c29d245968
Retro decryption working for statekeys
...
- Retro decryption working for statekeys (including factoring in chromekeys)
2025-10-20 11:49:29 -07:00
81fae70fc6
Fix for retroactive masterkey decryption
...
- Fix for retroactive masterkey decryption
2025-10-16 15:50:17 -07:00
b129422e8f
ABE v3 fixes and state key retroactive decryption
...
- Fixed decryption of v3 ABE keys via the CNG chromekey
- Schema mod w/ indexes for ABE mks
- New masterkeys now used to retroactively decrypt Local State keys
- added retry_decrypt_state_keys_for_masterkey for retroactive decryption
- Added more references
2025-10-16 12:01:34 -07:00
14e8147d76
chromium FK constraints, delete faster, retries+timeouts
2025-10-15 17:24:56 -07:00
87dacba761
Start of CNG Google Chromekey1/AES key ABE
...
- Start of CNG Google Chromekey1/AES key decryption for v3 of ABE key
- Added cng file enrichment module
- Entropy can now be passed through for blob decryption
2025-10-14 16:28:58 -07:00
95f158225d
update guids to be text so they're seachable
2025-10-14 12:54:17 -07:00
acc5e9f2b3
add domain backup key ID
2025-10-11 23:46:45 -07:00
51f05a3acd
add write-once constraints to DPAPI columns
2025-10-11 02:11:14 -07:00
3b969b2d01
rename UserAccountType to MasterKeyType
2025-10-10 23:49:26 -07:00
2b2ac94c23
add created/update timestamps to DPAPI
2025-10-10 23:23:50 -07:00
5afb864fca
update masterkey parsing
2025-10-09 08:55:20 -07:00
2baa7d5d6a
add CLI --folder option, linkings foreign key, linkage UI bug, plaintext checks in analyzers
2025-10-02 23:02:36 -07:00
e31239a8b3
fix constrain problem, decryption perf logging
2025-09-24 00:00:28 -07:00
91cc2b4028
dpapi postgres hookups, backup key validation
2025-09-23 15:45:32 -07:00
6f59fd0128
Moved file_linking code from file_enrichment into a library
...
-Moved `file_linking` code from `file_enrichment` into a library
-Added windows dpapi_master_keys.yaml file link rule
-Started integrating `nemesis_dpapi` library into chromium parser code
2025-09-04 15:07:58 -07:00
40902d9d8f
Version 2.1.3
...
- See CHANGELOG.md for summary of changes
2025-08-29 15:24:32 -07:00
d00e24b734
Update search_documents to support fuzzy search
...
change the WHERE clause to include the following fuzzy searches
content ILIKE '%' || search_query || '%'
file_name ILIKE '%' || search_query || '%'
2025-07-24 15:28:52 -05:00
8035a6a168
add code
2025-06-13 11:33:07 +02:00
harmj0y