• General: Hunter module output now reflects VK record rather than non-resident data offsets

HBIN-Recon-v1.0.0.75.zip MD5 Hash = fbc0cc71d968c76041b4e53b009c2c9c

• General: Improvements related to the experimental association of vk to non-resident data in Mode 2, including better handling of problematic scenarios including duplicated hbins

• General: Changed the previous "Confidence" column to "vk_mapping_verified" and it is now applied to Hunter Module and vk-specific output

HBIN-Recon-v1.0.0.74.zip MD5 Hash = 4ee2789efb1aa3db286fb32107a3317b

• General: Many improvements to experimental association of vk to non-resident data in Mode 2. Extremely powerful when dealing with carved (and especially unorganized) hbins. New columns “potential_mapping” and “Confidence” support this feature.

• Hunter Modules: New Office MRU Hunter module which identifies Microsoft Office Most Recently Used information

HBIN-Recon-v1.0.0.73.zip MD5 Hash = fae9ba9ebe011cc2465c37b98c137698

• Task Hunter: New records which include Triggers, Date, and Hash

• Task Hunter: Adjustments to experimental Mode 1 Task Hunter support for associating certain non-resident data to its vk record

• Task Hunter: Actions task_action identity is now split into a separate column, existing DynamicInfo created column is now created2, and last_run_result now includes a human-friendly description

HBIN-Recon-v1.0.0.71.zip MD5 Hash = e2c4d705a5c4d27e858b09aa9403e640

• Hunter Modules: New Task Hunter module which identifies scheduled task information

• Hunter Modules: Experimental Mode 1 Task Hunter support for associating certain non-resident data to its vk record

• General: Improved Mode 1 when dealing with particularly small records

HBIN-Recon-v1.0.0.69.zip MD5 Hash = 4e0c3fd839c6a3130e15727e7a7a6f76

• Hunter Modules: New MAC Hunter module which identifies MAC addresses with a focus on BSSIDs

• General: Carving from any input (Mode 4) now supports loose hive bin records

• General: Improved DB schema to cover both nk & vk timestamps as well as inclusion of all records when importing with SQL

• General: Various bug fixes

HBIN-Recon-v1.0.0.68.zip MD5 Hash = 374720db6196c16bbbfd72a663775126

• Hunter Modules: UserAssist Hunter now supports older Windows versions (XP onward)

• General: Database import support with sample schema (useful for timelining)

• General: Licensing system adjustment

• General: Various bug fixes

HBIN-Recon-v1.0.0.62.zip MD5 Hash = 5a11f012e4eee6d653fd762b14dfa84f

• General: Improved parsing performance and sk record validation

• Secrets Hunter: Improved syskey detection and secrets decryption

• Various performance improvements

• Default logging is now less verbose

• Fixed bug with (extremely) large output files

• Various improvements in sk record handling

• New Secrets Hunter module - extremely powerful identification and decryption of Windows secrets from SECURITY hives

• Bugfixes which improve large input handling

• Updated readme

• New Syscache Hunter module

• Experimental support for “Mode 2” (targets carved & stacked HBINs) full and partial nk path reconstruction, as well as nk and vk association