Brunnhilde Versions Save

• Fixes Brunnhilde to work with Siegfried 1.10's addition of class by switching CSV import to be key-based rather than column index-based (#60)

Patch release

• Removes the requests library, which is no longer in use in Brunnhilde and prevents installation on Python 3.5 (https://github.com/tw4l/brunnhilde/issues/58)

Bugfix release.

• Fixes UnicodeDecodeError when reading Siegfried CSV files (#36)

Patch release.

• Adds an --in-memory-db option to create and use the sqlite database in RAM rather than on disk (#31)

Community patch release:

• Add Windows support for ClamAV virus scan (#55)
• Refactor duplicates query and report processing to be significantly faster for large quantities of files (#52)

Many thanks to @djpillen and @kieranjol for the contributions!

Bugfix release.

• Add missing closing </div> to default "None found" HTML report section: ebcf262cdffd3018e0fda01ffb80e37747d84e34
• Add API backwards compatibility support for deprecated --save_assets and --load_assets flags: 61d48e341796e7fb8739596abab2e030131306d7
• Add CLI deprecation notices for basename, --save_assets, and --load_assets arguments

Brunnhilde 1.9.0 will be the last Brunnhilde release (with the exception of bugfix patch releases) to support Python 2, which hit end of life on January 1, 2020. The next major release of Brunnhilde is anticipated to be a significant rewrite.

Functional changes

Brunnhilde 1.9.0 includes a number of code quality and readability improvements, as well as:

• A new simpler syntax for calling Brunnhilde: brunnhilde.py source destination. The old API (brunnhilde.py source destination basename) is officially deprecated but will continue to be supported for API stability.
• New stylings for the HTML report, which no longer require Bootstrap or any external JavaScript or CSS dependencies. This removes the need for an internet connection or for caching asset files locally.
• A new properly-formatted "Virus report" section of the HTML report with its own link in the navigational bar.
• Improved "Duplicates", "Warnings", and "Errors" sections of the HTML report.
• Improving terminal logging, using Python's built-in logging module.
• Better handling of output directories. If the output directory already exists, Brunnhilde will now quit with a warning unless the-o/--overwrite option is provided.
• Support for running bulk_extractor on Windows.

New features

• The new --stdin and --csv options enable Brunnhilde to use a Siegfried CSV file as input from either piped stdin or a file, respectively, if the source being analyzed is a directory (issue #1).
• The new --hfs_partition and --hfs_fsroot options enable users to specify a partition number or POSIX path to unhfs to specify which files should be extracted from HFS disk images (issue #45, with thanks to Brian Dietz, NCSU Libraries).
• The new --regex option enables users to pass a regular expressions file to bulk_extractor to have bulk_extractor search for custom patterns (with thanks to Joe Carrano, MIT Libraries, https://github.com/tw4l/brunnhilde/pull/49).

Bugfixes

• Close connections before deleting the sqlite database (https://github.com/tw4l/brunnhilde/pull/48).
• Empty CSV files are no longer written to the csv_reports directory.

• Adds -v or --verbosesf argument which enables verbose Siegfried logging to the terminal during scanning. This addresses https://github.com/timothyryanwalsh/brunnhilde/issues/40 and should make it easier for users to tell the current status of the Siegfried scan for larger sources.

• Addresses Issue 38 by:
  • Replacing the wget Python module with requests (removing the cryptic "-1/unknown" terminal output and improving handling of downloads)
  • Adding --save_assets and --load_assets arguments that allow users to cache and retrieve the HTML report's Bootstrap CSS and JavaScript dependencies at a local filepath of their choosing, removing the need for an internet connection to use Brunnhilde. Previously, Brunnhilde HTML reports linked out to CDNs to render correctly; this was seen to be a preservation risk. The default behavior remains for Brunnhilde to download its Bootstrap dependencies from the Brunnhilde Github repository on each run.
• Renames the assets directory to hidden directory .assets.
• Fixes buggy formatting in display of Social Security Numbers found by bulk_extractor in the Brunnhilde HTML report.
• Renames the "PII" section of the Brunnhilde HTML report to "SSNs", more accurately reflecting the content being displayed, which is currently only Social Security Numbers. Other features found by bulk_extractor can be found in the bulk_extractor output directory.

• Changes to HTML report: now named report.html; CSS updated to Bootstrap 4; significant stylistic changes.
• All CSS and JS requirements for the HTML report are now downloaded locally rather than being linked from CDNs (unfortunately, at this time this means you need an internet connection at the time you run Brunnhilde).
• SQLite database is now removed by default at end of processing. -k and --keepsqlite arguments were introduced to give users the option to retain the database.