Releases: andrewbluepiano/macOS-CatalinaForensicsTool
Version 2
Password Verification Functional
The password verification for the password entered in the main application window is now functional through calling a shell script with the password to verify functionality, and allow the full output to be returned to the program if needed.
Small tweaks, bug squashed. Seems stable enough for a 1.0
Just some UI tweaks, and fixed an issue with quoted form of the path to the temporary plist file location in the metadata parsing function.
SystemProfiler Function fixed to full info
Read title.
FSEventParsing Fixed
There was a few bugs involving the FSEvent parsing function. It would work fine when the app was being run from Xcode, but wouldn't work when the app was being run as its .app. It may have also just been because I needed to use the quoted form of a file path in that function. Or it could have been because I was calling the python version.
Either way. Now the function is using the FSEParser_V4 static binary. You might need to chmod it. Which can be automated if it turns out to be needed. In the meantime, here's a build.
MetaData!!!
This release adds in metadata parsing. It will back up the metadata for the entire contents of a given folder, including all directories, subdirectories, their contents, etc.
This is done because there is no way to reverse engineer the spotlight database. I don't know what the spotlight database exactly contains, but from my research & reading, the implementation I have used is the industry standard for getting the metadata for files for a forensic investigation (mdls).
But I store it as a fantastic plist file. So readable. So nice. So pretty. SO TERRIBLE TO IMPLEMENT.
Still 4th beta, just fixed the window sizing constraints.
See title, and release 0.4 notes.
The fourth beta.
Warning window now at start.
TOOL TIPS FOR DAYS!!!!
Things are exported to their own subdirectories now.
Adds in functionality for installation history. Changes outputs of specific functions to subfolders.
This one adds FS Event Parsing via David Cowen's FSEventsParser.
Temporary icon replaced with final icon
No code changes, just icon update.
Solid Base Build
Although this build only has two options, the interface, Cocoa elements, and AppleScript code have been through a lot of revision, and most of the strange behaviors have been fixed.