Repository navigation
Persist hash verification and unlocked volumes; fix recents and Office previews - #171
Merged
Merged
Conversation
… Office previews - Hash verification: the badge is now drawn from the verification recorded in the case, so it survives reloading the case or switching exhibits. - Recent cases: setting an examiner name files the open case under that name, and the Cases view refreshes. - Unlocked volumes: the case keeps the BitLocker FVEK / LUKS master key, checks it again on reopen, and restores the volume unlocked. Locking a volume or removing its evidence drops the key. The case file therefore holds decryption keys. - Office previews: OOXML files whose first zip entry is [Content_Types].xml (Word, Excel, PowerPoint) are recognised from later entries, or from the file extension, and open as documents rather than archives. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
volume.unlock.restored. Locking a volume or removing its evidence drops the key.[Content_Types].xmlfirst, so the first-entry sniff never matched; they are now recognised from later entries or the extension.Security note
The case file now holds volume decryption keys, so anyone who can read a case can read its unlocked volumes without the password or recovery key. Passwords and recovery keys themselves are never stored.
Tests
New:
tests/test_recents_whoami.py(live-server test) and three kept-key tests intests/test_bitlocker.py. Thetest_b*,test_c*andtest_l*files pass (198 tests). The web changes (web/app.js) have no JS test harness and were only syntax-checked plus a hand check of the zip-detection pattern; not exercised in the UI.🤖 Generated with Claude Code