Changelog

USB Capture tab (Tab 10) in Mobile Forensics records live USB traffic via ETW (built-in, admin required) and USBPcap (optional driver); both engines run simultaneously and produce a unified event timeline

Each captured USB event shows direction, transfer type, endpoint, USBD status, bytes, and hex payload in a colour-coded table

Configuring an API key in Settings now immediately activates the AI provider — previously had no effect until the app was restarted or AI Chat was used first

AI features in Mobile Forensics, Evidence Tagging, and Folder Narratives now correctly pick up the saved API key at first use without a restart

USB Fingerprint tab in Mobile Forensics reads descriptor data passively — works on locked phones, ADB-dead devices, and devices in deep sleep without any app on the device

Descriptor fields read include manufacturer/product/serial strings, bcdUSB, bus speed, MaxPower declared mA, bmAttributes, and all interface class codes

Forensic interpretation shows power-state hint (deep sleep vs active) and interface-mode hint (ADB present, MTP only, etc.) automatically

USB fingerprint result is auto-logged to chain of custody and can be exported as JSON

Recovery sessions now create a drive-stamped subfolder (e.g. C_Recovery_20260625_001200) so multiple runs are never mixed together

Live ETA indicator in the recovery log estimates time remaining from file sizes before recovery starts, then refines from measured speed as files are processed

Open Folder button next to the output path creates the folder if needed then opens it in Explorer

AI rebuild option attempts to reconstruct Low and Medium chance files that cannot be recovered using structural repair and AI image reconstruction

Patch-to-openable option injects minimum valid header/footer bytes (JPEG, PNG, GIF, BMP, MP4, PDF, ZIP, DOCX/XLSX/PPTX, SQLite) so partially rebuilt files can be opened

Every AI-rebuilt file is accompanied by a caveat notice clearly stating it is reconstructed and must not be used as evidence

Catalogs scanned from multiple drives now correctly track and report availability for each drive independently instead of overwriting the first drive

Diagnostics companion APK collects system, application, network, and log information without requiring root access

Legacy APK variant supports Android 1.5+ for the oldest devices including the HTC Dream / G1

Modern APK variant supports Android 5.0+ and is built with Android Studio

Forensic Acquisition Wizard includes a Diagnostics APK section with install, run, wait, and pull workflow

Companion APK does not modify system partitions and writes output only to its own external storage folder

Forensic Acquisition wizard in the Quick ADB Scan tab extracts SMS/MMS, contacts, call logs, browser history, Wi-Fi configs, accounts, packages, logcat, device properties, and /sdcard contents

Non-rooted devices can use a user-selected recovery image with fastboot boot, which loads the image into RAM only and does not overwrite the recovery partition

Wizard requires explicit confirmation before rebooting the device and reports pulled, skipped, and errored artifact counts

New Scan dialog now includes a Drives source selector alongside folder, SIM card, and chip card options

Drive list shows mounted logical drives with labels, filesystem, and size, plus physical disks with model and drive letters

Physical disk selection triggers a forensic raw-drive scan using carving to recover files before cataloging

Mobile Device Forensics dialog tabs are now wrapped in scroll areas for better usability on smaller screens

Mobile forensics AI analysis: generate section-specific AI summaries for device info and ADB scan results from within the Mobile Device Forensics dialog

Vulnerabilities tab scans the extracted device against an offline knowledgebase of known mobile CVEs and exploits

Vulnerability findings are saved to the forensic database, linked to the active case and session for reporting

Offline-only knowledgebase requires no external API calls, supporting air-gapped forensic environments

Tools > Database > Catalog File Info: inspect catalog database path, size, modified date, DB schema version, app version, and comprehensive catalog statistics

Scan history table with drive model, serial number, filesystem, files scanned, and duration — click any row to view the raw scan settings

Export catalog info to JSON, CSV, or plain text for chain-of-custody and evidence documentation

Court-ready forensic reports (HTML, Markdown, Plain Text) include a Catalog File Information section documenting the database, DB schema version, app version, and scan provenance

Drive Overview Duplicates tab now supports column-header sorting with numeric sorting for copies, size, and wasted space

Quick Triage Summary macro preset: generates a ranked briefing of suspicious, credential, crypto, and encrypted files with top 5 items per category

File carving engine now uses page-level SQLite validation (page size + page type checks) to recover exact contiguous fragments of deleted or damaged SQLite databases

Electrum wallet artifact extraction: when an Electrum wallet is detected, addresses, transaction IDs, xpub, xprv, derivation path, and encryption status are parsed and reported

Cross-browser artifact correlation merges history from multiple browsers into a unified timeline and flags multi-browser activity and private-mode candidates

iOS Safari KTX snapshot carving: recover cached webpage screenshots from raw disk images and extract dimensions, format, and snapshot metadata

Mobile browser backup extraction locates Chrome, Firefox, Safari, and Chrome-iOS profiles inside extracted ADB and iTunes backups

Case workflow checklist with 9-step forensic evidence extraction process (intake, identification, preparation, isolation, processing, verification, documentation, presentation, archival)

Forensic Case Management dialog now links to the tamper-evident Chain of Custody tracker pre-filtered to the current case

File carving engine now uses structure-aware parsers for AVI, WAV, and MP3 based on the Yoo et al. (2012) multimedia carving method

NTFS/ReFS metadata recovery foundation: read-only MFT validation, forensic audit logging, and ReFS metadata block detection

Bitcoin forensics transaction graph builder with JSON, DOT, and CSV export, plus Electrum wallet integration

Splash screen loading bar status text is now white and bold for high contrast

Mobile Forensics Quick ADB Scan device info panel has increased vertical spacing for easier reading

Drive Narrative (Tools > Drive Narrative, Ctrl+Shift+N): AI-generated prose summary of your entire drive with time-based activity arc

Folder Narrative: right-click any file to get an AI summary of that file's folder — file types, date range, suspicious or encrypted content

Recursive subtree summarization with configurable depth (default 10 levels) — child summaries roll up into parent folder summaries automatically

Export narrative reports as HTML or PDF directly from the dialog

AI chat can now summarize folders and drives on request using the new summarize_folder and summarize_drive tools

Summaries are cached in the database — re-opening an existing narrative costs zero tokens

Quick ADB Scan tab in Mobile Forensics: scan connected Android devices directly without setting up a forensic VM — works with Android 1.5 and newer

Automatic detection of 2009–2011 era Android devices (HTC Dream/G1, myTouch 3G, Motorola Droid, Samsung Galaxy S, LG Optimus, and more)

Device info panel shows manufacturer, model, OS version, SDK level, battery, storage, encryption status, and root status for connected Android devices

File browser tab lets you list and filter files on the device, then pull individual files directly to your computer

Old Android devices (pre-4.2) are automatically identified — no RSA authorization prompt is needed for these devices

Bitcoin wallet detection now recognizes more record types found in early Bitcoin Core wallets, improving accuracy for pre-2012 wallets

Very early unencrypted wallets (pre-v0.4, 2009–2011) are now flagged with a distinct high-risk warning

Bootstrap.dat and wallet backup files are now recognized as Bitcoin Core data artifacts

Bitcoin Signed Message and P2SH markers added as high-confidence indicators of active Bitcoin key usage

Detects btcrecover password-recovery tool files — high forensic value indicator of wallet recovery attempts

Detects bitaddress.org offline paper wallet HTML files — common artifact on old drives

PSBT (Partially Signed Bitcoin Transaction) binary detection at file header level

Lightning Network invoice detection (BOLT11 mainnet and testnet) and Lightning node file recognition (LND, Core Lightning)

Ordinals index database and BRC-20/Runes keyword detection for modern Bitcoin NFT activity

Silent Payment address detection (BIP352), extended key detection (xpub/xprv/zpub/zprv), and output descriptor pattern matching

Taproot bech32m address regex corrected to match the proper charset

Automatic drive remap detection: if a cataloged drive is now mounted at a different letter, a one-time prompt lets you redirect all file access for the session

Status bar shows the active drive translation (e.g. F: → E:) so you always know when a remap is in effect

All file operations — double-click, Open File Location, right-click open — transparently use the remapped path

Transfer detail panel: view full transfer details including recipient, files, access log, and admin audit trail

Admin can change transfer passwords and extend expiration dates, with all actions logged

Support ticket system: conversation threads, canned responses, AI grammar and tone review for replies, and customer email notifications on status changes

Customer ticket tracking page: customers can view their ticket status and full conversation history in real time

Timeline chart automatically picks the best time granularity (hour/day/month/year/decade) based on your data range

Custom SQL filters now persist correctly between app restarts — previously saved filters were lost on exit

Secure Transfer now supports sending multiple files or entire folders in a single transfer

Admin can attach a separate help/reference document to a transfer for the recipient to download independently

AI support chat now has comprehensive knowledge of all File Cataloger features, security architecture, pricing plans, AI tokens, forensic tools, and troubleshooting steps

AI chat remembers conversation context — follow-up questions work naturally across multiple messages

AI chat upgraded to the latest Gemini 2.0 Flash model for faster, more accurate responses

Stripe checkout for token purchases now works correctly from the desktop app

AI chat shows rotating investigative phrases while thinking instead of a static spinner

Double-click timeline chart points to drill down into finer time granularity

Rapid timeline chart clicks no longer freeze the app — filter updates are now debounced

Deprecated AI model names are automatically replaced with the best available model on startup