Mobius Forensic Toolkit

This release features the Turing extension, an extension to handle cryptographic services. It is fully integrated to the Hive (registry) extension, so that when registry files are opened, it automatically records the user account password hashes and tests keywords such as LSA secrets, e-mail passwords, and Internet Explorer Autocomplete, among others. All hashes and passwords found are stored in an SQLite database. The Turing extension exports and imports to/from John The Ripper .pot files and to John The Ripper hash files.

This release features 14 new registry reports: autorun, services, IE download folder, IE typed URLs, MRU files opened/saved, MRU files executed, search assistant, printer ports, processors, all devices, enumerated devices, HID devices, network devices, and stream devices. Minor improvements were made.

This release introduces the Integrated Case Environment (ICE) extension, which replaces the Case Viewer extension. A new and improved data representation of the case model was developed. Several minor improvements were made.

The new extension Datasource Dossier handles Logicube Dossier imagefiles. The Hive Report features 3 new reports: LSA secrets, Protected storage, and Cached Credentials, and both user password report and email accounts report show the passwords when available. The Part Catalogue has been improved. Several other improvements were made.

The Hive (registry viewer) features three new reports: email accounts, TCP/IP interfaces, and computer descriptions. All registry reports can be exported as CSV and the user password report can be exported in a format suitable for John the Ripper as well. Minor improvements were made.