Gadzhovski/TRACE-Forensic-Toolkit v2.4.0

TRACE 2.4.0

on GitHub

TRACE 2.4.0

New

• External modules: the LEAPPs. iLEAPP (iOS), aLEAPP (Android), RLEAPP
  (warrant returns), VLEAPP (vehicles) and DLEAPP (Windows, macOS and Linux
  computers) are installed on request from their own releases: Tools ▸
  External Modules. The download is refused unless it matches the
  release's published SHA-256s. TRACE copies the files each tool reads out
  of any evidence it opens (folders, disk images, tars and zips of phone
  extractions, iTunes backups, encrypted ones with their password) and
  runs the tool on them.

  • What a tool reads joins TRACE's own Activity, Conversations, Map,
    Timeline and Search. Every record says which tool read it.
  • A call or message that TRACE and a tool both read is shown once.
  • Telemetry (the unified log, battery, settings) stays in Activity ▸
    Others unless you choose otherwise in Settings ▸ Results.
  • Each run keeps the tool's own report, which can be copied into
    TRACE's report.
  • Only the tools that suit an image are offered.

• Picture viewer for examiners:

  • pixel values under the pointer;
  • brightness, contrast, gamma, levels, invert and single channels;
  • error level analysis;
  • the JPEG quality and whether its tables are a standard encoder's;
  • every frame of a GIF, APNG, WebP or TIFF;
  • the EXIF thumbnail compared with the picture (a mismatch is also a
    Triage finding);
  • a loupe, and regions you can export or bookmark.

  Adjusted views are labelled and never saved as the file. Save Image
  always writes the original bytes.

• Video and audio player for examiners:

  • the container's own metadata: recording time with its zone, device,
    GPS (shown on the Map);
  • exact frame numbers and Go to time or frame;
  • zoom on a paused frame;
  • markers that become bookmarks;
  • contact sheets (with the file's SHA-256), which can be added to the
    report;
  • frame export with a manifest;
  • a waveform for audio.

  Videos with a recorded place are Triage findings, like photos.

• Timeline:

  • bursts of similar events collapsed into one row;
  • a Summary by folder, extension or kind;
  • Lanes per source;
  • Insights: a weekday × hour heatmap, gaps, and checks for clock
    changes, cleared logs, impossible dates, USN rollbacks and
    timestomping;
  • starred and coloured events, with highlight rules;
  • no row limit;
  • export to Timesketch, plaso (l2t CSV) and mactime.

• Activity charts and items: each category as charts (over time, by
  hour, ranked) or as a card per device, program, site or person. Every
  number opens exactly its records.

• More file systems, read in pure Python:

  • QNX4, QNX6 (and its previous state), QNX ETFS, EFS and IFS boot
    images (vehicle head units);
  • YAFFS1/2, with deleted files and earlier versions recovered;
  • cramfs, romfs, LittleFS and U-Boot environments.

• macOS and iOS:

  • the Spotlight store (file history, also files no longer on the
    volume);
  • Biome streams;
  • saved application state and Terminal history;
  • .DS_Store Trash records;
  • Big Sur's TCC decisions;
  • Launchpad, Dock, sharing settings and QuickLook thumbnails;
  • Keychain items, with secrets shown one at a time on request.

  LZFSE and LZVN are decoded by TRACE itself.

• Linux and ChromeOS:

  • the freedesktop Trash, mounts, crypttab, snap and Flatpak;
  • Vim and LibreOffice history;
  • web server logs (attacks and uploads, not every request);
  • remote access (RDP, VNC, GlobalProtect);
  • ChromeOS users named from Local State, VPD and the firmware event
    log.

• GrayKey extractions: the acquisition hashes and device details are
  read from GrayKey's report, never its passcode.

• Project VICS export, and Project VIC categories (Alt+0…4) on
  pictures and videos, for Griffeye and other review tools.
  DFXML and CASE/UCO exports.

• Reports as Word documents, each section with its own heading and
  text. A folder per report, with the external tools' own reports beside
  it.

• Password-protected archives: WinZip AES and ZipCrypto ZIPs, and 7z
  AES. The password is asked for and never stored.

• Hash indicators: hashes found in text are matched against the
  case's files and hash sets.

• Big archives (a 16 GB phone tar) are indexed in the background and
  browsed folder by folder.

• Text in any code page (Cyrillic, Greek, Arabic, Hebrew, Chinese,
  Japanese, Mac encodings…), with an Encoding list to override the guess.

• RTF documents are shown as formatted text.

• Evidence Information covers folders, extractions and backups: the
  device (model, iOS or Android version, serial, IMEI), what is packed
  inside, and whether a backup is encrypted.

• Map: a detailed offline world map, plus online maps (Esri,
  OpenStreetMap, and Google with your own API key), each asked for before
  anything is fetched.

• Switch Case (File menu) and a progress card for each step of
  opening evidence.

• API keys are kept in the system's key store (Windows DPAPI, macOS
  Keychain, Secret Service).

• Windows' title bars follow the theme.

Faster

• A folder of evidence (1.35 million entries) reopens in 0.25 s instead
  of 27 s: its listing is kept, and checked in the background.
• Indexing 2020JimmyWilson takes 72 s instead of 245 s, with the same
  results.
• Expanding a folder in the tree no longer reads it again (47 reads down
  to 1).
• Image verification hashes in a child process.
• LEAPP results of 22 million rows import with progress, not for hours.

Fixed

• The Utils dock can be made taller, and the media player's controls fit
  whatever its height.
• Tree folders with nothing inside no longer show an expand arrow.
• A file read that finished after you had moved on to another file could
  replace the newer file's view ("This RTF document could not be read").
• Cyrillic and other non-Latin text files were shown in the wrong
  encoding.
• Long NTFS file names were cut at 255 bytes, losing their extension.
• A case named with '#' (for example "Case #12") failed every job.
• Saving API keys could undo other settings saved since the window
  opened.
• The window froze for up to 15 s while a registry hive search ran, and a
  new case's verification could crash it on Windows.
• Reopening a case no longer asks which modules to run.
• Marks on a deleted file in the Listing are repaired to name the same
  file as the rest of TRACE.

Less tested: read before relying on these

These work, but have been checked on fewer or synthetic samples. Verify
important results with a second tool.

• QNX, YAFFS, cramfs, romfs, LittleFS and U-Boot: images from the
  formats' own tools and the Linux kernel, not from devices.
• ChromeOS: no public Chromebook image exists. The tests use generated
  folders.
• GrayKey: one report layout.
• Spotlight and Biome: checked against spotlight_parser and ccl-segb
  on public CTF images.
• Project VICS: checked against a VICS 2.0 file written by Griffeye
  Analyze DI. Importing categories back is not supported.
• The LEAPPs are run at the versions TRACE was tested with
  (iLEAPP 2026.4.4; aLEAPP, RLEAPP, VLEAPP and DLEAPP 2026.4.3). A newer
  release may name its artifacts differently.

Cases

Cases are upgraded to schema 25 when opened (Project VIC categories,
timeline marks, external module runs). TRACE 2.3.0 cannot open a case
that 2.4.0 has opened.

Requirements

• charset-normalizer replaces chardet (text encodings). Nothing needs
  a compiler or Homebrew.

Full Changelog: v2.3.0...v2.4.0