Changes:
- IsoBuster now also provides access to logical drives (C: D: etc.) instead of only Physical drives (see options). This gives access to Windows volumes. So on a higher level, which means that drivers can translate the data first before IsoBuster gets it. This is particularly useful in case of encrypted volumes, for instance TrueCrypt mounted volumes
- Dialog for experts with a [Professional] license to work with, test and complete managed image files
- Once an IBP file is loaded, right mouse click the drive-selection control in the left corner and choose "Change or Test managed Image File Properties (Expert)"
- Count the amount of errors inside a specified range
- Change the status of an area
- Complete the image file inside a range
- Command line parameters /CI: /RANGE: /FROMTO: and /EP:NPC to complete a managed image file, inside a range or not
- Ability to create an empty IBP/IBQ file set (no actual reads executed) via /ET:E to allow investigators to complete regions via /CI: and /RANGE: or /FROMTO:
- Allow managed image files to be completed at the end with dummy data if the input drive is "*" (/D:*)
- Implemented ability to reverse read (during extraction), using a given range
- Ability to reverse read via command line parameter: /RR:[Interval]
- Detect if the Linux EXT(2-4) file system is present and show an icon for it (exploration of EXT itself is not implemented but now an investigator knows it's present)
- Detect if the Unix UFS(1-2) file system is present and show an icon for it (exploration of UFS itself is not implemented but now an investigator knows it's present)
- Detect if the Linux Reiser(1-4) file system is present and show an icon for it (exploration of Reiser itself is not implemented but now an investigator knows it's present)
- Detect if the Unix XFS(1-4) file system is present and show an icon for it (exploration of XFS itself is not implemented but now an investigator knows it's present)
- Ability to load an additional LibEWF.dll next to the already present, embedded, libewf-20130416 version. A libewf.dll and its dependables need to be put in the /plugins/ folder
- IsoBuster will now always first try to load the dynamic version (assumed to be more recent) before falling back on the embedded libewf-20130416 version. The embedded version may be removed over time to reduce the size again, we'll see
- New option that defines how strict surface scanning is and whether there should be an abort after an error
Improvements:
- Improved device naming if Inquiry fails
- Improved determination of HD vs USB stick/Flash etc.
- Improved user feedback while cleaning up (sanitising) NTFS so that the user has an idea about where the process is
- Create sparse files when extracting sparse files and no filters are in use for that file
- Ability to drag files to IsoBuster's TreeView, to open as image file, when IsoBuster is running in an elevated state
- Popup warning when extracting from the ISO9660 file system, when other better file systems are present
- Support for the *.image disk file format
- Show attributes for Tracks, Sessions and Partitions in ListView (instead of N/A)
- Fixed it so that HDs larger than 2 TB are seen as 2 TB instead of less, so that at least that space can be fully adressed and explored
- Rewrote the automatic skipping and retry-count reducing mechanism, during extraction of a managed image file, to perform much better
- Allow <%FN> in the filename, in case an image is extracted via the command line
- Dependency on cc3250.dll for old Win2K OS in combination with multi-language support has been removed
- You can now always choose the installation folder. Before this was dependant on previous installations
- Show the object Type, cfr. Windows, in the ListView (for instance "JPG file") and allow to sort this new column (column may be hidden by default, right mouse click the ListView columns to enable)
- Added more sort options that will be performed right after the low level file system / folder exploring is done
- Various other smaller GUI improvements
Fixes:
- Fixed an exception error that happened if auto-folder-scanning was interrupted by closing the application
- Fixed an issue that could cause the last part of Video not to be saved to a file, when this video was being filtered via: "Extract but filter only MPG frames"
|
