erik.miyake: Forensic Framework

Just finished posting the video for the third teaser. The feature updates below had eaten up time that was supposed to be allocated to the Registry Reporter (new name for what I was calling Registry Explorer). I'm getting back to the Registry Reporter this week, so expect a beta soon.

Below is the teaser 3:

Feature Updates:

Overlay Toolbox
- Treble Layout
- Editable Favorites
- Drag and Drop to the Hex Control
- Selectable palette
Hex Tools
- Dropper Select
- Paint Brush Select
- XRAY vision
-Selected color auto cycling
Data Probes
- GUI Rearrangement
Data Visualization
- Control overhaul
- Scrolling and paging updates.
- Zoom level buttons
- Display of selections in hex control
Hex Control
- added SeekUntil overlay feature
- modified to support tool behavior changes

Image: XRAY feature

User can enable the XRAY tool and select an overlay type to have the hex control highlight items which match the overlay type. Some overlay types are more discriminating than others, and are therefore more effective to identify data of interest i.e. "Windows 64 LE Timestamp" vs UInt64.

Image: Favorites toolbox editor

A user can customize a favorites toolbox with only the overlay types that they wish to work with at the time. These custom toolboxes can be saved and loaded later.

Image: Data probes

Data probes allow a user to selected an offset within the hex control and have it evaluated against different data types. The data probes are broken into three categories: Binary(Numeric), Timestamp, and Text Encoding.

Image: Binary probe

Image: Timestamp probe

The display formatting, timezone, and valid date ranges can be modified for the timestamp probe. The data range allows the timestamp probe control to only display decoded data time values which fall within the range of interest. This helps eliminate dates such as 3 AD, January 1rst ...( I think that is a Monday)... which probably doesn't have any relevance to your data.