V11.1 build 1008 11th June 2025$$$Hash Sets$$$Fixed crash when New Set... is used when no DBs are active$$$Fixed controls not being enabled if new DB was created and there are no existing DBs$$$Fixed controls not being disabled when deleting last DB$$$Misc$$$Fixed XML file existence validation when importing cases to prevent crashes$$$Revert libbde back to 20220807 as it wasnt loading some bitlocker images$$$Updated VolatilityWorkbench to 3.0.1012$$$Prevent processes without administrator privileges from accessing the DirectIO kernel device to reduce security vulnerabilities

V11.1 build 1007 6th May 2025$$$Case Management$$$When adding volume shadow to case; fixed bug showing only the first volume shadow info when selecting All$$$Indexing$$$Recompiled OSFOCR to fix slow OCR processing speeds$$$Fixed some unique word count inconsistencies when running exiftool

V11.1 build 1006 29th April 2025$$$Event Log Viewer$$$Fixed General and Details tabs showing different info in certain situations$$$File Name Search$$$Fixed files identified as hash set matches not given the barcode icon identifier in the Flags column$$$Fixed scrolling issue in config window causing incorrect element placement in certain cases$$$UsnJrnl Viewer$$$Fixed issue where pre-extracted UsnJrnl $J stream may fail to parse by the viewer

V11.1 build 1005 16th April 2025$$$Email Viewer$$$Added E-mail folder column in HTML index file when exporting e-mails$$$Disk Imaging$$$Fixed bug where assigned the assigned category from Attach Image Metadata File to Case on Completion was not working$$$Indexing$$$Added right-click option to jump to e-mail message$$$Fixed .gz files not being indexed properly when running multiple threads$$$Prefetch Artifacts$$$Fixed issue where Prefetch from Windows 11 systems were not being processed correctly which resulted in certain fields being absent from display$$$User Activity$$$Fixed bug where JumpLists were not being processed when using Folder/Network Path option to add drive to case

V11.1 build 1004 19th March 2025$$$Email Viewer$$$Fixed crash due to regression in Jump to message right-click option$$$Fixed possible crash when exporting PST to MSG$$$Hash Sets$$$Fixed some active hash databases not being saved when reopening OSF$$$Fixed Hash DB link not showing all active DBs being used in Lookup File in Hash Set window if DB names are long$$$Removed checks for active database when importing; user selects database to import to during import process$$$Fixed one database always being active on OSF reopen if all were set to inactive$$$Updated all the warnings about no active databases to be consistent$$$Fixed some fields not being disabled while creating new hash set$$$Manage Case$$$Changed to throw error if key/password was incorrect when adding BDE volumes to case$$$USB Write-Block$$$Restored USB write-block setting on OSF exit and case deletion$$$Enhanced USB write-block verification: Creates OSForensics write-block check.txt on the target drive; appends test logs if the file exists.$$$Enhanced status bar with more detailed information.$$$Added a button in the list view for per-device write-block verification$$$Displayed write-block check results; auto-hiding after 5 seconds$$$Removed USB Write-block from the customize workflow list$$$User Activity$$$Web History; Fixed possible crash accessing the URL records for browser history when parsing WebCacheV01.dat. The URL may be empty/null for some entries

V11.1 build 1003 28th February 2025$$$Auto Triage$$$New Reports generated after running triage under Suggested Actions will prompt confirmation before opening the report in default system viewer (to prevent undesired opening forensic report on the suspects computer)$$$Email Viewer$$$Fixed possible crash caused by heap corruption (string buffer overrun) when exporting emails$$$File Hashing - Hash Sets$$$Added result summary when importing Project VIC hash set$$$Added option to cancel import when importing Project VIC hash set$$$Updated multi-file hash lookup to show current file more accurately$$$Fixed issue where it would import to the wrong hash database$$$Fixed hash database not being populated after NSRL import$$$Fixed NSRL import error for long file names$$$File Viewer$$$Fixed potential file path buffer overflow when getting case device info. For very long / deep paths this could result in a crash of OSF when viewing files

V11.1 build 1000 30th January 2025$$$Auto Triage$$$Changed to try recovering BitLocker keys instead of just detecting BitLocker status$$$Drive Preparation$$$Fixed possible bug where if OSF failed to open drive the first time; the retries to open drive would fail as well$$$Event Log Viewer$$$Added decoded XML from details tab to general$$$Renamed User to User SID to avoid confusion between other uses of User in other modules$$$User SID column will display some known Security IDs (https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-identifiers) in addition to the SID$$$Changed to now show -1 as the number of event log records if the event log is returning invalid log records$$$Display Device Connected/Disconnected in General tab for devices using DirectAccess$$$File Name Search$$$Added Website Files pre-set$$$Changed to allow resizing of config window for machines with low screen resolution$$$File Viewer$$$Entropy Tab; Added Scan @ VirusTotal.com option which will upload the current file to VirusTotal and scan it$$$Metadata Tab; Removed Date/Time and File Permissions Attributes from showing for files extracted to temp before running exiftool$$$Updated the number case changes allowed in a word when using the Extract String function from 5 to 15$$$Hashing$$$Added ability to have more than one active Hash Database$$$Added Add to existing hash set option in Hash Selected Files window$$$Added field to name Hash Database & Hash Set when creating Quick Hash$$$Added Hash Database name to hash scan results$$$Indexing$$$Added ability to run selected files against active hash sets and create quick hash sets$$$Changed to go to the first tab that has any results instead of last tab that has results$$$Changed to default to most recently created index$$$Fixed possible crash when going to the Search Index tab when case does not contain any existing indexes$$$Manage Case$$$Updated to save the last used custom case location; and use it for new cases$$$Disabled Tagged Files from automatic inclusion in the report$$$Mismatch Files Search$$$Added right-click option to save checked items to disk$$$Fixed Browser Cache preset not working for images with multiple partitions$$$Fixed Browser Cache scan not working on certain versions of Chrome$$$Passwords$$$Added Select Partition window to Windows Login Passwords tab$$$Fixed Wi-Fi passwords not being decrypted$$$Fixed possible stall when trying to decrypt NTFS encrypted files; OSF will now treat them as not supported; as the file is not readable$$$Fixed recovered password hint not displaying$$$Fixed UI elements being disabled if scan is cancelled in certain situations$$$System Information$$$Added System Clock (Time Sync) setting under the Timezone Info (Registry) section$$$User Activity$$$Website Logins; Added additional check for Firefox install location$$$Fixed a potential crash when parsing the users Master Key$$$Misc$$$Added new Report Bug option to make reporting bugs for streamlined$$$Updated to VolatilityWorkbench 3.0.1010$$$Fixed reading data of compressed files with more than 1 non-sparse fragments in a compression unit

V11.0 build 1015 29th October 2024$$$File Viewer$$$File Info; Change LCN to display <Sparse> instead of -1 for sparse fragments$$$User Activity$$$Fixed a potential crash during cookie scans$$$Misc$$$Updated VolatilityWorkbench to V3.0.1009

V11.0 build 1014 3rd October 2024$$$File Viewer$$$When opening encrypted file within an image; fallback to using direct access if unable to decrypt temporary copy of the file$$$Misc$$$Fixed issue with OSF crashing when trying to boot from USB

V11.0 build 1013 24th September 2024$$$File Viewer$$$Fixed possible crash on some machines when opening files

V11.0 build 1012 20th September 2024$$$Create Disk Image$$$Further improvements to E01 and Ex01 disk imaging speeds when compression is in use. Compared to build 1010 this can result in a 7 fold performance improvement (depending on hardware and settings). A 5 hour imaging job might now take 40min !!$$$Fixed Preparing to copy status not being updated when creating E01/Ex01 images$$$Fixed compression speed being displayed when compression is set to None$$$Fixed unable to set # threads to max of 32$$$Fixed occasionally incorrect image format and options being grayed out when editing imaging settings$$$Changed default number of threads to be dymanic; to optmimse performance based on the hardware in use$$$Display warning message when # threads is greater than 16 or the number of CPU cores$$$Set default compression level to Medium. This was done becuase medium compression is now significantly faster than it was and is now the bets default option.$$$Show compression level and # threads in Create Disk Image under Options column

V11.0 build 1011 17th September 2024$$$Create Disk Image$$$Use multithreading to improve E01/Ex01 imaging performance$$$Added UI option to set # threads for E01/Ex01 imaging$$$File Previewer$$$Fix bug with HEIC images having Red and Blue colors flipped$$$Misc$$$Fixed issue where area around the main logo was flicking as the mouse cursor moved over it

V11.0 build 1010 6th September 2024$$$Customize Workflow$$$Fixed the issue where Lock/Unlock button text was not displayed properly$$$Fixed the issue where the lock and unlock action was not in effect after pressing Enter key$$$Deleted Files$$$Clicking the X in the text search will Enter and the results should clear the text search filter. Also added Reset Right-Click option in the Scan Status tab to do the same.$$$Drive Preparation$$$Fixed issue with warning message strings not shown in full$$$Email Viewer$$$Changed PDF/HTML/MSG email export file naming scheme to: [Email Filename]-[Delivery Date in Case Time]-[Entry ID]-[Sender Email Address]$$$Start/End date ranges on the search filters are now updated according to the list-view items delivery time$$$Updated to take into account time zone for search filtering by Start/End dates$$$Updated Emails export format.$$$Updated column sort for the Email export index.html$$$ESEDB Viewer$$$Fixed sorting issue when results have been filtered$$$Indexing$$$Added View with E-mail Viewer option to the right-click checked items submenu for the Emails tab$$$Optimized the process of loading multiple emails to Email Viewer$$$Fixed issue where duplicate items were added when loading multiple emails to Email Viewer$$$Fixed issue with exporting a single email as HTML$$$Internal Viewer$$$Changed to perform regular expression searches using UTF8 strings only (to support URL regular expressions)$$$Fixed memory bug when extracting strings in Hex View$$$Mismatch Files Search$$$Added Browser Cache pre-set that allows the user to scan a specified evidence device or directory for Windows web browser cache$$$Web Server Log Viewer$$$Fixed possible crash on log files loading$$$Misc$$$Added a new line under the main OSF logo to display X days left to validate warning test in red when there is less than 10 days left for license check$$$Updated the warning message that displayed when the subscription license is expiring soon

Android Artifacts$$$Updated to allow double-clicking tagged items from Manage Case dialog to open Android Artifacts module; select the item on the tree-view and display on the tab view$$$Updated list-view:$$$- Added Tag Flag column$$$- Added Read column to the MMS/SMS Messages$$$- Added Read/Unread status to the preview$$$- Removed Read column from Conversations$$$Updated right-click menu options$$$Deleted Files$$$Added additional sanity checks to JPG carving to prevent buffer out of bounds access$$$Disk Imaging$$$Display total time taken and average speed after imaging$$$File Viewer$$$Fixed issue opening docx files with non-ASCII filenames

V11.0 build 1007 20th March 2024$$$$$$Android Artifacts$$$Added destination target write permissions check before launching acquisition$$$Fixed issue that OSFExtract-data.xml file was not created properly under certain conditions (e.g. Failed to create OSFExtract folder in the destination target)$$$Fixed issue where the image was not loaded properly when the OSFExtract-data.xml file was placed in the root folder instead of in the OSFExtract folder$$$Updated logs display format$$$Deleted Files Search$$$Fixed hash calculation using DirectAccess version instead of buffer version of file$$$Drive Preparation$$$Fixed issue where this module was unable to be run on Drive-0$$$File Viewer$$$Fix lockup of internal viewer when attempting to read past media stream size$$$Hash Sets$$$Updated to include total # files to hash in Files hashed field$$$Updated to display # files with errors$$$Manage Case$$$Removed category ID column from Case Edit window - Case Categories tab$$$User Activity$$$Fixed possible crash when scanning VLC .ini file$$$Fixed issue where OSF is stuck scanning Event Logs on Linux$$$Config; Changed to auto uncheck Moved Downloads if Downloads is unchecked$$$Misc$$$Fixed possible crash when running USB install$$$DirectAccess; Fixed bug in I30 b-tree incorrectly using index record size rather than cluster size. This caused errors traversing the file system and reading file data when the cluster size is not 4096 bytes$$$Updated OSFMount to V3.1.1003

V11.0 build 1001 18th January 2024$$$Android Artifacts$$$OSForensics now receives contact photos from OSFExtract and saves them to disk but does _not_ display them in any way nor does it associate them with the actual contact to whom they belong$$$Added play button to MMS video thumbnails$$$Added contact name to SMS/MMS list$$$Added missing conversation view information$$$Added contact photos to contact window$$$Fixed GDI Bitmap handle leak in MMS thumbnail cache$$$Fixed showing invalid string when no contact name present$$$Fixed bug where OSForensics wasnt consuming and decoding the new forensic data element counts$$$Fixed bug in OSFExtract where .jpg was added to the contents of all ContactParts instead of only the Photo one; to make the contact photo URI into a jpg file name$$$Changed default string for calls with no associated name from null to unknown$$$Improved contact name resolution for conversations$$$File Name Search$$$Added detection of the store.vol Windows Email database file in the UnistoreDB folder; in the preset email search option$$$Update the email preset search to exclude some false positives and also include .msg files in the search$$$User Activity$$$Added a few columns that can be of great forensic value; such as MAC timestamps; File size; Access count (retrieved from DestList); MAC address and System boot timestamp from Birth Object; New&Birth volume IDs$$$Added some extended info retrieved from DestList entry of OneDrive Jump List file (available from Windows 11); for example: Title; User ID; Local path; App name; MAC Timestamps$$$Updated Jump Lists to support for parsing OneDrive Jump List file (5a2098e080cf7ac4.automaticDestinations-ms) on Windows 11$$$Jump Lists; Fixed bug where some Windows 11 were parsed incorrectly

V10.0 Build 1016 10th Octover 2023$$$File Name Search$$$Changed to show Multiple directories selected in directory field instead of the first directory being scanned if multiple directories are selected$$$Fixed issue where it would add to directories to scan rather than replacing them when switching between different directories$$$Registry Viewer$$$Fixed bug where Time Zone values were incorrect (only first byte of integer value returned) when exporting System Hive$$$User Activity$$$Fixed potential buffer overflow issue during the Event Log rendering