Autopsy: Autopsy 4.9.0

10/15/2018 12:33 pm

Autopsy: Autopsy 4.9.0

Autopsy 4.9.0

Autopsy 4.9.0 – New Features:

  • Removed data from table that are time intensive and can be found in content viewers (such as hash set hits)
  • Added ability to find common items (files, emails, etc.) between current case and past cases using the Central Repository.
  • Added ability to ignore common items that exist in a large number of cases by using Central Repository data.
  • Data is validated and normalized before being entered into the Central Repository.
  • Allow users to specify that an ad-hoc keyword search should not be saved to database
  • New \u201cAnnotations\u201d content viewer that shows all tags and comments associated with an item
  • Added 2 icons to the table to show the item\u2019s score (if it is notable or suspicious) and if it has a comment.
  • Added column to the table to show previous number of occurrences.
  • Tags are now associated with the user (in a multi-user environment) and you can hide other people\u2019s tags
  • New Display options area that unifies various new settings.
  • Hash sets can be copied into the user\u2019s config folder (AppData), which makes it easier to run Autopsy from a Live Triage USB and not care about what drive letter it gets.
  • Image Gallery stores its groups and seen status in Case DB instead of its own.
  • Image Gallery works better in multi-user setups and reloads the database when other nodes add data sources.
  • Image Gallery saves which user saw a group and gives user option of seeing only their unseen groups or all unseen groups.
  • Saves last export location and pre-populates that in the file picker
  • Provide feedback about why some right click options are disabled (ingest is running, not file content, etc.)

Bug Fixes:

  • Substring keyword search is more accurate (now uses regular expression)
  • New text extractor for SQLite that better deals with full text search tables
  • Better deal with Unicode text files that do not have Byte Order Marker
  • Embedded file extractor module is now faster because it uses a different 7ZIP API.
  • Fixed various HTML report bugs
  • Duplicate hash set hits are not created when you run the Hash Ingest Module twice.
  • Auto ingest (in Experimental) scan times of input folders is faster.

Directly related posts: