From d6f0557c6c096c2dc825d7821452a63bb85bc3ae Mon Sep 17 00:00:00 2001 From: deadp Date: Wed, 16 Sep 2026 22:08:48 +1200 Subject: [PATCH 1/2] Add a changelog for the 0.1.0 release Records what 0.1.0 contains ahead of tagging it, with the themes, theme picker and CI work linked to their PRs, the features not yet implemented, and known issues. CONTRIBUTING.md now asks PRs to add a line under Unreleased. Co-Authored-By: Claude Opus 5 --- CHANGELOG.md | 80 +++++++++++++++++++++++++++++++++++++++++++++++++ CONTRIBUTING.md | 3 ++ 2 files changed, 83 insertions(+) create mode 100644 CHANGELOG.md diff --git a/CHANGELOG.md b/CHANGELOG.md new file mode 100644 index 0000000..44c0f81 --- /dev/null +++ b/CHANGELOG.md @@ -0,0 +1,80 @@ +# Changelog + +Notable changes to Strata. The format follows +[Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and versions follow +[Semantic Versioning](https://semver.org/). While the version is 0.x, a minor +release may change behaviour. + +Add a line under **Unreleased** in the same PR as the change. Examiners read +this list, so write for them: what changed in what Strata reads, reports or +records, not how the code changed. + +## [Unreleased] + +## [0.1.0] - Unreleased + +The first release. Everything is described in the [README](README.md). In +brief: + +### Evidence + +- EWF (`.E01`, `.L01`) including split segment sets; raw/dd; VMDK (flat, + sparse and stream-optimized); VHDX (fixed and dynamic); AccessData AD1. +- Logical evidence: a folder, a zip or a single file opened as an exhibit. +- MBR and GPT volume layout, including damaged tables and the gaps between + partitions. +- Stored acquisition hashes recovered and re-verifiable; EWF chunk + checksums checked as data is read. +- BitLocker and LUKS1 unlock by password or recovery key, held for the + session only. + +### Filesystems + +- NTFS, FAT12/16/32, exFAT, ext2/3/4 with jbd2 journal recovery, APFS and + HFS+/HFSX, parsed directly, with deleted entries, file slack and + unallocated space reachable throughout. + +### Analysis + +- Sixteen artefact parsers with a triage set, including `$UsnJrnl`, + prefetch, LNK and Jump Lists, Recycle Bin, registry keys, shellbags, + Amcache and ShimCache, browser history, event logs and a timeline. +- Registry hives with transaction-log replay and deleted key recovery. +- SQLite (with deleted record recovery), ESE, LevelDB, PST, mbox, Office + documents, PDF, EXIF and cryptocurrency wallet material. +- Literal and regex search with stated coverage; signature carving (29 + built-in signatures); MD5, SHA-1 and SHA-256 hashing with hash sets; + ATT&CK tagging. + +### Interface and cases + +- Hex view with the core sample, data interpreter and structure templates; + directory listing and gallery; a preview pane that never executes active + content. +- Six themes, including midnight, sepia and two high-contrast themes, chosen + from a theme picker dialog + ([#1](https://github.com/switch-nz/strata/pull/1), + [#9](https://github.com/switch-nz/strata/pull/9)). +- Cases as folders with several exhibits and examiners, file extraction + with a hashed manifest, a self-contained HTML report and a hash-chained, + append-only audit log. + +### Project + +- CI on Linux, Windows and macOS across Python 3.8 to 3.13, with unit tests + and a smoke test of the running app; `SECURITY.md`, `CONTRIBUTING.md` and + issue templates ([#12](https://github.com/switch-nz/strata/pull/12)). + +### Not implemented + +EWF v2 (Ex01), FileVault, BitLocker with the Elephant diffuser, LUKS2 with +Argon2, ANSI PST, `$LogFile`, carving across fragments, and opening shadow +copies (they are listed only). + +### Known issues + +- Parser defects found by fuzzing are tracked in + [#15](https://github.com/switch-nz/strata/issues/15). + +[Unreleased]: https://github.com/switch-nz/strata/compare/v0.1.0...HEAD +[0.1.0]: https://github.com/switch-nz/strata/releases/tag/v0.1.0 diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index b53ad06..e8647a5 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -20,6 +20,9 @@ python3 run.py # then open http://127.0.0.1:8722 frontend, runs the cross-platform smoke matrix (which launches the real server), and runs the unit tests. - Keep the diff focused: one behaviour per PR, no drive-by reformatting. +- **Note user-visible changes** under *Unreleased* in + [`CHANGELOG.md`](CHANGELOG.md), written for an examiner rather than a + developer. ## The rules that make this codebase what it is From eebdaa215ea7a19bba41d21414f8bac012261eb2 Mon Sep 17 00:00:00 2001 From: Tim Date: Thu, 17 Sep 2026 14:54:09 +1200 Subject: [PATCH 2/2] Link the wrong-result bugs from the 0.1.0 known issues Known issues pointed only at #15, which covers crashes and hangs. The bugs that matter more to an examiner reading release notes are the ones that return wrong or missing results with no finding, tracked in #19: exFAT timestamps labelled UTC without applying the offset, sparse ext4 files at the wrong offsets, misread ext4 inline data, scrambled deleted FAT names and misplaced FAT slack, a truncated EWF chunk returned short, and split raw sets loading as a partial disk. Each is still an expected failure on main, so each is listed individually rather than behind a link. 0.1.0 is not tagged yet, so what has merged since this changelog was written ships in it: the EWF read bounds (#14), the exFAT contiguous run clamp (#17) and the parser tests, fuzzing and CodeQL (#13) are added. Raw/dd is described as single-file and split raw sets move to Not implemented, matching the README correction in #20. Co-Authored-By: Claude Opus 5 --- CHANGELOG.md | 44 +++++++++++++++++++++++++++++++++++++------- 1 file changed, 37 insertions(+), 7 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 44c0f81..b19b9cf 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -18,8 +18,12 @@ brief: ### Evidence -- EWF (`.E01`, `.L01`) including split segment sets; raw/dd; VMDK (flat, - sparse and stream-optimized); VHDX (fixed and dynamic); AccessData AD1. +- EWF (`.E01`, `.L01`) including split segment sets; single-file raw/dd; + VMDK (flat, sparse and stream-optimized); VHDX (fixed and dynamic); + AccessData AD1. +- Size and offset fields in EWF segment files are bounded, so a damaged + image records a finding instead of exhausting memory + ([#14](https://github.com/switch-nz/strata/pull/14)). - Logical evidence: a folder, a zip or a single file opened as an exhibit. - MBR and GPT volume layout, including damaged tables and the gaps between partitions. @@ -33,6 +37,9 @@ brief: - NTFS, FAT12/16/32, exFAT, ext2/3/4 with jbd2 journal recovery, APFS and HFS+/HFSX, parsed directly, with deleted entries, file slack and unallocated space reachable throughout. +- A contiguous exFAT run that claims more than the cluster heap holds is cut + off at its end, with a finding + ([#17](https://github.com/switch-nz/strata/pull/17)). ### Analysis @@ -64,17 +71,40 @@ brief: - CI on Linux, Windows and macOS across Python 3.8 to 3.13, with unit tests and a smoke test of the running app; `SECURITY.md`, `CONTRIBUTING.md` and issue templates ([#12](https://github.com/switch-nz/strata/pull/12)). +- Parser tests built from synthetic images, mutation fuzzing of the parsers, + tests of the request gate, and CodeQL + ([#13](https://github.com/switch-nz/strata/pull/13)). ### Not implemented -EWF v2 (Ex01), FileVault, BitLocker with the Elephant diffuser, LUKS2 with -Argon2, ANSI PST, `$LogFile`, carving across fragments, and opening shadow -copies (they are listed only). +EWF v2 (Ex01), split raw sets, FileVault, BitLocker with the Elephant +diffuser, LUKS2 with Argon2, ANSI PST, `$LogFile`, carving across fragments, +and opening shadow copies (they are listed only). ### Known issues -- Parser defects found by fuzzing are tracked in - [#15](https://github.com/switch-nz/strata/issues/15). +Corroborate results in these areas with another tool before relying on them. + +- **Some parsers return wrong or missing results without a warning** + ([#19](https://github.com/switch-nz/strata/issues/19)): + - exFAT timestamps ignore the recorded UTC offset but are labelled UTC. + - Files in the later clusters of a contiguous exFAT directory are not + listed. + - Sparse ext4 files read back with their data at the wrong offsets; ext4 + inline files over 60 bytes, and inline directories, are misread. + - Deleted FAT long filenames made of several parts are assembled out of + order, and slack for a deleted multi-cluster FAT file is reported in the + wrong place. + - A truncated compressed EWF chunk is returned short, without a finding. + - Opening the first segment of a split raw set reads that segment alone, + with nothing to say the rest of the disk is missing. Join the segments + first. +- A file with a three-letter extension beside an EWF image, such as + `case.txt` next to `case.E01`, is taken as a segment and stops the image + opening ([#19](https://github.com/switch-nz/strata/issues/19)). +- Some damaged images crash or hang a parser instead of recording a finding + ([#15](https://github.com/switch-nz/strata/issues/15), + [#19](https://github.com/switch-nz/strata/issues/19)). [Unreleased]: https://github.com/switch-nz/strata/compare/v0.1.0...HEAD [0.1.0]: https://github.com/switch-nz/strata/releases/tag/v0.1.0