TRACE 2.5.0
One list of everything a case holds, place names for GPS positions,
exports that say what they lack, a far more complete Project VICS
export, and the newest LEAPP releases.
New
- Artifacts navigator and Case Overview. An "Artifacts" tab beside
the Tree View lists every kind of artifact in the case with its count,
for one image or all: no need to know which Triage sub-tab or Activity
category holds it. Scans that have not run, or stopped part-way, are
greyed with a Run command. The Overview panel, in front when a
case opens, shows the evidence, a tile per section, what is worth a
look and which scans have not finished (Run Missing Scans). - Place names for GPS positions, offline. Photos, videos, the Map,
Activity's locations, File Metadata and the report now say where a
position is -- "4 km NE of Reading, Wokingham, United Kingdom" --
worked out from Natural Earth data shipped with TRACE. Nothing is
sent online. Shown as "Near (approx.)": borders are accurate to about
200 m, and only towns and cities are named. - Exports say which scans have not run. Project VICS, DFXML,
CASE/UCO, the Timeline's export and Create Report each check the scans
they draw on (for VICS: carving of every picture and video type) and
say what is missing, with Run Missing Scans, Then Export.
Project VICS export
Compared with AXIOM, X-Ways, FEX and Griffeye on the M57 'Jean' image,
the export now also includes:
- pictures and videos inside archives, mailboxes and documents, listed
under their container's path (a container's category is never given
to its members) - pictures kept by Word, Excel and PowerPoint 97-2003
- browser caches: Firefox (cache v1 and cache2), Chromium (blockfile
and simple cache), Safari's Cache.db - pictures and videos stored as BLOBs in SQLite databases
- Volume Shadow Copies, when asked (a snapshot's unchanged copy of a
live file is left out) - WMF, EMF, Flash and TGA, recognised the same way on every system
- optionally, pictures carved from inside any file
Without carving, coverage of AXIOM's media on M57 went from 35% to 65%,
of X-Ways' from 41% to 79%.
Carving
- Pictures that start inside a sector (case setting, off by
default): JPEG, PNG, GIF and BMP are searched for at every byte of
free space and slack, each marked as found inside a sector. - Sources are kept together: carving unallocated space, slack or
memory files no longer replaces the carves of the others. - hiberfil.sys of Windows XP to 7 is decompressed and carved.
External modules (LEAPPs)
- The newest release is offered, not the one TRACE was tested with,
and installed tools are said to be out of date (Modules tab,
Supported Features). Installing an update is still your click. - aLEAPP 2026.4.4 and iLEAPP 2026.4.5 renamed columns TRACE reads:
runs of either release now keep their times, directions and parties.
Cases sort their runs again when opened. - DLEAPP on a Mac: Apple System Log lines are no longer read as chats,
and rows of files a Mac shows under several paths preview again.
Fixed
- Closing TRACE while carving was being cancelled logged errors from a
count reading a case already closed.
Installation
- Intel Macs install without a compiler again. cryptography 49 and
PyMuPDF 2.0 publish no Intel Mac wheels, so pip tried to build them
from source (cryptography needs Rust). Intel Macs now get the last
releases that have wheels (cryptography 48, PyMuPDF 1.28).
Cases
Cases are upgraded to schema 26 when opened (how each scan ended is
recorded). TRACE 2.4.x cannot open a case that 2.5.0 has opened.
Full Changelog: v2.4.1...v2.5.0