stripe, with one
missing raidz disk rebuilt; lz4, gzip, zstd, lzjb and zle compression - UBI and UBIFS, the journal replayed
- F2FS
- SquashFS, EROFS, UDF (UDF bridge discs are read as UDF), classic HFS
and JFFS2
- More containers: Android sparse and super images, VirtualBox VDI
(snapshot chains too), AFF (single file, AFD and AFM), and raw disks
compressed with gzip, xz, zstd, bzip2 or LZ4. - Cellebrite UFDR reports: the phone's files at their paths, plus
chats, SMS, calls, e-mail, contacts, accounts, web history, searches and
locations. - VeraCrypt and TrueCrypt volumes are unlocked, in every encryption
VeraCrypt offers: AES, Serpent, Twofish, Camellia, Kuznyechik and the ten
cascades. PIM and hidden volumes are supported. - Android
adb backupfiles, encrypted ones included, and phone file
systems inside an extraction tool's folder. - The operating system on each volume is named and shown by its logo,
in the tree, Image Information, the Case tab and the report. The
Timeline can be filtered by system. - New in user activity:
- Windows 11 Notepad tabs: unsaved and closed tabs, with their unsaved
edits replayed - Open/Save dialog history (ComDlg32)
- Chromium cookies (names only, never values), form autofill, saved
logins (site and user name only, never the password), top sites and
favicons - Windows Wi-Fi profiles (the key is never copied)
- PowerShell transcripts in any language
- The Windows Firewall log
- Windows Error Reporting reports
- Chromium and Electron Local Storage, Session Storage and IndexedDB,
with overwritten and deleted values kept - The previous install in Windows.old, read as a system of its own
- Windows 11 Notepad tabs: unsaved and closed tabs, with their unsaved
- Conversations (Triage): messages and calls as threads per contact,
exportable as HTML and CSV, and addable to the report. - Tags: Relevant, Needs review and Ignore (or your own) on any file
from any list, set with keys 1, 2, 3 and cleared with 0, every change
audited. - Case archives (
.trace) for handing a case over, checked member by
member when opened. Locate… points a case at moved evidence only if
the evidence's hashes match. - Scope: choose what a run covers (folders, names, types, sizes,
dates, deleted files), with a live count of the files in scope. - Compare shadow copies: what was deleted, added, changed or renamed
between a snapshot and a later snapshot or the live volume. - Files inside files: images and attachments in PDFs, OLE packages,
OOXML/ODF objects, RTF objects and EXIF thumbnails, listed and searched. - Page, swap and hibernation files are searched and carved like free
space. - System records carving category: event-log chunks, MFT and index
records, and registry hive bins, read back into the timeline and
activity. - Search: "Whole image" in the Listing's find box (once the image is
indexed). Indexing resumes where it stopped. Free space and memory files
have their own module, run after the file index. - Interface:
- Interface size from 80% to 200%
- Text zoom with Ctrl + mouse wheel
- Light or dark following the system
- Find a Command (Ctrl+K)
- The window layout remembered per screen setup
- Check for Updates in About
- Redrawn icons
Faster
- Analysis runs on several processes: 201 s down to 54 s on a 143,769-file
Fedora image, with the same rows. - Indexing is five times faster, and deleted-file checks on ext and Btrfs
now finish (22 s on the same image). - A big case opens in seconds: similar pictures are grouped in a background
job. - Heavily fragmented ext2/3 files open at once. NIST's 300 MB FILL.TXT took
40 s to open and now takes 0.2 s.
Fixed
- Reopening a case could stop loading at 20% behind an "Analysis Modules"
dialog; that dialog is now offered only once loading is done, and only
when nothing has been run yet. - A Listing fill interrupted by a click on another folder mixed the two
folders' rows. - Deleted files inside deleted ext folders are named, and deleted HFS+ files
are listed. - The Timeline offers only the file-system times the case holds.
- A possible crash in the hex search (seen on macOS) was removed.
- On macOS, libmagic could fail to identify some text files in the window
that an analysis job identified.
Less tested: read before relying on these
These work, but have been checked on fewer or synthetic samples. Verify
important results with a second tool.
- ReFS: one real image only (ReFS 3.2). Newer ReFS (Windows 11's Dev
Drive, 3.5+) has not been read from a real volume. Deleted files are not
listed. ReFS 1.x is refused. - ZFS: built in a virtual machine by OpenZFS 2.2. Native encryption,
deleted files and raidz expansion (OpenZFS 2.3) are not read. A raidz2/3
pool with two disks missing cannot be rebuilt (only P parity is used). - UBIFS: deleted files are not listed.
- Cellebrite UFDR: no complete public UFDR exists. The tests use real
report.xmlfragments wrapped in the published layout, not a report from
a real extraction. - Android backups were tested with files from an independent writer
that follows Android's source, not with backups taken from a phone. - Windows.old was tested on a generated folder holding a real
registry hive, not on an image of an upgraded PC. - Wi-Fi profiles were tested with Microsoft's published samples, not
with profiles exported from a machine. - Windows Error Reporting was tested with lines from Microsoft's
published sample. The test where Windows writes a report itself is
skipped where WER is turned off. - Chromium cookies, logins, top sites and favicons were tested with
plaso's files (Chrome 68's cookies) and Chromium's own test fixtures, not
with a current Chrome profile. - Electron apps (Teams, Slack, Discord…): their storage is found and
read, but no app-specific message parser is included. - VeraCrypt: Whirlpool and Streebog hashes and keyfiles are not
supported. Serpent, Twofish and Kuznyechik are decrypted in pure Python
(1–5 MB/s). - hiberfil.sys is searched as stored: its compressed parts are not
decompressed. - Classic HFS: data forks only. UDF: a deleted file is listed by its
name only. - Encrypted AFF and ADCRYPT AD1 are refused.
- Windows dynamic disks, hardware RAID and some UDF and lost-partition
cases are tested only on private training images, so CI does not run
those tests. - Not in this release: Windows Storage Spaces and VMware VMFS.
Known issues
- Closing the media player could hang inside Qt's FFmpeg backend after
stepping frames (seen in a few CI runs on Linux and macOS Intel, never
on Windows, and never reproduced on demand). 2.3.0 pauses and lets
frames in flight arrive before stopping; CI has not hung since, but it is
not proven fixed. - One VeraCrypt test volume was once not offered for unlocking on Linux
CI and could not be reproduced afterwards (over 700 trials).
Cases
Cases are upgraded to schema 20 (tags, and the systems found per image)
when opened. TRACE 2.2.0 cannot open a case that 2.3.0 has opened.
Requirements
crc32c(Btrfs checksums in C), with wheels for every platform. Nothing
needs a compiler or Homebrew.
What's Changed
- TRACE 2.3.0 by @Gadzhovski in #14
- Website for TRACE 2.3.0 by @Gadzhovski in #15
New Contributors
- @Gadzhovski made their first contribution in #14
Full Changelog: v2.2.0...v2.3.0