Mobius Forensic Toolkit v0.5.20 Released

Mobius Forensic Toolkit is a forensic framework written in Python/GTK that manages cases and case items, providing an abstract interface for developing extensions. Cases and item categories are defined using XML files for easy integration with other tool.

Changelog v0.5.20

new extension cellphone-agent
report-model: new service report.run-dialog
report-model: generate ‘%’ instead of ‘%%’ in verbatim environment
report-model: do not generate duplicated methods in .py
gtk-ui: forbid treeitem DND onto itself
gtk-ui: case treeview icon cache implemented
gtk-ui: do not expand selected item when item.children is modified
skype-agent: “generate report” option
skype-agent: disable DND on account view when not selected
skype-agent: account tile image repositioned
ice: use service report.run-dialog
sdi-window-manager: call to on_widget_started eliminated
partition-viewer: scan only partition-system components
partition-agent: update item.children only whether it detects partitions
partition-agent-dos: keep item.children when building components
turing: test dictionary option fixed

Changelog v0.5.19

new extension partition-agent
new extension partition-agent-dos
datasource-model: new service datasource.new-slice
datasource-imagefile: set datasource.start and datasource.end
gtk-ui: reorder treeview only when necessary
gtk-ui: tableview column’s new attribute is_exportable
hive: better link between HKEY_USERS and NTUSER.DAT
hive-report: new report Shared Folders
ice: reload items only when item.children is modified
ice: remove items by item.uid
ice: do not reuse children var in treeview_on_file_dropped
partition-viewer: show partition-system.dos components
object-model: new method object._copy ()
object-model: set class_id attribute
category-model: merge in categories from extension’s category.xml
turing: test keywords while reading dictionary file
turing: importer for John The ripper .john (hashes) file
xml-pickle: use class_id to identify mobius objects
xml-pickle: delete deprecated code

Changelog v0.5.18

hive-report: new report WiFi Network List
hive-report: new report Gigatribe accounts for Gigatribe v3.0
hive-report: new report Gigatribe download folders for Gigatribe v3.0
hive-report: new report Gigatribe requested passwords for Gigatribe v3.0
hive-report: new report Ares Search History
new extension gigatribe-agent to browse Gigatribe chat files
developers-guide: new chapter Mobius’ Software Architecture
gtk-ui: new method container.set_content
gtk-ui: new method container.get_content
gtk-ui: new method container.remove_content
gtk-ui: tableview columns accept new attribute is_markup
report-viewer: use ui.widget.container
datasource-model: fix datasource.get-path bug
imagefile-solo: fix Handler.retrieve_metadata bug
imagefile-dossier: implement Handler.build_reader
datasource-imagefile: better support for solo, dossier and talon in datasource.get-path service
copyright (c) 2013 notice

Changelog v0.5.17

new extension datasource-imagefile
new extension datasource-physical-device
new extension imagefile-dossier
new extension imagefile-talon
new extension imagefile-solo
data-sourcerer: improved version, accepting datasource types
datasource-model: new service datasource.get-metadata
datasource-model: new service datasource.is-available
datasource-model: service ‘set-default-type’ eliminated
datasource-model: service ‘datasource.new-from-uri’ moved to datasource-imagefile
datasource-imagefile: handles imagefiles DND
datasource-scsi extension eliminated
datasource-raw extension eliminated
datasource-ewf extension eliminated
datasource-talon extension eliminated
datasource-solo extension eliminated
datasource-dossier extension eliminated
gtk-ui: new widget ‘container’ implemented
gtk-ui: method ‘hide’ implemented for all widgets
gtk-ui: tableview.get_data ignore invisible columns
data-viewer: better control of selected item
data-viewer: handles ‘item.datasource-modified’ event
partition-viewer: better control of selected item
partition-viewer: handles ‘item.datasource-modified’ event
uri-file: file.get_metadata uses datatime.datetime
ice: DND before case item bug fixed
report-model: global dataholder class Data available
turing: import dialog title corrected
category-model: category.xml updated
xml-pickle: added support to ‘long’ type

Changelog v0.5.16

new extension turing-model deploys a cryptographic API
new extension turing is a frontend to the turing-model extension
new extension hive-turing integrates the hive and the turing extensions
gtk-ui: new widget ui.widget.multiviewer
gtk-ui: tableview.__iter__ implemented
hive: clear registry option implemented
hive: emits ‘registry.updated’ event
hive-report: user accounts and user passwords reports unified
hive-report: user accounts report uses crypt.unhash_win
hive-report: new “logon info” report
imagefile-split: method is_available implemented
imagefile-raw: method is_available implemented
imagefile-ewf: method is_available implemented
partition-viewer: check if stream is available
data-viewer: check if stream is available
gtk-ui-treeview: bug fixed in clear method
tutorial: new chapter “cracking Windows password”

Changelog v0.5.15

new extension gtk-ui-treeview implements ui.widget.treeview with GtkGenericTreeModel
new extension partition-viewer
hive: uses ui.widget.treeview in reportview
part-catalogue: uses ui.widget.treeview
part-catalogue: uses ui.widget.attribute-list
imagefile-split: better implementation of write method
datasource-model: workaround for datasource-scsi size bug
datasource-scsi: strips ‘\0’ from metadata

More Information: here