Crow-Eye Timeline & search enhancement

[Ghassan-elsman]

Overview

Crow Eye v0.5.0 introduces significant enhancements to forensic analysis capabilities, focusing on improved artifact parsing, search functionality, and timeline visualization .

Key New Features

• New Search Engine : A powerful, full-text search system for efficient querying across all artifacts, with support for advanced filtering and natural language input to assist non-technical users.
• Timeline Correlation Dialog : Interactive dialog for visualizing and correlating forensic events in a timeline view.
• ShellBags Parsing : Added parsing for ShellBags artifacts, extracting folder access history, views, and timestamps to reveal user navigation patterns.
• SRUM Parsing : New parser for System Resource Usage Monitor (SRUM), capturing app resource usage, network activity, energy consumption, and execution data.
• MRU and Recent Docs Binary Parsing Enhancements : Improved binary parsing for Most Recently Used (MRU) lists and Recent Documents, with better handling of typed paths, Open/Save history, and recent files across Windows versions. Includes error handling and output in SQLite + JSON formats. Improvements and Fixes

Notes

• Offline Analysis : Still under development for some artifacts—use with caution and report issues.
• Contributions : We welcome pull requests for additional correlations or parsers. Contact ghassanelsman@gmail.com for collaboration.

---

This discussion was created from the release Crow-Eye Timeline & search enhancement .