Gadzhovski/TRACE-Forensic-Toolkit v2.4.1 on GitHub

TRACE 2.4.1

Fixes and polish on 2.4.0, and installers that work in more places.

The right LEAPP is offered. An iPhone extraction could be offered
aLEAPP but not iLEAPP, and a Linux disk RLEAPP and VLEAPP but not
DLEAPP:
- Unlocking an encrypted volume kept the "nothing found" from while it
  was locked, so an unlocked Linux install was never offered DLEAPP.
- A Linux system without an os-release file (a live USB's overlay)
  was not recognised.
- With no system found, one stray file let RLEAPP or VLEAPP rule out
  every other tool.
- Phone data laid out by an extraction tool in folders of its own
  (filesystem2/mobile/Library/...) was not recognised as iOS.
When TRACE cannot tell what the evidence is, every installed tool is
now offered, with the ones its findings point to listed first.
A live disk has a name in the tree, the case and job messages (it
showed none on Windows).
The window's title read "TRACE 2.4.0 - TRACE". It now names the
case, then the version.
The installers work from any folder. Started from elsewhere, they
made the virtual environment in that folder and could not find
requirements.txt.
Linux libraries the window needs were missing from the installer's
list: libxcb-icccm4, libxcb-keysyms1 and libxcb-shape0. Without
them, on a minimal Ubuntu, TRACE's window could not open.

Panels are headed by their tabs. The "Tree View" and "Utils" title
rows are gone: the tree, the Utils tabs and the Listing / Search / ...
row each end with float and close buttons.
Light theme: the title bar and menu bar are a soft grey, so the top
of the window has an edge.
The partition listing: names and sizes are no longer cut off, and
"1 sector" is singular.
The Text tab says why it is empty, and its Encoding list fits its
names.

Linux: Fedora, RHEL / Rocky, Arch and openSUSE are installed
automatically (dnf, pacman, zypper), as Ubuntu and Debian were (apt).
Checked on Ubuntu 24.04, Debian 13, Fedora 42, Rocky 9, Arch, openSUSE
Tumbleweed and Leap 15.6. Where the system's Python is older than 3.10
(Rocky 9, Leap 15), a newer one is installed.
Windows: every Python the py launcher knows is tried, newest
first. TRACE_PYTHON names one, as on macOS and Linux.
The install is checked before it is reported done: the forensic
engines, Qt and libmagic must load. On Linux, any library the window
needs that the system lacks is named with its package.
Launchers: ./trace (macOS, Linux) and TRACE.cmd (Windows) start
TRACE from anywhere, without activating the virtual environment.
Running the installer again keeps a working virtual environment,
and rebuilds one whose Python no longer runs.

No change to the case format: 2.4.0 and 2.4.1 open the same cases.

TRACE 2.4.1: right LEAPP, docks headed by tabs, installers for more systems by @Gadzhovski in #18

Full Changelog: v2.4.0...v2.4.1