[AffluentMods]

Summary

A full review of the codebase and the UI, with the confirmed defects fixed and every remaining tool view rebuilt on one layout. Each fix has a regression test where the logic can be tested: the .NET suite goes from 269 to 1,488 tests and the Python sidecar suite from 2 to 164. Details are in the CHANGELOG entry; the main points:

Evidence integrity

• E01: images with more than 64 MiB in one sectors section failed to open (including Cinder's own output); EnCase-style size-0 next / done sections were rejected; all-zero digests counted as recorded hashes.
• Imager: a failing source produced endless zeros. It now stops and keeps an explicitly incomplete .partial; cancel deletes partial output; sector padding is hashed so E01 / VHD / VHDX verify; damaged source chunks are reported.
• AFF4: stored chunks were decompressed, and unlocatable map targets read as zeros.
• $LogFile restart-area fields were read from the wrong offsets; the USN parser could hang or stop early; FAT times were shifted by the examiner's time zone.
• Custody: entries went to whichever case was active when work finished; a signature from an unknown key reported as verified; cinder custody verify verified nothing.

Wrong or silently incomplete results

• YARA / IOC: long case-insensitive strings never searched, shared literals lost, conditions not evaluated.
• Hex search folded case on hex patterns; invalid patterns reported "no matches".
• Search: unparseable query reported "0 hits"; second index build failed.
• ShimCache, Amcache, Linux logs, LNK times, UserAssist and several truncation flags.
• Hard limits (Strings, YARA, Carver, Gallery, Search) are now stated when hit.

Stability and security

• Opening an in-use file, or a slow regex in the Find dialog, exited the app.
• Report HTML carried evidence text unescaped; the plugin trust files lived in the plugin folder; the Windows mount command interpolated the image path into PowerShell.
• Settings and recents writes are atomic and never overwrite an unreadable file.

Interface

• 19 tool views rebuilt (shared toolbar / empty state / footer, export everywhere, Stop buttons).
• Cases now activates the case; Workflows can run; Hash sets can create a database; Custody checks the open case; Search is one flow.
• Settings shows only settings that do something, and Theme is applied.
• Hex shortcuts act only while the Hex Viewer is on screen; inspector toggle is Ctrl+Shift+B.

Second round

• Hex Viewer: find pages through large result sets (F3 / Shift+F3 keep going past the first 1,000), the data inspector decodes from the start of the selection, and the toolbar holds together at 1366 px.
• Filesystem browser: the record number column is filled in for NTFS (MFT record and sequence) and ext (inode).
• Search index: rebuilding updates documents in place, and an unparseable query is reported as one.
• The rail remembers which sections are open and scrolls to the selected tool.
• README screenshots are captures of the real window on synthetic data; docs/screenshots.md and tools/screenshots/Capture-Window.ps1 reproduce them.
• End-to-end tests drive the Imager, Convert, Carver and Chain of custody tools the way their screens do.

Things that change for existing data

• Some parser columns were renamed, which changes CSV headers and keys in new bookmarks.
• Plugins trusted through the old in-folder files must be trusted again in the Plugins tool.
• Custody signatures from another workstation show "unknown key" until that key is trusted.
• Encrypted case bundles are written as format version 2 (version 1 still opens).
• Multi-volume AFF4 containers now refuse to open rather than reading as zeros.

Not verified here

Listed in LIMITATIONS.md under "Known gaps left by the full review pass": the $LogFile fix against a real log, the Hex Viewer control beyond its extracted arithmetic, real-device imaging, Volatility process handling, and most of the Python sidecar's C# wrappers.

Test plan

• dotnet test -c Release (1,488 tests) and python -m pytest in parsers/ (164)
• Open, create and switch cases from Home, the title bar and the Cases tool; bookmarks follow the active case
• Image a file to E01, Verify it, Convert it to raw; cancel one mid-run and confirm nothing is left at the output path
• Hex Viewer: find in each mode, selection backwards with Shift+Left, click in the text column, open a file that another program holds open
• YARA with a rule that has a condition and one with an unsupported feature
• Each rebuilt tool view in dark and light