Turbinia

No entries match these filters. Clear filters

1. 20250131 Feb 5, 2025 · release notes

   Adds local docker compose debugging, Chrome credential parsing, ELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code. and Mach-O parsing

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 20250131 https://github.com/google/turbinia.git
   # already have the repo? check out this version:
   $ git checkout 20250131

   • Adds local docker compose debugging support via a dedicated compose file configuration
   • Enables parsing and extracting saved Chrome credentials within Turbinia recipes
   • Adds ELF File Format Parsing capability for binary analysis
   • Adds Mach-O File Format Parsing capability for macOS binary analysis

   4 details in Everything

2. 20240930 Oct 2, 2024 · release notes

   Adds Task status v2 API for granular task state management and refreshed Yara rules at runtime.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 20240930 https://github.com/google/turbinia.git
   # already have the repo? check out this version:
   $ git checkout 20240930

   • Introduces Task status v2 with improved task lifecycle management and logging updates.
   • Enables Yara Analyser jobs to refresh their rules dynamically at runtime.

   2 details in Everything

3. 20240820 Aug 26, 2024 · release notes

   Turbinia adds API endpoints and CLI commands for logs, evidence, output downloads, and new report views.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 20240820 https://github.com/google/turbinia.git
   # already have the repo? check out this version:
   $ git checkout 20240820

   • Adds API endpoint download.output to retrieve task artifacts
   • Adds request.report markdown functionality to the API server config
   • Adds config.download functionality to the API server config
   • Adds new commands to support the latest API endpoints (logs, evidence, download)
   • Adds request report view in the Web UI

   +2 more show less

   • Adds task report endpoint and corresponding UI changes
   • Updates OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. spec to reflect new capabilities

   7 details in Everything

4. 20240313 Mar 13, 2024 · release notes

   Turbinia adds LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. analyzer with VertexAI backend

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 20240313 https://github.com/google/turbinia.git
   # already have the repo? check out this version:
   $ git checkout 20240313

   • New Turbinia LLM analyzer, LLM lib interface and LLM lib implementation for VertexAI
   • Updated the turbinia-client API calls to use the revised client library

   2 details in Everything

5. 20231116 Nov 16, 2023 · release notes

   Adds evidence upload endpoints, statistics/workers API commands, VERSION_CHECK config, and PostgreSQL SCRAM cracking support

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 20231116 https://github.com/google/turbinia.git
   # already have the repo? check out this version:
   $ git checkout 20231116

   • Added evidence upload and related endpoints to the API server and client
   • Implemented a TurbiniaEvidence object in Redis for internal state management
   • Generated OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. code for evidence, workers, and statistics endpoints
   • Added statistics and workers commands to the CLI via the updated API client
   • Added PostgreSQL SCRAM password cracking support within existing task infrastructure

   +1 more show less

   • Introduced VERSION_CHECK configuration setting for release consistency enforcement

   6 details in Everything

6. 20230726 Jul 26, 2023 · release notes

   Turbinia adds SSH brute force analyzer task and redis-tool script for Redis key management.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 20230726 https://github.com/google/turbinia.git
   # already have the repo? check out this version:
   $ git checkout 20230726

   • Adds the SSHBruteForceAnalysisTask to detect potential SSH brute force attacks
   • Adds the redis-tool script to query, delete, dump, and restore keys in Redis
   • Adds evidence size and name fields to the Turbinia API responses

   3 details in Everything

7. 20230214 Feb 15, 2023 · release notes

   Turbinia 20230214 adds APFSAPFSApple's proprietary filesystem introduced in 2017, replacing HFS+, designed for SSDs with native encryption, snapshots, and space sharing — giving cyber tools reliable forensic primitives on modern Apple devices. and LUKSLUKSA disk-encryption standard built into the Linux kernel that stores encryption metadata in a header on the volume itself, letting cyber tools unlock encrypted drives portably across distributions and implementations. support, a Web UI V2 with task output export, and an API CLI tool.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 20230214 https://github.com/google/turbinia.git
   # already have the repo? check out this version:
   $ git checkout 20230214

   • Adds APFS filesystem support for mounting and processing disk images.
   • Adds LUKS encryption support for unlocking encrypted disk images in Turbinia tasks.

   2 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The turbinia-api-client Python package has been removed; users must now use the built-in api CLI subcommand or other client methods.
8. 20221103 Nov 3, 2022 · release notes

   Adds containerd evidence support, YARA min-score configuration, and CLI flag generation from evidence attributes

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 20221103 https://github.com/google/turbinia.git
   # already have the repo? check out this version:
   $ git checkout 20221103

   • Adds containerd as a new enumeration method and evidence type with corresponding mounting support
   • Adds ability to generate command line flags directly from evidence attributes
   • Adds pre-validation of YARA rules and configurable minimum score via the new Yara Task
   • Expands Postgres compromise rule coverage to include Yugabyte databases

   4 details in Everything

9. 20220919 Sep 20, 2022 · release notes

   Turbinia adds Web UI V1, API Server, ExpertWitness disk support, Yescrypt cracking, and optimized partition filtering.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 20220919 https://github.com/google/turbinia.git
   # already have the repo? check out this version:
   $ git checkout 20220919

   • turbinia now ships with a Web UI V1 and related containers/deployment scripts for visualizing jobs.
   • A new Turbinia API Server docker container is provided to expose endpoints programmatically.
   • Supports ExpertWitnessFormat disk images as a new input type for evidence processing.
   • The default Filter/Optimize Partitions process is now applied automatically to reduce workload.
   • A new Yara scanner replaces text matching analysis Tasks with new rules and analysis capabilities.

   +1 more show less

   • Added support for Yescrypt password hashing format in domain controller credential extraction jobs.

   6 details in Everything

10. 20220701 Jul 1, 2022 · release notes

    Turbinia 20220701 adds PGSQL account analyser, Loki-based Yara integration, and dfDewey deployment scripts.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 20220701 https://github.com/google/turbinia.git
    # already have the repo? check out this version:
    $ git checkout 20220701

    • Adds New PGSQL account analyser for querying PostgreSQL accounts.
    • Enables custom Yara rules via integration with the Loki analyzer (increasing max file size to enable Kinsing detection).
    • Adds deployment scripts for dfDewey datastores.

    3 details in Everything

11. 20220216 Feb 16, 2022 · release notes

    Adds -g group status query to turbiniactl and implicit recipe loading in PyPI package

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 20220216 https://github.com/google/turbinia.git
    # already have the repo? check out this version:
    $ git checkout 20220216

    └──▷ USE IT
    Check the aggregate status of all evidence items in a specific large-scale investigation group.
    shell copy

    turbiniactl status -g <group id>

    • turbiniactl status gains -g <group id> flag to bulk query request status for multiple evidence processing jobs
    • Recipe files are now loaded implicitly from the PyPI package, removing the need to set RECIPE_FILE_DIR or provide a full path

    2 details in Everything

12. 20220113 Jan 14, 2022 · release notes

    Turbinia 20220113 adds bulk evidence processing, new TimelineJob, quick triage recipes, and GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure. infrastructure management.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 20220113 https://github.com/google/turbinia.git
    # already have the repo? check out this version:
    $ git checkout 20220113

    • Adds support for making bulk requests to process multiple Evidence objects of the same type with a single turbiniactl command
    • Introduces FileSystemTimelineJob for creating timelines using dfimagetools
    • Provides new quick triage recipes for MacOS/Linux and updated Windows recipe
    • Adds a new script for managing GKE Turbinia infrastructure

    4 details in Everything

13. 20211018 Oct 18, 2021 · release notes

    Turbinia adds GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure. deployment support and new tasks for Windows/Linux password cracking.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 20211018 https://github.com/google/turbinia.git
    # already have the repo? check out this version:
    $ git checkout 20211018

    └──▷ HOW TO FIND IT
    Deploy Turbinia workers on a Google Kubernetes Engine cluster.
    📍kubectl apply -f <path-to-turbinia-gke-manifests>
    • Adds GKE deployment support for Turbinia workers
    • Adds Crontab analyzer, Loki scanner, dfDewey, and password crackers as new Tasks
    • Supports encrypted disks for Analyzer Tasks using the image_export API

    3 details in Everything