Changes / New:
- Added XML style export when creating lists/reports starting from a file-system or folder
- Added (Digital Forensics) DFXML style export when creating lists/reports starting from a file-system or folder
- Support for MFS (Macintosh File System) which was used prior to HFS, mainly on 400KB and 800KB floppies
- Support for DC42 image files, which are old style Mac floppy image files
- Ability to define your own style lists/reports and create/export them from the GUI
- Help (F1) now goes online and shows the online help in your browser. The help file is still installed as well and online help can be turned off in options
- GUI option to display all time stamps in GMT / UTC
Improvements:
- Catch PC going to sleep and wake-up messages and delay auto-finding and removing of drives for 10 seconds after waking up, so that external drives get the chance to be found again. Otherwise (overnight) scan results may be removed again when the PC wakes up (after having gone to sleep), because the drive was dismounted due to the sleep process
- Do not ignore slack space between partitions smaller than 2048 blocks anymore. Assign it to a new partition for easy inspecting, searching etc.
- Improved read caching mechanisms
- Make sure that Main Menu text used to display loaded image file properties is translated, when the language is changed via options
- Repaint block map in the Managed Image File Manager ([Professional] functionality) when F5 is clicked
- Ability to select multiple blocks in the block map, to see the range it spans
- Ability to select multiple blocks in the block map that is part of the Managed Image File Manager, to perform actions on that range
- Keep polling blank media, because sometimes a drive reports blank media while it is still mounting the disc
- Improvements setting the font in the Edit window and better support for different monospace fonts
- Improved sizing of the Drive Combobox on application start, so that it works properly for all fonts and shows the items fully
- Improvements dealing with inactive NTFS INDX records and test their content for duplicate files or folders
- Do not automatically go deep on (embedded) folders that are listed in inactive NTFS INDX records
- Optimized allocating memory for large NTFS folders
- Hide raw type extraction (via right-mouse-click) on media that does not support raw
- Hide the right-mouse-click extents icon when there are no multiple extents
- Remove strange long waits for the right-mouse-click-popup to appear after lots of objects (especially folders) have been found
- Shows ISRC in Track Properties (when available)
- Check if there is enough free space before extracting files etc. and put up a dialog if there is an issue (not enough free space)
- Use CD-Text (if available) for filenames when extraction audio tracks from CD
- Added a plethora of new tags and commands to the existing command line functionality to export lists
- Resource forks are now also always Streams, which is important to know when doing searches, exporting lists etc.
- Made sure the block map also properly shows bad blocks when they fall outside the range of the blocks bitmap
- Show the amount of streams and extents in the right-mouse-click popup on files and folders, if present, to easily spot the exact amount
- Lots of improvements, changes and re-writes in the core code / engine, as this is a living project and to deal with the ever growing new functionality
- Various other, not listed, GUI improvements
Fixes:
- On huge media, e.g. >= 4TB, and under certain conditions, displaying the block map would pop-up a division by zero error
- Sometimes, depending on the content, parsing NTFS would not always work correctly on 4Kn drives (drives with 4096 byte sectors)
- While searching for deleted NTFS files and folders it was possible to get stuck if a deleted folder was both a child and (great) parent, causing a never ending loop
- Under certain conditions, starting multiple extractions could cause memory issues on the stack, resulting into an exception error
- Fix for CD-i (for RTF files for instance) where sometimes the tail end of the file would be missing (if (partially) located on 2324-bytes sectors)
- Fixed it so that the block map is properly refreshed after filling gaps via the Managed Image File Manager
- Fixed Access Violation while extracting a certain illegal NTFS file (freak situation: deleted, embedded, file for which fixup was not set, and only seen one case ... ever)
|
