Skip to content

Releases: andrewbluepiano/macOS-CatalinaForensicsTool

Version 2

05 Dec 16:38
Compare
Choose a tag to compare

Setup functions optimized and function corectly.

Got password verification working without need to call to additional script using one line of AppleScript.

Password Verification Functional

05 Dec 16:03
Compare
Choose a tag to compare

The password verification for the password entered in the main application window is now functional through calling a shell script with the password to verify functionality, and allow the full output to be returned to the program if needed.

Small tweaks, bug squashed. Seems stable enough for a 1.0

04 Dec 11:08
8f722dc
Compare
Choose a tag to compare

Just some UI tweaks, and fixed an issue with quoted form of the path to the temporary plist file location in the metadata parsing function.

SystemProfiler Function fixed to full info

24 Nov 11:45
Compare
Choose a tag to compare

Read title.

FSEventParsing Fixed

24 Nov 11:18
Compare
Choose a tag to compare
FSEventParsing Fixed Pre-release
Pre-release

There was a few bugs involving the FSEvent parsing function. It would work fine when the app was being run from Xcode, but wouldn't work when the app was being run as its .app. It may have also just been because I needed to use the quoted form of a file path in that function. Or it could have been because I was calling the python version.

Either way. Now the function is using the FSEParser_V4 static binary. You might need to chmod it. Which can be automated if it turns out to be needed. In the meantime, here's a build.

MetaData!!!

24 Nov 05:07
cda864c
Compare
Choose a tag to compare
MetaData!!! Pre-release
Pre-release

This release adds in metadata parsing. It will back up the metadata for the entire contents of a given folder, including all directories, subdirectories, their contents, etc.

This is done because there is no way to reverse engineer the spotlight database. I don't know what the spotlight database exactly contains, but from my research & reading, the implementation I have used is the industry standard for getting the metadata for files for a forensic investigation (mdls).

But I store it as a fantastic plist file. So readable. So nice. So pretty. SO TERRIBLE TO IMPLEMENT.

Still 4th beta, just fixed the window sizing constraints.

22 Nov 08:02
Compare
Choose a tag to compare

See title, and release 0.4 notes.

The fourth beta.

22 Nov 07:48
Compare
Choose a tag to compare
The fourth beta. Pre-release
Pre-release

Warning window now at start.

TOOL TIPS FOR DAYS!!!!

Things are exported to their own subdirectories now.

Adds in functionality for installation history. Changes outputs of specific functions to subfolders.

This one adds FS Event Parsing via David Cowen's FSEventsParser.

Temporary icon replaced with final icon

21 Nov 06:05
Compare
Choose a tag to compare
Pre-release

No code changes, just icon update.

Solid Base Build

21 Nov 03:35
34734e7
Compare
Choose a tag to compare
Solid Base Build Pre-release
Pre-release

Although this build only has two options, the interface, Cocoa elements, and AppleScript code have been through a lot of revision, and most of the strange behaviors have been fixed.