Skip to content

Releases: ramikhashmel/ContainerForensics

v0.2.0

22 May 02:18

Choose a tag to compare

ContainerForensics v0.2.0

Significant capability and accuracy improvements over v0.1.0.

Device signature database
Expanded from 6 to 18 device and software profiles. Added WhatsApp,
Instagram, OBS Studio, Xbox Game Bar, QuickTime screen recording,
Samsung Galaxy S series, Google Pixel, Axon body-worn camera, DJI
drone, DJI 360 editor export, iPhone slow-motion, and iPhone
ReplayKit screen recording. Overhauled scoring algorithm to prevent
generic evidence from matching device-specific profiles.

New analysis checks

  • O7: mdat payload accounting — flags unexplained surplus/deficit
    against declared sample sizes
  • A6: trailing data detection — flags data beyond the last
    structural box
  • O8: stco/stsc chunk-count agreement
  • O9: cross-table sample-count consistency (stsz/stts/stsc)
  • M2 extended: video frame-rate vs. timescale check

Triage framing
Reports now open with a TRIAGE RESULT line and explicit disclaimer.
SIGNIFICANT severity redefined as priority recommendation for
further examination, not an authenticity determination.

Correctness fix
Removed silent truncation of large offset tables. O2 and O4 now
run on complete data for long/high-framerate recordings.

Language corrections
M5 relabelled "Post-processing software signature identified." D1
now states explicitly this is a similarity score, not a device
identification.

38 tests passing.