v2.11.0

This release contains the following changes of note:

• Improvements to the MFT parser, allowing data streams to be extracted, decoded and written to disk.
• Decoded MFT Datastreams can now be queried via the Search command and via the Hunt Command.

Additional information in the related PR: #210

This release addresses #190 #191. Thanks to @IppSec for the suggestion.

v2.10.4

Changes in this release:

• Add --skip-errors helper message when chainsaw bails from a hunt
• Improve progress logging for hunt command, now displays elapsed time and the current artefact file being processed

v2.10.3

This release contains the following changes of note:

• Adds -v and -vv to output debug and trace.

v2.10.2

This release contains the following changes of note:

• New Chainsaw Detection Rules
• Significant speed improvements when searching across multiple event log files

v2.10.1

This release contains the following changes of note:

• Minor bug fixes
• New Chainsaw rules
• ARM build for Linux

v2.10.0

This release contains the following changes of note:

• Add the Key/Value (kv) container that can be used to extract key value pairs from strings. (#178)

Thanks to @reece394 for requesting the above (#177) and supplying the PowerShell rules that make use of it (#179).

v2.10.0-beta.1

build: bump to version 2.10.0-beta.1

v2.10.0-beta.0

build: bump to version 2.10.0-beta.0

v2.9.3

This release contains the following changes of note:

• Fixes handling of invalid link dates in the amcache (#176)

v2.9.2

This release contains the following changes of note:

• Fixes incorrect handling of amcache hive on new versions of Windows. (#173)