# changelog

author: Lawrence R. Rogers <lrr@cert.org> 1.3.006-1
changelog:
  * Release 1.3.006-1
  	This update is expected to be fully forward-compatible with bulk_extractor v1.3 expected in July.
  		The "Case" file commands are replaced with "Work Settings" in order to accurately reflect what is going on.
  		Errors involving invalid filenames are managed better.


author: Lawrence Rogers <lrr@cert.org> 1.0-85
changelog:
  * Release 1.0-85
  	Added
  		* qtmltfs
  		* vmfs6-tools
  		* rekall-forensics (not CentOS/RHEL 6)
  		* xva-img


author: Lawrence Rogers <lrr@cert.org> 1.0-86
changelog:
  * Release 1.0-86
  	The kernel-PAE-modules-extra package is not available for Fedora 28 and beyond so that dependency was removed.


author: Lawrence Rogers <lrr@cert.org> 1.0-92
changelog:
  * Release 1.0-92
  	Added Volatility 3 and the symbol files for Fedora 31 and beyond and CentOS/RHEL 7 and beyond


author: Simson Garfinkel <simsong@t> 3.6.9-1
changelog:
  - configure.ac: incremented to version 3.6.9
  - lib/aftest.cpp (bugs_test): added tests
  - lib/vnode_split_raw.cpp (split_raw_identify_file): now
    returns 1 for filename.000 or filename.001 or filename.AAA or filename.aaa.
  - (split_raw_close): Now only closes files that are open.
  - (increment_fname) changed to vnode_split_raw_increment_fname so it
    can be externally tested.


author: Simson Garfinkel <simsong@t> 3.6.10-1
changelog:
  - configure.ac: increased version to 3.6.10
  - lib/vnode_split_raw.cpp (split_raw_increment_fname): revised
    splitraw so that it goes 000 to 999 then A00 through ZZ9 (that is,
    the first and second character are base 36, the third remains base 10)


author: Simson Garfinkel <simsong@alphonse-mucha.home> 3.6.11-1
changelog:
  * Release 3.6.11-1
  	* configure.ac: increased version number to 3.6.11, overcomes recent problems.
  	* configure.ac: added back libcrypto (needed on MacOS)
  	* tools/affinfo.cpp (color): explicity tests for tigetstr(), putp() and tparm()
  	* configure.ac: removed dependency on libcrypto (as we have libssl-dev dependency)
  	* lib/Makefile.am (EXTRA_PROGRAMS): java re-added to distribution;
  	  bulk_extractor.jar is now listed as an EXTRA program so it doesn't
  	  always get built.


author: Simson Garfinkel <simsong@alphonse-mucha.home> 3.6.15-1
changelog:
  * Release 3.6.15-1
          * configure.ac: incorporated Greg Freemyer's patch to address some ncurses problems.
          * configure.ac: added AC_PROG_CXX
          * tools/affxml.cpp (main): removed unused bflag variable
          * lib/vnode_afd.cpp: max() is now always defined, even on windows.
          * lib/aftimer.h (aftimer::eta_time): added std:: before string
          * lib/utils.h: added virtual destructor for seginfo
          * lib/utils.h: created virtual destructore
          * lib/afflib_pages.cpp (af_get_pagesize): having af_page_size() as
            a macro was causing problems, so now there is both af_page_size
            and af_get_pagesize, both of which do the same. Please use af_get_pagesize.


author: Simson Garfinkel <simsong@alphonse-mucha.home> 3.7.0-1
changelog:
  * Release 3.7.0-1
  	* configure.ac: increased version number to 3.7.0
  	* ALL FILES: Audited for copyright.
  	* COPYING: Clarified that Basis copyright only applies to 
  	* Changed license from BSD with advertising to BSD without advertising.


author: Simson Garfinkel <simsong@alphonse-mucha.home> 3.7.1-1
changelog:
  * Release 3.7.1-1
  	* configure.ac: increased version number to 3.7.1
  	* tools/affxml.cpp (struct page_stat_block): uint32_t long changed to uint64_t


author: Lawrence R. Rogers <lrr@cert.org> 5.11-1
changelog:
  * Release 5.11-1
  	Added support for JSON output using the json-c library.
  	Added support for the NO_FILTER configuration keyword to pass all records to a statistic or evaluation.
  	Pipeline now prints the age range of the processed records in the file ingest log line.
  	"make check" now runs a more comprehensive test suite.
  	Various speed improvements and bugfixes.


author: Lawrence R. Rogers <lrr@cert.org> 5.11.1-1
changelog:
  * Release 5.11.1-1
  	Fixed a memory leak in certain alerting scenarios when compiled with json-c but not using --json.


author: Lawrence R. Rogers <lrr@cert.org> 5.11.2-1
changelog:
  * Release 5.11.2-1
  	Fixed a bug in the Makefile logic that would cause a build failure on newer compilers.


author: Lawrence R. Rogers <lrr@cert.org> 5.11.3-1
changelog:
  * Release 5.11.3-1
  	Fixed a bug with how HAS_CHANGED was parsed in the config file.
  	Fixed a bug where marking a DISTINCT eval inactive would cause errors.
  	Fixed a bug where CALC_STATS evals would not properly recover after overflowing.


author: Lawrence R. Rogers <lrr@cert.org> - 2.0.12-1
changelog:
  - Release 2.0.12
  	v2.0.12,03/15/2014 -- (Contributed by Brice) Added -e, --excel switch to print date/times in format that will
  			    cause Excel to import them properly.


author: Lawrence R. Rogers <lrr@cert.org> - 2.0.15-1
changelog:
  - Release 2.0.15
  	v2.0.15,02/08/2015 - fix 2's complement computation (Willi)
  		   - Added anomaly detection back in. Missing since V2.0.0 in the summer of 2013


author: Lawrence R. Rogers <lrr@cert.org> - 2.0.16-1
changelog:
  - Release 2.0.16
  	v2.0.16,05/21/2015 - Documentation fix and attribute fixes based on NTFS version with thanks to Joachim Metz


author: Lawrence R. Rogers <lrr@cert.org> - 2.0.19-1
changelog:
  - Release 2.0.19
  	v2.0.19,05/27/2016 - (Contributed by lespea)
  			   - Properly deal with fncnt findings > 3
  			   - Allow the user to use either windows or unix path seperators
  			   - General code cleanup


author: Lawrence R. Rogers <lrr@cert.org> 4.10.0-1
changelog:
  * Release 4.10.0-1
  	New Features:
  	- Users can now view information on all cases/data sources in the Central Repository.
  	- SSID, MAC address, IMEI, IMSI, and ICCID properties can now be added to the 
  	  Central Repository by the Correlation Engine ingest module. 
  	- The Correlation Engine ingest module can be configured to flag any occurrences 
  	  of SSID, MAC address, IMEI, IMSI, and ICCID properties that have been previously 
  	  added to the Central Repository.
  	- File type filtering for common properties search is now supported.
  	- Common properties search results can now be viewed by case and data source 
  	  within the case.
  	- Users can now search the Central Repository for property instances with a given value.
  	- OCR text extraction for keyword search now supports languages other than English, if language packs are installed.
  	- Added the ability for examiners to select the time zone for displaying dates.
  	- Custom headers and footers can now be added to HTML reports.
  	- Added ability to either enter or generate hashes of image data sources.
  	- Data sources that fail hash verification are now flagged with interesting 
  	  item artifacts by the Data Source Integrity ingest module (formerly known as the E01 Verifier ingest module).
  	- Added a report module to export data in CASE/UCO format.
  	- Ingest filters and interesting file sets can now be defined with multiple 
  	  extensions included in a single condition/rule.

  	Bug Fixes:
  	- The Images/Videos Gallery now works for multi-user cases.
  	- Duplicate interesting item and EXIF metadata artifacts are no longer created when you run the modules that generate them more than once.
  	- The Application content viewer now displays SQLite table column names even when the table is empty.
  	- Assorted small bug fixes are included.


author: Lawrence R. Rogers <lrr@cert.org> 4.12.0-1
changelog:
  * Release 4.12.0-1
  	Aded .desktop files in addition to the following:
  	Collection
  		Added ability to configure a USB drive to use new logical imager tool.
  		Added logical imager tool that runs on a live Windows computer and saves results to a USB drive.
  		Added ability to import logical imager results into Autopsy as a data source.
  	Ingest Modules:
  		Changed file type detection so that Tika does not rely only on extension.
  		Email ingest module assigns thread IDs to messages
  		Android ingest modules store thread ID from their databases.
  	Content Viewers (lower right of UI):
  		New “Text” viewer that consolidates previous Strings and “Indexed Text” viewers.
  		New “Translation” panel was added to the new “Text” viewer.
  		Added integration with Google and Bing translation (credentials required)
  		Redesigned “Other Occurrences” viewer to have 4th column with details of selected item.
  		Added Willi Ballentin’s “Registry Hive Viewer” panel to the “Application” viewer.
  		Improved HTML viewer to use style sheets and better layout.
  		Added ability to draw a box on a picture while tagging it.
  	Result Table (upper right of UI)
  		Added paging to all views for faster loading of large data sets.
  		Improved speed of displaying results when a column was sorted.
  	Reporting
  		Portable cases can contain files marked as Interesting Items
  		Portable cases can be compressed and chunked
  		“Files - Text” report can use either tabs or commas as the delimiter
  		“Files - Text” report better handles Unicode text.
  		Added ability to create a CSV report for the contents of a table
  		HTML report for tagged pictures includes a copy with the overlay box
  	Communications:
  		Added Account Summary view
  		Added Contacts panel to show all contacts associated with an account.
  		Added Media panel to show media attachments associated with an account
  		Added filter to show accounts if they involved with the most recent messages.
  		Messages can be grouped by thread.
  	Auto Ingest
  		New Test button was added to help diagnose permission and configuration issues.
  	Documentation:
  		Created new Triage Standard Operating Procedure (SOP) section to the User Docs


author: Lawrence R. Rogers <lrr@cert.org> 0.1.4-2
changelog:
  This version removes some /usr/bin/binplist.py[co] and /usr/bin/plist.py[co] that appear when run as root.


author: Lawrence R. Rogers <lrr@cert.org> 1.7
changelog:
  * Release 1.7
  	Release 1.7 (04-05-2015)
  	 * General refactoring of functions and classes to make them more abstract and generic.
  	 * Added new experimental web server (Mune) based on webpy with command-line
  	   flag --web.  It's very incomplete but the idea is to keep making it a
  	   first-class citizen in subsequent releases.
  	 * Fixed a lot of usability bugs, weird bugs, corner cases, unhandled
  	   exceptions and the like.
  	 * Revamped all the search dialogs, moved them to a new tab and fixed some
  	   bugs in the meantime.
  	 * Added compatibility with radare2 up to 0.9.8.
  	 * Added support for base address in radare.
  	 * Updated xdot to latest version.
  	 * Fixed Add comment functionality.
  	 * Added click-to-go and highlighting the search string.


author: Lawrence R. Rogers <lrr@cert.org> 1.8
changelog:
  * Release 1.7
  	Release 1.8 (10-06-2015
  	 * Removed pyew entirely.  Its support has been in a non-official deprecated
  	   state for the past two years but we were trying not to do it.  Pyew has
  	   some dependencies that makes harder to package it, it's missing a lot of
  	   features from r2, plus it sees very few releases.
  	 * Removed other almost useless features in their current form: Strings repr
  	   and Interactive mode.  We expect to bring those at some point in a proper
  	   way.
  	 * Added r2 console.  It crashes here and there but we think it's rather
  	   usable.
  	 * Added interactive Python console.
  	 * Rearranged and simplified some tabs: Strings, Relocs and File info.
  	 * Some additional cleanups and fixes.


author: Lawrence Rogers <lrr@cert.org> - 1.2.2-1
changelog:
  * Release 1.2.2-1
  	* src/threadpool.cpp (threadpool::win32_init): created for administrative simplification.
  	* src/threadpool.h (class cppmutex): moved cppmutex to this file.
  	* src/feature_recorder.h: replaced #include "cppmutex.h" with #include "threadpool.h"
  	* src/xml.cpp (xml::close): removed dtd making
  	* src/cppmutex.h: added cppmutex.h
  	* src/feature_recorder.h (class feature_recorder): replaced pthread_mutex_t with cppmutex, a C++ cover class for mutexes.
  	* src/bulk_extractor.cpp (phase1): added #ifdef HAVE_LOCALTIME_R to cover systems that do not have localtime_r.
  	* src/aftimer.h (aftimer::eta_time): changed from 'when' to 't' for consistency.
  	* src/scan_aes.cpp (scan_aes): added check -- if sp.buf.bufsize<WINDOW_SIZE, don't scan.
  	* src/regex_list.h (class regex_list): removed globbing
  	* src/scan_zip.cpp (scan_zip): now detects decmopression bomb attack and changes mode of operation so that buffers are hashed prior to being decompressed and the same buffer will only be hashed just one.
  	* src/feature_recorder_set.cpp (scan_zip): alert_recorder is now in feature_recorder_set.
  	* src/feature_recorder.cpp (feature_recorder::banner_stamp): banner_stamp moved to feature_recorder
  	* src/bulk_extractor.h: opt_banner_file moved to feature_recorder
  	* src/bulk_extractor.cpp (main): outdir now an instance variable
  	* src/feature_recorder_set.h (class feature_recorder_set): outdir now an instance variable
  	* src/feature_recorder_set.cpp (feature_recorder_set::feature_recorder_set): outdir now an instance variable
  	* src/feature_recorder.h (class feature_recorder): outdir now an instance variables
  	* src/feature_recorder.cpp (feature_recorder::feature_recorder): outdir now an instance variable
  	* src/scan_net.cpp (class packet_carver): outdir now read from feature recorder.
  	* src/scan_wordlist.cpp (wordlist_split_and_dedup): outdir now read from feature recorder.
  	* src/MANY - outdir is no longer global.
  	* src/bulk_extractor.cpp (main): added -G to specify page size

  2012-01-29  Simson Garfinkel  <simsong@imac3.home>
  	* src/xml.h (class xml): added svn_version to DFXML output.
  	* src/scan_net.cpp: now carries its own ipv6 implementation.


author: Lawrence Rogers <lrr@cert.org> - 1.5.1-1
changelog:
  * Release 1.5.1-1
  	* configure.ac: incremented version number
  	* src/image_process.cpp: multi-split files was not working properly on Windows. Fixed
  	* src/scan_rar.cpp (scan_rar): fixed typo. raw_find_volume becomes rar_find_volume
  	* src/scan_base16.flex (public): fixed decoder so that what is decoded is a child sbuf with a specific offset and length
  	* src/be13_api/feature_recorder.cpp (hexval): fixed hexval(); it was not working properly for letters A through F. (I wrote this myself becuase it isn't present on mingw.)
  	* src/be13_api/feature_recorder.h (f): several of the flags were the same, resulting in behavior that was incorrect.
  	* src/be13_api/feature_recorder_set.cpp (feature_recorder_set::unset_flag): changed clear_flag to unset_flag for consistency.
  	* bugfix: featurefiles for carved elements no longer include the name of the -o directory.
  	* src/scan_vcard.cpp (scan_vcard): removed     string myString;
  	* src/image_process.h (class process_dir): changed blocks() to max_blocks().
  	* src/be13_api/feature_recorder.cpp (feature_recorder::dump_histogram): moved regex into histogram_def so that it could be run in write(), rather than in post-processing. 
  	* src/be13_api/feature_recorder.h (class feature_recorder): removed outdir and input_fname from feature_recorder, since they are in the feature_recorder_set
  	* src/be13_api/feature_recorder.h (class feature_recorder): carve no longer needs hasher passed in, becuase it is in the feature_recorder_set
  	* src/be13_api/bulk_extractor_i.h (be13): hash_def moved from be13 namespace to feature_recorder_set
  	* src/image_process.h (class process_dir): implemented const correctness for a whole bunch of methods
  	* src/be13_api/feature_recorder.h: removed using namespace std
  	* src/be13_api/feature_recorder_set.h (class feature_recorder_set): process_histograms changed to make_histograms, because that's what it is doing
  	* src/be13_api/feature_recorder.h (class feature_recorder): make_histogram renamed to dump_histogram (because that's what it's doing; callback function added)
  	* src/be13_api: USE_HISTOGRAMS is gone; everybody uses them now.
  	* src/main.cpp (main): alert_list and stop_list are no longer global variables; they are now local to main() and added to the feature_recorder_set
  	* src/be13_api/feature_recorder_set.cpp (feature_recorder_set::init): stop_list and alert_list are now part of the feature_recorder_set.
  	* src/be13_api/Makefile.defs: moved word_and_context_list.* from bulk_extractor to be13_api
  	* src/be13_api/feature_recorder.cpp (feature_recorder::feature_recorder): now has reference to feature_recorder_set
  	* src/stand.cpp (main): replaced manual histogram generator in stand with call to phase_histogram in be13::plugin
  	* src/be13_api/bulk_extractor_i.h (be13): added proper #ifdefs for each type
  	* src/be13_api/feature_recorder_set.h (class feature_recorder_set): more functions were made virtual and more instance values were made private
  	* src/be13_api/bulk_extractor_i.h: process_packet_info renamed to process_packet.
  	* src/be13_api/sbuf.h (class sbuf_t): removed pos0_t from map_file because it can be inferred.
  	* python/bulk_extractor_reader.py (BulkReport): changed .imagefile() to .image_filename
  	* python/identify_filenames.py: changed .imagefile to .image_filename
  	* configure.ac: updated for C++ and MacOS Mavericks. Changed version to 1.4.2
  	* src/main.cpp (main): removed BULK_EXTRACTOR_DEBUG.
  	* src/scan_net.cpp (p): removed packetset (no longer used)
  	* src/be13_api/sbuf.h (stoi64): stoi() removed because it is part of stdc11
  	* src/be13_api/feature_recorder.h (f): removed tags
  	* src/be13_api/plugin.cpp (plugin::phase_histogram): cleaned up printing of newlines during histogram output printing.
  	* src/be13_api/feature_recorder.cpp (feature_recorder::write): replace substr with in-place resize
  	* src/be13_api/feature_recorder.h (class feature_recorder): added MAINTHREAD() to set_flag(), becuase flags should only be set in the main thread.
  	  lso moved definition into feature_recorder.cpp, so that the in-memory histogram can be created if that flag is set.
  	* src/bulk_extractor.cpp (main): added reporting of MD5 of disk image
  	* src/be13_api/feature_recorder.cpp (carve): valid_dosname has to be applied to ext, since ext may come with slashes in it.
  	* src/scan_bulk.cpp (dfrws2012_bulk_process_dump): removed DFRWS code.
  	* configure.ac: incremented version to 1.4.1-dev. Enabled LT_INIT support; removed RANLIB support.
  	* src/scan_accts.flex (dob): DOBs, Fedex#s, and SSNs are now recorded to a feature recorder called 'pii.txt'.
  	* configure.ac: updated to beta6
  	* src/be13_api/feature_recorder.cpp (feature_recorder::write_tag): disabled recorders no longer carve or have tag support.
  	* src/be13_api/feature_recorder_set.cpp (feature_recorder_set::create_name): added warning if feature recorder already exists.
  	* src/bulk_extractor.cpp (main): removed explicit creation of alert recorder; no longer needed.
  	* src/be13_api/feature_recorder_set.h (class feature_recorder_set): alert_recorder should not be a global static; it is now per feature_recorder_set.
  	* src/be13_api/feature_recorder.cpp (feature_recorder::feature_recorder): removed carved_set that was keeping track of what was carved, as it is no longer necessary.
  	* src/scan_exif.cpp (scan_exif): jpeg carver feature recorder renamed to jpeg_carved.
  	* src/be13_api/plugin.cpp (info_scanners): now only prints -H info if it is provided by the scanner.
  	* src/scan_zip.cpp (scan_zip_component): now records general_purpose_bit_flags in XML. Bit 1 indicates that a component is encrypted
  	  (scan_zip_component): removed max_depth check; it's in plugin system
  	* src/scan_net.cpp (scan_net): the -S variable carve_tcp is now implemented by the scan_net scanner to enable or disable TCP/IP memory structure carving. It is disabled by default.
  	* src/scan_windirs.cpp (scan_windirs): windirs now only runs at top level
  	* src/scan_zip.cpp (scan_zip_component): now prints mtime in ISO8601 format
  	  (scan_zip_component): (previously mtime and ctime were wrong parts)
  	* src/scan_xor.cpp (scan_xor): will not XOR on either side of a ZIP. improved error handling
  	* tests/regress.py: updated numbers for 1.4 release
  	* configure.ac: updated to beta4
  	* configure.ac: updated to beta3
  	* src/scan_exif.cpp: fixed jpeg validation. carving now works.
  	* src/be13_api/plugin.cpp (GET_CONFIG): fixed bug in handling of uint8_t config values. They weren't getting set properly.. Ugh.
  	* src/scan_xor.cpp (scan_xor): fixed error when XOR mask was specified as 0. Previously it recused; now it does not.
  	* configure.ac: removed defines we aren't using anymore
  	* src/be13_api/feature_recorder.h (class feature_recorder): as a result of popular demand, the UTF8 BOM and BOM EXPLAINATION have been removed from the feature files
  	* src/be13_api/feature_recorder_set.cpp (feature_recorder_set::get_name): get_name() now returns NULL if feature recorder does not exist.
  	* src/be13_api/feature_recorder.h (class feature_recorder): added context_window_before() and context_window_after().
  	* src/bulk_extractor.cpp (main): replaced context_window with context_window_default.
  	* src/be13_api/bulk_extractor_i.h (class scanner_params): made more variables const.
  	  (class recursion_control_block): removed returnAfterFound(raf); now implemented with exceptions
  	* src/bulk_extractor.cpp (]): fixed handling of LIB_EXPAT
  	  (b): restart logic did not compile. Now it is fixed.
  	* configure.ac: fixed bug in which expat.h was not being checked for. use AC_CHECK_HEADERS() instead of AC_CHECK_HEADER(), as AC_CHECK_HEADER() requires
  	  that you add additional logic and AC_CHECK_HEADERS() automatically adds HAVE_HEADER_H.
  	* src/scan_zip.cpp (scan_zip): removed name_len (not needed)
  	* src/pyxpress.h: removed 'extern' designation
  	* src/image_process.h (i): removed extern size_t opt_pagesize and extern size_t opt_margin. These are now phase1 configuration variables that are passed into the image_iterator.
  	* src/scan_email.flex (Host): removed ip_written and ip_tested (always remove dead code)
  	* src/be13_api/feature_recorder.cpp (feature_recorder::carve): changed carving so that carved files are stored with the filename of their location. Also, fixed check-then-access race error in feature_record.cpp
  	  (feature_recorder::carve): fixed race conditon in carving.
  	* feature_recorder_set.cpp - debug is now a static variable
  	* src/image_process.h (image_process): debug is now a local variable for image_process.h
  	* src/be13_api/bulk_extractor_i.h (DEBUG_EXIT_EARLY): removed DEBUG_MALLOC and DEBUG_MALLOC_FAIL_FREQUENCY; now is handled with -S system
  	* src/bulk_extractor.h: removed all global options; replaced with the be config system
  	* src/pyxpress.c: added OpenSSL exemption per email from Matthieu Suiche
  	* src/be13_api/sbuf.h: md5 support removed from sbuf
  	* src/be13_api/plugin.cpp (plugin::get_scanner_feature_file_names): extensive changes to make the global functions part of the be13::plugin class.
  	* src/bulk_extractor.cpp (main): -S now sets options; -s now sets sampling fraction.
  	* src/bulk_extractor.cpp (usage): The -B option for specifying the blocksize for bulk data analysis has been removed. Instead specify it with -S block_size=NN.
  	* src/be13_api/xml.cpp (xml::xml): Routine for opening an existing DFXML file is removed. Anyone who processes XML with regular expressions is in a state of sin.
  	* src/be13_api/plugin.cpp: max_depth changed to 7
  	* src/scan_winpe.cpp (scan_winpe_verify): added verification of section names and DLL names to reject false positives. 
  	* src/scan_net.cpp (p): carved ethernet packets are now properly recorded in ether.txt and tcp.txt
  	* packet carving for disembodied ethernet packets fixed!  In 3ad21780, simsong was creating the hz structure but not setting it, so all carved packets had zero length
  	* src/be13_api/feature_recorder.cpp (banner_stamp): added \n to # BANNER FILE NOT PROVIDED
  	* src/scan_elf.cpp (scan_elf_verify): fixed bug in scan_elf where XML was incorrect and being generated for invalid ELF headers.
  	* src/bulk_extractor.cpp (main): -Z is no longer fatal if directory does not exist.
  	* configure.ac: fixed AX_PTHREAD test to fail if pthreads are not found.
  	* src/be13_api/feature_recorder_set.cpp (get_name): renamed Mstats to Mlock. Added Mlock to get_name() (apparently this isn't thread safe?)
  	* src/threadpool.h (class worker): removed pesky noreturn problem with threadpool.
  	* python/identify_filenames.py (process_featurefile): added #'s to report printed at bottom
  	  (process_featurefile): added format
  	* python/bulk_extractor_reader.py (is_feature_line): Now handles annotated feature files.
  	  (BulkReport.__init__.validate): added programmer notice for error of providing a feature file instead of a report directory


author: Petr Machata <pmachata@redhat.com> - 1.9.20111219-1
changelog:
  - Rebase to 20111219
    - add "-s" option
    - Resolves: #769237
  - Revert default stack size to 10000
    - Related: #743343


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 3.0.4-11
changelog:
  - Python 2 binary package renamed to python2-capstone
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Lawrence R. Rogers <lrr@cert.org> 1.0-8
changelog:
  * Release 1.0-8
  - New CERT Forensics Team key - expires on 2014-01-06. This RPM contains the 2012 key and is signed by the 2012 key.


author: Lawrence R. Rogers <lrr@cert.org> 1.0-9
changelog:
  * Release 1.0-9
  - New CERT Forensics Operations and Investigations Team key - expires on 2016-02-22.


author: Lawrence R. Rogers <lrr@cert.org> 1.0-11
changelog:
  * Release 1.0-11
  - New CERT Forensics Operations and Investigations Team key - expires on 2018-04-07.


author: Lawrence R. Rogers <lrr@cert.org> 1.0-14
changelog:
  * Release 1.0-14
  	Re-added the "( ( fedora-release == 6 ) or ( generic-release == 6 ) )" requires for Fedora.


author: Lawrence R. Rogers <lrr@cert.org> 2.5.2-4
changelog:
  * Release 2.5.2-4
          Version 2.5.2-4 Uses python3_pkgversion for the current version of Python 3.


author: Lawrence R. Rogers <lrr@cert.org> - 2.0.7-10.1
changelog:
  - Releae 2.0.7-10.1
  	Rebuilt for DAQ 2.0.8 and to add the static libraries
  	The revision number is a guess to be a number higher than what Fedora or
  		CentOS provide so as to install the static libraries needed for snort.


author: Adam Miller <maxamillion [AT] gmail.com> - 6.12.2-2
changelog:
  - Removed .gmo binaries, fixed source0, added doc items, fixed EOF encoding
  - fixed licencing listing


author: Adam Miller <maxamillion [AT] gmail.com> - 6.12.3-3
changelog:
  - Fixed Source0 listing as reported https://www.redhat.com/archives/fedora-devel-list/2009-August/msg00591.html


author: Richard Cordovano <rcordovano@users.sourceforge.net> 7.1.164-1
changelog:
  * Release 7.1.164-1

  	Log output may be sent to multiple job logs and hash logs. Simply specify
  	log=LOG and/or hlog=LOG more than once.

  	Verification of an image restored to a device larger than the image is now
  	supported. Specify phod=DEVICE to hash only the bytes dc3dd writes to the
  	device. Specify fhod=DEVICE to hash both the bytes dc3dd writes to the
  	device and all the bytes that follow, up to the end of the device.


author: Richard Cordovano <rcordovano@users.sourceforge.net> 7.2.641-1
changelog:
  * Release 7.2.641-1

  	* Log output may be sent to multiple job logs and hash logs. Simply specify
   	  log=LOG and/or hlog=LOG more than once.

   	* Verification of an image restored to a device larger than the image is now
   	  supported. Specify hof=DEVICE to hash only the bytes dc3dd writes to the
   	  device. Specify fhod=DEVICE to hash both the bytes dc3dd writes to the
   	  device and all the bytes that follow, up to the end of the device.   

   	* Specifying hof=DEVICE will now default to phod=DEVICE behavior (hash only 
   	  the bytes output by dc3dd, not the full device).


author: Lawrence R. Rogers <lrr@cert.org> - 1.42-1
changelog:
  * Release 1.42-1
  	1.42 brings the possibility to load plugins to analyze or transform data
  	before it's written to the output file(s). A plugin to calculate the MD5
  	hash is provided. posix_fadvise() is used if available (optimization) and
  	dd_rescue now only provides a short usage info rather than the long help
  	text on wrong parameters.


author: Lawrence R. Rogers <lrr@cert.org> - 1.42.1-1
changelog:
  * Release 1.42.1-1
  	1.42.1 contains a fix for a sublety how we set up a handler for
  	SIGILL and return with longjmp to detect the supported instruction
  	sets of the CPU -- we need to manually reset the process' signal mask,
  	otherwise a second failed probe would abort.


author: Lawrence R. Rogers <lrr@cert.org> - 1.43-1
changelog:
  * Release 1.43-1
  	The main feature of 1.43 is the new lzo plugin. It de/compresses data
  	using the lzo algorithms, which are very fast to decompress and most
  	versions are also fast to compress (at somewhat moderate compression
  	levels). The plugin supports many of dd_rescue's features, such
  	as skipping bad blocks (encoding sparseness/holes into the output)
  	as well as appending. It also continues on errors (skipping a whole
  	block if nodiscard is NOT given) and allows to search for valid lzo
  	block headers if sync is lost. fuzz testing has been done to support
  	reliability. A man page ddr_lzo(1) has been created.

  	The plugin interface has been enhanced to support ddr_lzo; the MD5 plugin
  	has also seen some work beyond just refactoring: It supports the parameter
  	output/outfd= now and supports all type of holes that can be generated in
  	a chain with ddr_lzo now.

  	Some minor improvements (docu, messages) and bug fixes have been
  	applied. There also is a new ARMv8 (AArch64 aka ARM64) optimized
  	routine to detect zero-blocks.


author: Lawrence R. Rogers <lrr@cert.org> - 1.44-1
changelog:
  * Release 1.44-1
  	The plugin libddr_MD5.so (short ddr_MD5) has been renamed to ddr_hash, reflecting that we also support sha1, sha256,
  		sha224, sha512, sha384 now. Checks have been added to the test suite and the documentation been updated accordingly.


author: Lawrence R. Rogers <lrr@cert.org> - 1.45-1
changelog:
  * Release 1.45-1
  	ddr_hash received a bugfix (sha512/sha384 could overflow a buffer).
  	It gained support for sha1 hash.
  	ddr_hash can now conveniently retrieve (and check) and store hashes in xattrs and md5sum/sha256sum/... style files.
  	A new null plugin (ddr_null) was added.


author: Lawrence R. Rogers <lrr@cert.org> - 1.46-1
changelog:
  * Release 1.46-1
  	ddr_hash now supports calculating HMACS instead of plain hashes. The hash calculation
  	has been cleaned up a bit. When a seed val of 0 is passed on the command line, additional
  	randomness is created using the rdrand() command on x86/x86-64 (if available).

  	(2014-06-27) A vulnerability in most implementations of lzo decompression has been
  	reported. The liblzo2 library (up to and including v 2.06) used by the ddr_lzo plugin
  	(until dd_rescue-1.45) is affected. You need i to feed specially crafted compressed
  	data in blocks of 16MB or larger to the decompressor on 32bit platforms to exploit it,
  	see the report for more details. (This issue has ID LMS-20140616-1/ CVE-2014-4607.)
  	The man page ddr_lzo advises to be careful when feeding data from untrusted sources
  	to the decompressor; it seems that this advice has been wise. Fortunately, ddr_lzo
  	does not normally feed such large blocks to the decompressor; you'd need to manually
  	increase the soft block size to at least 8MB and ignore a warning to trigger this issue
  	with dd_rescue. But it is possible.  So here's my advice:

  	Update liblzo2 to 2.07 (or a fixed 2.06 version) which has this issue fixed (your Linux
  	distributor should provide this very soon). This is enough to fix the issue, as the
  	ddr_lzo plugin of dd_rescue does dynamically link against liblzo2, except for Android.
  	If using my provided Android binaries, redownload and reinstall the libddr_lzo.so binary
  	(now with version number 1.45a), which has been compiled against liblzo2.a v 2.07 or
  	better use the binaries from 1.46.  Be careful with media consumption -- ffmpeg/mplayer
  	seems to be badly affected by this issue, even on 64bit platforms.


author: Lawrence R. Rogers <lrr@cert.org> - 1.98-1
changelog:
  * Release 1.98-1
  	It has a few improvements such as a few cleanups, a fault injection framework for
  	testing and significantly improved speed of the pseudo RNG. But the important feature
  	is the addtion of a crypt plugin. You can insert it into the plugin chain to de/encrypt
  	data using the AES family of algorithms. (More are planned for the future.) You can use
  	128/192/256 bit keys and optionally use a higher number of rounds to have an increased
  	security margin. Keys (and IVs) can be generated, saved, retrieved or generated from
  	password and salt. Please be aware that despite diligent testing this is a new plugin --
  	so be prepared that there will be some changes and bugfixes to it in the near future.


author: Lawrence R. Rogers <lrr@cert.org> - 1.99-1
changelog:
  * Release 1.99-1
  	Version 1.99 brings updates to the ddr_crypt plugin: It adds hardware
  	acceleration for ARMv8 CPUs/SOCs (even if in 32bit mode) -- this is a 10x
  	speedup on AES en/decryption operations. (An Cortex-A57 at 2.1GHz (Exy7420)
  	does ~1GB/s with AES128-CTR.) The ddr_crypt plugin xattr support has been
  	extended and it has an option to process openSSL compatible Salted__ files. A
  	bug in CTR initialization has been fixed. The main program sees improved write
  	error retry logic and better fault injection logic (support for ranges, using
  	absolute positions). There are now more variants of Android binaries.


author: Lawrence R. Rogers <lrr@cert.org> - 1.99.5-1
changelog:
  * Release 1.99.5-1
  	Version 1.99.5 (2016-12-29)
  	  Version 1.99.5 has two compiler fixes and a better estimation (and thus better progress reporting) of the transfer length.
  	  It also has a new ratecontrol feature, allowing to throttle the speed with which data gets copied.

  	Version 1.99.4 (2016-08-25)
  	  Version 1.99.4 has a couple of fixes on top of 1.99: A memory corruption was resolved when using fmt_int() improperly,
  	   which was the case when a list of bad blocks was written out with -b. Thanks to Marc Thomas for reporting and debugging.
  	  A segfault with the graph with reverse direction copies was also fixed as well as improved flexibility to compile ddr_crypt
  	   plugin with incomplete support for new insns.


author: Lawrence R. Rogers <lrr@cert.org> - 1.99.8-1
changelog:
  * Release 1.99.8-1
  	Version 1.99.8 brings compatibility with OpenSSL-1.1.
  	Trouble was that the EVP interface has significantly changed.
  	Thanks got to Marcus Meissner for contributing the patch.
  	I used the opportunity to structure the AES plugins a bit better; also the test_aes program now uses CPU detection and can thus be used in the check target.


author: Lawrence Rogers <lrr@cert.org> 1.17-1
changelog:
  - Update to 1.17
  	* Version 1.17 released.
  	* Added new option '-l, --logfile-size'.
  	* Added new option '-w, --ignore-write-errors'.
  	* Option '--fill' has been renamed to '--fill-mode'.
  	* Option '--generate-logfile' has been renamed to '--generate-mode'.
  	* Added option '--sector-size' as a synonym of '--block-size'.
  	* Added option '--retries' as a synonym of '--max-retries'.
  	* Added option '--size' as a synonym of '--max-size'.
  	* rescuebook.cc: Trimming is now done from both edges of each
  	  non-trimmed block. Largest blocks are trimmed first.
  	* rescuebook.cc: Largest blocks are now split first until
  	  logfile reaches '--logfile-size' entries.
  	* logbook.cc (extend_sblock_vector, truncate_vector): Terminate
  	  if truncation would discard finished blocks.
  	* rescuebook.cc: Mark failed blocks with 1 sector as bad-sector.
  	* logbook.cc (extend_sblock_vector): Remove last block of
  	  logfile if it starts at isize and is not marked as finished.
  	* io.cc (show_status,update_rates): Detect a jump back in time
  	  and adjust status.
  	* ddrescue.h (slow_read): Return false for the first 10 seconds.
  	* io.cc (show_status) Leave cursor after message so that ^C does
  	  not overwrite it.
  	* main.cc: Do not require '--force' for generate mode.
  	* ddrescue.h (Logbook::logfile_exists): Do not return false if
  	  logfile exists but is empty.
  	* Added new chapter 'Using ddrescue safely' to the manual.
  	* Documented that 'direct disc access' only reads whole sectors.
  	* configure: Options now accept a separate argument.
  	* Makefile.in: Added new target 'install-bin'.


author: Lawrence Rogers <lrr@cert.org> 1.18.1-1
changelog:
  - Update to 1.18.1
  	* Version 1.18.1 released.
  	* ddrescuelog.cc (do_logic_ops): Fixed 'or' and 'xor'.
  	* Added new option '-H, --test-mode' to simulate read errors.
  	* Added new option '-L, --loose-domain' to ddrescue and ddrescuelog.
  	* Added new option '-N, --no-trim' to disable trimming of damaged areas.
  	* Added new option '-O, --reopen-on-error'.
  	* Added new options '-1, --log-rates', and '-2, --log-reads'.
  	* Extended '-K, --skip-size' with maximum and disable values.
  	* Changed long name of option '-r' to '--retry-passes'.
  	* Changed short name of option '--generate-mode' to '-G'.
  	* Default value of option '-l, --logfile-size' increased to 10000.
  	* If interrupted, ddrescue terminates by raising the signal received.
  	* rescuebook.cc (copy_non_tried): Do not mark skipped blocks as non-trimmed.
  	  Try them in additional passes (before trimming).
  	* rescuebook.cc: Limit the copying phase to 3 passes.
  	* rescuebook.cc: Alternate direction of passes during copying phase.
  	* rescuebook.cc: Smallest blocks are trimmed first.
  	* rescuebook.cc (split_errors): Read largest first if logfile full.
  	* Improved speed when using option '-m, --domain-logfile'.
  	* io.cc (show_status): Show the current total run time.
  	* rescuebook.cc: Show pass number and direction during copying.
  	* rescuebook.cc (show_status): Show block pos instead of current_pos.
  	* main.cc: Show "an unknown number of bytes" for unknown isize.
  	* Added option '-B, --binary-prefixes' to ddrescuelog.
  	* Added new option '-C, --complete-logfile' to ddrescuelog.
  	* Added new option '-P, --compare-as-domain' to ddrescuelog.
  	* Improved speed of logic operations in ddrescuelog.
  	* rescuebook.cc (Rescuebook::do_rescue): Show warning when domain is smaller than logfile.
  	* ddrescuelog.cc (do_show_status): Show logfile and domain extents when domain is smaller than logfile.
  	* block.h: Class Block now forces the invariant by itself.
  	* Code reorganization. New class 'Logfile'.
  	* Added status message to rescue logfile.
  	* Many improvements to documentation.
  	* ddrescue.texinfo: Renamed to ddrescue.texi.


author: Lawrence Rogers <lrr@cert.org> 1.18.1-2
changelog:
  - Update to 1.18.1-2
  	This patch currently adds the following options:

  	--no-reverse-pass          do not switch direction for each pass
  	--skip-on-first-err        start skipping on first error
  	--trim-sequentially        don't trim small blocks first
  	--split-sequentially       don't split large blocks first

  	--no-reverse: This makes the second pass also go in the same direction as the first. This
  	is for those who may ask for the option. But in my benchmark testing I can say there
  	is no real benefit to turning off reverse.

  	--skip-on-first-err: By default, ddrescue doesn't start skipping until 2 errors are
  	encountered in a row. Sometimes the errors are spread out so that skipping does not
  	happen very often if at all. This option will make ddrescue skip on the first error on the
  	first pass forwards, and also on the second pass in reverse. If used with --no-reverse,
  	the second forward pass skips on the second error like normal. Note that if used with
  	the --reverse option then ddrescue will behave as normal and this option will not do
  	anything. This option does best when setting a higher skip size, as when used with the
  	default skip size it does not have a positive effect.

  	--trim-sequentially: Normally ddrescue trims the smallest block first, which can cause
  	unwanted head movement. This option makes it trim in order in one pass in the direction
  	specified. My tests did not show any speed difference, but the small size of the test
  	also did not have excessive head movement to begin with.

  	--split-sequentially: Normally ddrescue splits the largest blocks first (which can
  	cause a lot of unwanted head movement), and then when there are only small blocks of
  	less than 7 sectors in size it will split sequentially. This option makes it split
  	in order in one pass in the direction specified. In my benchmarking tests this helped
  	slightly with overall recovery time, which is likely a result of drive read-ahead. This
  	was even with a small test size, so it is possible that there could be more to gain on
  	a full size recovery. Note that this speed increase would not normally be noticed due
  	to the amount of time errors take to process, and is a very small increase overall. The
  	biggest benefit is the head movement.


author: Lawrence Rogers <lrr@cert.org> 1.19-1
changelog:
  - Update to 1.19-1

  	* Fixed a race condition at start of run with '--timeout=0'.
  	* Added new option '-P, --data-preview'.
  	* Added new option '-u, --unidirectional'.
  	* Added new option '-X, --exit-on-error'.
  	* Added new option '--ask' to ask for user confirmation.
  	* Added new option '--cpass' to select passes during copying phase.
  	* Added new option '--pause' to insert a pause between passes.
  	* Removed option '-l, --logfile-size'.
  	* Skip on the first error during the copying phase.
  	* rescuebook.cc: Trimming done in one pass, may be run in reverse.
  	* The splitting phase has been replaced by a scraping phase.
  	* Changed long name of option '-n' to '--no-scrape'.
  	* rescuebook.cc: Alternate direction of passes during retrying phase.
  	* Show ATA model and serial number with '--ask' or '-vv' on Linux.
  	* configure: Added new option '--enable-linux'.
  	* New files linux.h linux.cc.
  	* License changed to GPL version 2 or later.


author: Lawrence Rogers <lrr@cert.org> 1.20-1
changelog:
  - Update to 1.20-1
  	* 'logfile' has been renamed to 'mapfile' everywhere.
  	* Changed short name of option '--synchronous' to '-y'.
  	* Changed long name of option '-d' to '--idirect'.
  	* Added new option '-D, --odirect'.
  	* Added new option '-J, --verify-on-error'.
  	* Added new option '--max-read-rate'.
  	* rescuebook.cc (copy_block): Copy arbitrary blocks with '--idirect'.
  	* Include only bad_sector blocks in 'errsize'.
  	* rescuebook.cc (show_status): Show the estimated remaining time.
  	* io.cc (format_time): Show time in days, hours, minutes and seconds.
  	* Added per sector location data to fill mode.
  	* mapbook.cc: Added emergency save of the mapfile.
  	* Show device name with '--ask' or '-vv' on Haiku.
  	* mapfile.cc (read_mapfile): Read read-only mapfiles from stdin.
  	* ddrescuelog.cc: Allow multiple mapfiles for '-t, --show-status'.
  	* ddrescuelog.cc (create_mapfile): '-' writes mapfile to stdout.
  	* ddrescue.texi: Added new chapter 'Optical media'.
  	* ddrescue.texi: Documented maximum size of the rescue domain.
  	* configure: Option '--enable-linux' renamed to '--enable-non-posix'.
  	* Makefile.in: Added new targets 'install*-compress'.
  	* File 'ddrescue.h' renamed to 'mapbook.h'.
  	* File 'logbook.cc' renamed to 'mapbook.cc'.
  	* File 'logfile.cc' renamed to 'mapfile.cc'.
  	* Files linux.{h,cc} renamed to non_posix.{h,cc}.


author: Lawrence Rogers <lrr@cert.org> 1.21-1
changelog:
  - Update to 1.21-1
  	* Version 1.21 released.
          * mapbook.cc (Mapbook): Fix iobuf alignment.
            (Reported by Heikki Tauriainen).
          * Removed short option names '-1' and '-2'.
          * Allow only regular files for '--log-rates' and '--log-reads'.
          * Option '-D, --odirect' now works also in fill mode.
          * rescuebook.cc (copy_block): Return 1 on unaligned read error.
            Set e_code on any error if verify_on_error.
          * Option '-X, --exit-on-error' has been extended to all phases.
          * Assigned short name '-Z' to option '--max-read-rate'.
          * mapbook.cc (update_mapfile): 'fsync' the mapfile every 5 minutes.
          * Rescuebook: Show full range of sizes from non-tried to finished.
          * rescuebook.cc (show_status): Show percent rescued.
          * configure: Avoid warning on some shells when testing for g++.
          * Makefile.in: Detect the existence of install-info.


author: Lawrence Rogers <lrr@cert.org> 1.22-1
changelog:
  - Update to 1.22-1

  	The option '-X, --exit-on-error' has been replaced by
  	'-X, --max-read-errors'. This introduces a backward incompatibility with
  	versions 1.19 to 1.21 in that option '-X' now requires an argument. The
  	long form '--exit-on-error' is still accepted, but will be removed in a
  	future version of ddrescue.

  	The new option '--max-slow-reads' has been added. It makes ddrescue exit
  	with status 1 if too many slow reads are encountered during the copying
  	phase.

  	The new option '--delay-slow' has been added. It sets the initial delay
  	before ddrescue starts checking for slow reads.

  	The new option '--reset-slow' has been added. It resets the slow reads
  	counter every time the read rate reaches or surpasses '--min-read-rate'.

  	The new option '--log-events' has been added. It logs all significant
  	events in a file, indicating the time, the percentage rescued, and a
  	message describing the event.

  	The new option '--mapfile-interval' has been added. It changes the
  	interval at which ddrescue saves and fsyncs the mapfile.

  	The new option '--pause-on-error' has been added. It makes (or
  	simulates) a pause after each read error.

  	The option '--pause' has been renamed to '--pause-on-pass'.

  	The option '--max-errors' has been renamed to '--max-bad-areas'.

  	Ddrescue now shows the number of read errors, the error rate and (if a
  	--min-read-rate is specified) the number of slow reads.

  	The 'current_pass' field has been added to the mapfile. This allows the
  	copying phase to resume instead of restart from pass 1. It also allows
  	the retrying phase to resume in the same direction it was interrupted.

  	Two new passes have been added to the copying phase.
  	Sometimes there is a significant difference in read speed and likelihood
  	of data recovery between blocks skipped due to slow areas, and blocks
  	skipped due to read failures. Two passes have been inserted after pass 2
  	that read the blocks skipped due to slow areas (if any) before the final
  	sweeping pass (which now is pass 5).

  	The '--cpass' option now accepts ranges of passes; '--cpass=1-4'.

  	The option '-K, --skip-size' now accepts sizes up to 1 EiB.

  	The initial skip size now defaults to (infile_size / 100_000) with a
  	minimum value of 64 KiB.

  	The minimum read rate of good non-tried areas is no longer reduced after
  	each pass, and now only affects passes 1 and 2.

  	During the trimming phase, if any edge of a non-trimmed block is already
  	adjacent to a bad sector, it is considered as already trimmed and is not
  	trimmed again.

  	The 's' multiplier may now be appended to any of the other multipliers.
  	For example, 'ks' = kilosectors (1000 * sector_size), or
  	'Kis' = kibisectors (1024 * sector_size).

  	Options '--ask' and '-vv' now always show file size, even if model and
  	serial number are also shown.

  	Device model and serial number are now shown with '--ask' or '-vv' on
  	Cygwin. (Patch written by Christian Franke).

  	The tried size (non-trimmed + non-scraped + bad-sector sizes) is now
  	shown in the initial status.

  	The new option '-A, --annotate-mapfile' has been added to ddrescuelog.
  	It adds comments to a mapfile containing the positions and sizes of the
  	blocks in human-readable form.


author: Lawrence Rogers <lrr@cert.org> 1.23-1
changelog:
  - Update to 1.23-1
  	2018-02-13  Antonio Diaz Diaz  <antonio@gnu.org>

  	* Version 1.23 released.
  	* rescuebook.cc (trim_errors): Fix wrong change to non-scraped.
  	* Added new option '--same-file'.
  	* Added new option '--shift' to ddrescuelog.
  	* fillbook.cc (fill_block): Write location data as one line.
  	* fillbook.cc (read_buffer): Do not require a seekable infile.
  	* ddrescue.texi: Added chapter 'Output'.
  	* check.sh: Added 'combined rescue' test.
  	* io.cc: Added missing '#include <cstdio>'.


author: Lawrence Rogers <lrr@cert.org> 1.24-1
changelog:
  - Update to 1.24-1
  	2019-02-24  Antonio Diaz Diaz  <antonio@gnu.org>

  	* Version 1.24 released.
          * Added new option '--command-mode'.
          * Implemented mapfile backup.
          * ddrescue.texi: Documented final contents of bad areas in outfile.
          * configure: Accept appending to CXXFLAGS, 'CXXFLAGS+=OPTIONS'.


author: Lawrence Rogers <lrr@cert.org> 1.25-1
changelog:
  - Update to 1.25-1
  	2020-02-21  Antonio Diaz Diaz  <antonio@gnu.org>

  	* block.h: Add default constructors to classes Block and Sblock.  (Reported by Rosen Penev).
  	* check.sh: Quote all file name variables to allow names with spaces.  (Reported by David Morrison).
  	* In rescue mode, join non-finished subsectors read from mapfile.  (Reported by David Burton).
  	* mapbook.cc (update_mapfile): Exclude writing time from intervals.  (Reported by David Burton).
  	* rescuebook.cc (extend_outfile_size): Use ftruncate if it works.
  	* Print large numbers in groups of 3 digits separated by underscores.
  	* main.cc: Set a valid invocation_name even if argc == 0.


author: Lawrence R. Rogers <lrr@cert.org> 2.5-1
changelog:
  Changes in version 2.5
  		Some of the code has been restructured to allow for sharing of functions.

  		Ddru_ntfsbitmap & ddru_ntfsfindbad - Both are now able to properly process non 512 byte sectors. They both can also now handle partial MFT errors,
  		 meaning if the second sector of the record is bad and the record size fits in the first sector it will now process it instead of totally rejecting it.

  		Ddru_ntfsbitmap - Fixed a bug where the MFT domain output file would end up with an error (same error that was fixed in domain output file previously).

  		Ddru_ntfsbitmap & ddru_findbad - Both are now able to process the older NTFS filesystem from Windows NT and 2000.

  	Changes in version 2.4 (released May 15 2014)
  		Ddru_ntfsbitmap - Added option --restart to delete all important files from the previous run before starting. This is used to help prevent any issues from old
  		 files causing bad results.

  		Ddru_ntfsbitmap - Fixed a bug where the domain output file would end up with an error when using the --inputoffset option and the partition start position was
  		 equal or less than what was considered the "first track" (63 sectors).

  		Ddru_ntfsfindbad - Fixed a bug where files were falsely reported as having errors if the start or finish was right next to an error sector.
  		 They would be listed but with a 0 byte error size.

  		Ddru_ntfsfindbad - Fixed a bug in the debug output where the offset and full offset were not correct.

  	Changes in version 2.3
  		Ddru_ntfsfindbad - Fixed a bug where some file or folder names were in DOS 8.3 instead of Win32 format in the output.

  		Ddru_ntfsfindbad now properly converts NTFS file names from UTF-16 to UTF-8, as opposed to just processing every other byte. This should allow for multi-language
  		 support in the output. Added the option "--encoding" to be able to choose the filename output encoding, if needed to be different from the default of UTF-8.

  		Ddru_ntfsfindbad - Added option --noconvert to turn off the new encoding option. This has been added in case of strange program crashes caused by the very buggy iconv.
  	 	 When used, this option uses the old method of every other character for the file names, which will work for ASCII.


author: Lawrence R. Rogers <lrr@cert.org> 2.6-1
changelog:
  * Changes have been made for compiling compatibility:
      + Some unneeded items removed from configure.ac
      + Added lib check for iconv
    * Some improvements have been made to the documentation:
      + Added examples to the --mftdomain option of ntfs_bitmap
      + Updated info about ddru_findbad being slow
    * Ddru_findbad 1.11 released:
      + No longer relies on bash
      + Fixed a bug dealing with bad ntfscluster results
      + Images are now accessed as read only
    * Ddru_ntfsfindbad 1.4 released:
      + Fixed potential memory bug with name conversions
      + Fixed iconv BOM issue
      + Fixed a bug with mft data run length
      + Fixed issue with current postition in logfile
    * Ddru_ntfsbitmap 1.4 released:
      + Fixed potential memory bug with name conversions
      + Fixed iconv BOM issue
    * Ddru_diskutility 1.3 released:
      + Initial release


author: Lawrence R. Rogers <lrr@cert.org> 2.7-1
changelog:
  * Release 2.7-1
    * Ddru_ntfsfindbad 1.5 released:
      + Fixed possible program crash if partition boot sector error
      + Better partition boot sector error output
    * Ddru_ntfsbitmap 1.5 released:
      + Fixed possible program crash if partition boot sector error
      + Better partition boot sector error output


author: Lawrence R. Rogers <lrr@cert.org> 2.8-1
changelog:
  * Release 2.8-1
  	No longer uses automake to compile, now uses a regular make file. No program files were updated or changed.


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.64
changelog:
  - Add 0167-RHBZ-735459-fix-mpathpersist-fns.patch
    * make reservation_key display correctly in "multipathd show config"
  - Resolves: bz #735459


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.65
changelog:
  - Add 0168-RHBZ-902585-fix-state-size.patch
  - Add 0169-RHBZ-895110-fix-params-size.patch
  - Add 0170-RHBZ-889441-fix-multipath.rules.patch
    * set multipath device link_priority on change events
  - Add 0171-RHBZ-904836-handle-other-sector-sizes.patch
    * handle non-512 byte GPT sector sizes
  - Add 0172-RHBZ-895110-fix-output-buffer.patch
    * make sure to allocate enough space to print the full list of multipath
      devices
  - Add 0173-RHBZ-889429-catch-early-uevents.patch
    * start up the uevent listening thread early, but don't start up the
      uevent servicing thread until after you configure
  - Add 0174-RHBZ-875199-null-vector-fix.patch
  - Add 0175-RHBZ-889987-detect_prio_fix.patch
    * make sure you can actually get the priority with ALUA before selecting it.
  - Add 0176-RHBZ-892292-listing-speedup.patch
    * don't get the wwid when you are just listing a device.
  - Add 0177-RHBZ-902593-multipath-c-manpage.patch
  - Add 0178-RHBZ-918825-kpartx-loop-devices.patch
    * remove tmp loopdev create by 'kpartx -l' in no partitions were found.
  - Add 0179-RHBZ-920448-bindings-fix.patch
    * try to find the smallest unused user friendly name
  - Add 0180-RHBZ-928831-check-dm-version-for-retain_hwhandler.patch
    * don't use retain_attached_hw_handler on kernels that don't support it.
  - Resolves: bz #875199, #889429, #889441, #889987, #892292, #902585
  - Resolves: bz #902593, #904836, #918825, #920448, #928831


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.66
changelog:
  - Modify 0179-RHBZ-920448-bindings-fix.patch
    * remove debug printing.
  - Add 0181-RHBZ-958091-check-for-erofs.patch
    * only retry loading a map read-only if the read/write load failed
      with EROFS
  - Add 0182-RHBZ-947798-rw-change.patch
    * add a new multipath.conf default keyword "reload_readwrite". If set
      to "yes", multipathd will listed to path device change events, and
      if they device has become read/write, it will reload the multipath
      device.
  - Add 0183-RHBZ-924924-replace_whitespace.patch
    * add a new multipath.conf default keyword "replace_wwid_whitespace".
      If set to "yes", multipath will add --replace-whitespace for devices
      That use the default getuid callout.
  - Add 0184-RHBZ-975676-fix_cli_resize.patch
    * deal with resize happening while path device is being removed.
  - Add 0185-RH-signal-waiter.patch
    * send waiter thread a signal to break out of waiting for dm events
  - Resolves: bz #958091, #947798, #924924, #975676


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.67
changelog:
  - Modify 0182-RHBZ-947798-rw-change.patch
    * Add documentation
  - Modify 0183-RHBZ-924924-replace_whitespace.patch
    * Add documentation
  - Add 0186-RHBZ-974129-delay_set_fast_io_fail.patch
    * fix issue with setting fast_io_fail_tmo past the old value of
      dev_loss_tmo
  - Resolves: bz #974129, #924924, #947798


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.68
changelog:
  - Modify 0172-RHBZ-895110-fix-output-buffer.patch
    * free buffer
  - Modify 0182-RHBZ-947798-rw-change.patch
    * don't access multipath device if it has been freed in setup_multipath
  - Add 0187-RH-fix-bad-derefs.patch
    * Fix places where we are dereferencing freed pointers
  - Resolves: bz #947798


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.69
changelog:
  - Add 0188-RH-add-all_devs.patch
    * Add new special "all_devs" devices identifier, that makes multipath
      update a the values on all devices
  - Add 0189-RHBZ-986767-blacklist-td-devs.patch
    * add td[a-z].* devices to the builtin blacklist
  - Add 0190-UPBZ-994277-handle-offline-states.patch
    * Handle "transport-offline" and "quiesce" path states
  - Add 0191-UPBZ-995251-fail-rdac-on-unavailable.patch
    * make rdac checker always mark paths with asymmetric access state of
      unavailable as down
  - Resolves: bz #986767, #994277, #995251


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.70
changelog:
  - Modify 0185-RH-signal-waiter.patch
    * making the waiter threads exit correctly caused a race at shutdown.
  - Resolves: bz #996921


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.71
changelog:
  - Add 0192-RHBZ-916667-print-major-minor.patch
    * Make multipathd print major:minor on path and and remove events
  - Resolves: bz #916667


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.72
changelog:
  - Add 0193-UPBZ-1011341-dos-4k-partition-fix.patch
    * Make kpartx correctly handle 4K sector size devices with dos partitions.
  - Resolves: bz #1011341


author: Lawrence R. Rogers <lrr@cert.org> 1.1.0-1
changelog:
  * Release 1.1.0-1
  	
  	Features: 
  	---------
  	
  	* Translation : DFF GUI is now available in chinese, thanks to Zhang Jun.
  			Other languages were updated : Deutch, Italian, ...
  	
  	* AFF : A connector to support AFF dump. The module is based on AFFLib by Simson
  	L. Garfinkel (http://afflib.org)
  	
  	* PFF : This module parses PST, OST and PAB files to extract mailbox contents, it
  	also recovers deleted and orphaned files and give access to unallocated clusters.
  	It's based on Joachim Metz LibPFF. (http://sourceforge.net/projects/libpff)
  	
  	
  	* API : New cache system for FileMapping and File Descriptor.
  		vtime now can directly convert unix and windows 64 bits time stamp.
  	
  	* FAT:
  	  - extended attributes:
  	      * When there is slack space, a dedicated attribute specifies its start 
  	     	offset and its size. 
  	     	This feature is only available for classical files (neither deleted nor
  		orphaned)
  	      * Classical attributes are provided: Read Only, Hidden, System, Archive,
  	     	Volume
  	      * DOS name is provided (8+3 name)
  	  - Orphaned files scan
  	        The algorithm is now faster. When walking on free clusters, checks are
  	     	done to know if it was previously parsed when walking on deleted files
  		and directories in allocated clusters. Since chain of clusters of deleted
  		directories are used, this pass could read and parse free clusters.
  	
  	* GUI: Unicode support
  	
  	
  	Bug fixes:
  	----------
  	
  	* Add devices and Add files on Windows, it was not possible to add devices and
  	files or directories in the same session.
  	
  	* MFSO opened only one file descriptor and cache it, leading to crash especially
  	 using device module on windows platform, a totally new cache system was written
  	for FileMapping and File Descriptor.
  	
  	* EWF : Sometimes the modules could not open the underlaying due to bad fd
  	handling this was fixed by using variant.
  	
  	* FAT :
  	  -  Recovery of deleted files was not properly handled. Previous version relied
  	     on the chain of clusters found in FAT which are often emptied when files are
  	     deleted. Now, the module gets the first cluster, asks the FAT for a the 
  	     chain of cluster, if the size of all provided is smaller than the size of 
  	     file, the mapping starts from the first cluster until size of the file is 
  	     reached.
  	  -  Even if not noticeable by users (hashes of files were coherent for example)
  	     and not really a bug, the previous mapping for files were cluster aligned.
  	     It means the slack space of files were directly included in the mapping.
  	     This was done this way in prediction of future implementation of MFSO. 
  	     This feature would be able to read either original size or slack space.
  	     Since it is not implemented yet, the mapping is now fully based on the size
  	     of the file. This patch has been developed based on Johannes Stuttgen's
  	     feedback when he was working on the aff4 module.
  	
  	* NTFS :
  	  -  Fix for files-end made of virtual chunks ; full of 0.
  	  -  Infinite loop fix when searching for parent of deleted or orphan items.
  	  -  Two segfault fixes on metadata parsing due to complex on-disk structure
  	     of NTFS attributes.
  	
  	* GUI :
  	  -  A bug occuring when trying to input a Node as a parameter to modules has
  	     been fixed : it was not possible to browse in the tree view.
  	  -  The tree view, in the node browser, had an inconsitant behavior : to change
  	     directories, users had to double-click on nodes names, which used to
  	     collapse the tree view. This is fixed. The node browser now behaves as a
  	     classic file browser.
  	
  	* Variant vtime repr:
  	  -  Dealing with vtime encapsulated in Variant in the Python interpreter, an
  	     exception were raised because there were no __repr__ or __str__ provided
  	     for this type.


author: Lawrence R. Rogers <lrr@cert.org> 20160704-1
changelog:
  * Release 20160704-1
  	Version from 20160704
  	Now also requires libfwnt-python >= 20160418
  	Now also requires python-dfdatetime >= 20160610


author: <euitto@gmail.com> - 9-15
changelog:
  * Release 9-15
  	Readded libewf support, for newer versions of libewf
  	Monolithic patch includes previous patch from David Loveall (ewf.c)
  	Added support for btrfs, ext4, exfat, luks, f2fs - 9-14


author: <euitto@gmail.com> - 9-19.1
changelog:
  * Release 9-19.1
  	The release number was advanced to make it larger than the version currently provided by stock Fedora.


author: <euitto@gmail.com> - 9-30.1
changelog:
  * Release 9-30.1
  	The release number was advanced to make it larger than the version currently provided by stock Fedora 32.


author: Lawrence R. Rogers <lrr@cert.org> 2-1
changelog:
  * Release 2-1
  	A major release of diStorm3.2 is now available. Fixed many instructions, either operand accuracy
  	problems or typos in mnemonics. Fixed a few bugs introduced in July 2011. Added new instructions
  	such as: INVPCID, TZCNT, RDxSBASE, WRxSBASE, CVTPS2PH, CVTPH2PS and more. Added a new compiler
  	directive DISTORM_LIGHT to compile only distorm_decompose (no text formatting) to make diStorm
  	smaller in size (should save around 20kb), thanks to Marius Negrutiu of BullGuard. Fixed the
  	Java wrapper to support latest version.


author: Lawrence R. Rogers <lrr@cert.org> 3-1
changelog:
  * Release 3-1
  	diStorm version 3.3 is now released. The structure of a decoded instruction now contains new fields
  	that let one know how the instruction affected the CPU flags (modified, tested, undefined). For
  	more info see the last three fields of the DInst structure inside DecomposeInterface.

  	Compacted the DB of instructions much more, with another level of shared data among similar instructions...

  	The Python bindings now support the control flow features that diStorm3 itself support, thanks to Vext01.


author: Lawrence R. Rogers <lrr@cert.org> 3-2
changelog:
  * Release 3-2
  	Fixed a text formatting problem with the MOVZX instruction, thanks to Jun Koi for reporting.

  	Finally I got to fix the problem with the Python binding. I also had to fix a few other problems.
  	I am testing everything and will upload a new version by tomorrow. Thanks for your patience.


author: Lawrence R. Rogers <lrr@cert.org> 3.1-1
changelog:
  * Release 3.1-1
  	This is distorm3 version 3.1 that has been installed to solve this problem: https://code.google.com/p/volatility/issues/detail?id=342
  	Distorm3 version 3.3 is available but it has a problem in Volatility.


author: Lawrence R. Rogers <lrr@cert.org> - 1.0.0-1
changelog:
  * Release 1.0.0-1

  	* Fixed crash when renaming a file within a single directory and a new name differs only in case.
  	* Fixed clusters allocation: a cluster beyond valid clusters range could be allocated.
  	* Fixed crash when a volume is unmounted while some files are open.
  	* SConscript now respects AR and RANLIB environment variables.
  	* Improved error handling.

  	Linux:

  	* Enabled big_writes. This improves write speed (larger block size means less switches between kernel- and user-space).
  	* Do BLKROGET ioctl to make sure the device is not read-only: after "blockdev --setro" kernel still allows to open the device
  	  in read-write mode but fails writes.

  	OS X:

  	* Fixed OS X 10.8 support.
  	* Switched to 64-bit inode numbers (now Mac OS X 10.5 or later is required).
  	* Switched from unmaintained MacFUSE to OSXFUSE (http://osxfuse.github.com).
  	* Fixed device size detection. Now mkfs works.
  	* Workarounded some utilities failures due to missing chmod() support.
  	* Disabled (senseless) permission checks made by FUSE.


author: Lawrence R. Rogers <lrr@cert.org> - 1.0.1-1
changelog:
  * Release 1.0.1-1
  	* Fixed unexpected removal of a directory if it is moved into itself.
  	* Fixed "Operation not permitted" error on reading an empty file.


author: Lawrence R. Rogers <lrr@cert.org> - 1.2.0-1
changelog:
  * Release 1.2.0-1
      1.2.0 (2015-08-26)
  	* Switched from SCons to autotools.
  	* Added musl libc support [Brendan Heading].
  	* Worked around "FS is larger than device" error for memory cards formatted by Panasonic Lumix cameras.
  	* Worked around "unknown entry type 0xe1" error for memory cards formatted by Sony cameras.

      1.1.1 (2014-11-15)
  	* Fixed mkfs crash on some sectors-per-cluster (-s option) values.

      1.1.0 (2014-07-08)

  	* Relicensed the project from GPLv3+ to GPLv2+.
  	* OpenBSD support [Helg Bredow].
  	* Improved I/O errors handling.
  	* Implemented fsync() and fsyncdir().
  	* Fixed crash on Mac OS X 10.5 caused by non-standard use of realpath(). Also
  	  fixed TrueCrypt disks unmounting.
  	* Avoid extra erase on writes to the end of a file. This should improve linear write speed.
  	* Allow arbitrary changing of lower 9 bits of mode. Allow owner/group changing
  	  to the same owner/group. This fixes rsync.
  	* Fixed buffers overflows when handling lengthy file names.
  	* Fixed "real size does not equal to size" error on volumes with pagefile.sys.
  	* Fixed negative IUsed in "df -i" output.


author: Lawrence R. Rogers <lrr@cert.org> - 1.2.3-1
changelog:
  * Release 1.2.3-1
  	1.2.3 (2015-12-19)
  	* Fixed clusters loss when file renaming replaces target.

  	1.2.2 (2015-11-09)
  	* Improved reliability in case of a sudden unplug: FS will be in a clean state
  	  after closing all files and performing sync(1).
  	* Fixed compilation on Debian GNU/kFreeBSD and GNU/Hurd platforms.
  	* Updated mount.exfat-fuse man page.

  	1.2.1 (2015-09-24)
  	* Fixed compatibility with Zalman VE-200: now newly created directories do not
  	  have archive bit set.
  	* Fixed heap corruption: malformed FS can use invalid sector or cluster size.
  	* Fixed hang on mount: malformed FS can have cyclic references in the clusters
  	  map.


author: Lawrence R. Rogers <lrr@cert.org> - 1.2.4-1
changelog:
  * Release 1.2.4-1
  	* Fixed wrong files names hashes when upper case table is compressed.
  	* Man pages are now installed by default.
  	* Commas and backslashes in device names are now escaped.


author: Lawrence R. Rogers <lrr@cert.org> - 1.2.7-1
changelog:
  * Release 1.2.7-1
  	1.2.7 (2017-06-05)
  		* Fixed handling of two last clusters: operations with files that occupy these
  		  clusters could fail.
  		* Fixed crash when started with stdin, stdout or stderr closed.

  	1.2.6 (2017-01-28)
  		* Operations with directories (except initial listing) now make less
  		  read/write system calls.
  		* Fixed handling of files with optional tail entries (0xe0-0xff): videoclip
  		  files created by Sony cameras were missing.
  		* Write operations now correctly return ENOSPC (instead of EIO) when there is
  		  no free disk space left.
  		* Fixed max file name length: it's 255 16-bit code units (not 256).

  	1.2.5 (2016-12-05)
  		* Added an option for dumpexfat to show file fragments [Daniel Drake].
  		* Fixed crash when directory starts with an invalid cluster.
  		* Daylight saving time in now properly reflected in file timestamps.


author: Lawrence R. Rogers <lrr@cert.org> - 1.2.8-1
changelog:
  * Release 1.2.8-1
  	1.2.8 (2018-02-03)
  		* Fixed new files or directories creation in the root directory: ensure there
  		  are no 0x00 entries before valid ones; otherwise Windows can corrupt them.
  		* Fixed compilation on GNU/HURD platform.


author: Lawrence R. Rogers <lrr@cert.org> - 1.3.0-1
changelog:
  * Release 1.3.0-1
  	1.3.0-1 (2018-09-15)
  		* exfatfsck can now repair some errors.
  		* Added experimental Android support for exfat-utils [liminghao, LongPingWEI,
  		  Pablo Mendez Hernandez, Pierre-Hugues Husson].
  		* Cleaned up FUSE code preparing for FUSE 3 support.
  		* Removed OpenBSD support as it does not handle -o option in fuse_main().
  		* Re-introduced FreeBSD support [Oleksii Samorukov].
  		* Fixed DragonFly BSD support [Tomohiro Kusumi].
  		* dirent->d_type in now filled on readdir() [Mark Browning].


author: Simson Garfinkel <simsong@imac3.home> 0.6.6-1
changelog:
  * Release 0.6.6-1
  	* configure.ac: increased version number to 0.6.6
  	* src/fiwalk.cpp: added -GXX option to suppress hash calculation on files larger than XX GB.
  	* src/test_fiwalk.sh: now validates XML
  	* src/fiwalk.cpp: added option -Gnn to specify a maximum gigabyte size of files larger than which won't be processed for content. Default filesize is 2GB.
  	* src/fiwalk.cpp: now calls x->open() before reading the config file.
  	* src/fiwalk.h: removed opt_multithreaded.
  	* src/content.cpp: removed evp_md5 stuff
  	* src/fiwalk.cpp: libmagic is now disabled by default
  	  outer tag changed from <fiwalk> to <dfxml>


author: Simson Garfinkel <simsong@imac3.home> 0.6.7-1
changelog:
  * Release 0.6.7-1
  	* configure.ac: increased version number to 0.6.7
  	* python/idifference.py: relevant_filenames removed.
  	  (DiskState.print_fi2.prtime): extensively rewrote for improved performance. Removed numerous typos. Now makes ZIP or TAR files.
  	* python/dfxml.py (fileobject_reader._end_element): modified to allow either <fiwalk> or <dfxml> by ignoring tag type in _end_element()
  	* xml.h: added HAVE_SYS_RESOURCE_H


author: Simson Garfinkel <simsong@imac3.home> 0.6.9-1
changelog:
  * Release 0.6.9-1
  	* configure.ac: added -Wall and -D_FORTIFY_SOURCE=2 
  	* increase version number to 0.6.9
  	* configure.ac: changed search for -lcrypto from MD5_Update to EVP_md5
  	* src/fiwalk.h: significantly rearranged the #include files so that all of the /usr/include/*.h files are included,
  	  then the /usr/include/sys/*.h, then the C++ files. This seems to handle some strange errors we were getting.
  	* configure.ac: removed -lewf -lz push into LIBS. It doesn't give you luck if the libewf library is not present.
  	* src/content.cpp: removed __PRI64_PREFIX define for Weird Linux Bug
  	* src/unicode_escape.cpp: added #include <stdint.h>
  	* src/unicode_escape.cpp (UTF8BufferToUTF32Buffer): changed unsigned long * to uint32_t *
  	  (validateOrEscapeUTF8): changed unsigned long to uint32_t
  	* src/lua_utf8.c (sarn_utf8_code_func): replaced unsigned long int with uint32_t
  	* src/fiwalk.cpp: -s option removed because it causes problems on big disks.
  	* src/content.cpp: removed my_evp_md(const char *str)
  	  (content::open_savefile): unable to open save file is no longer a fatal error.


author: Simson Garfinkel <simsong@imac3.home> 0.6.11-1
changelog:
  * Release 0.6.11-1
  	* configure.ac: incremented version number to 0.6.11.
  	* hash_t.h final(): if final() is called before initialized, init! 
  	* src/test_fiwalk.sh (IMG): updated test so that it returns 0 if $IMG is not on the system, rather than failing.


author: Simson Garfinkel <simsong@Alphonse-Mucha.local> 0.6.12-1
changelog:
  * Release 0.6.12-1
  	* configure.ac: upgraded fiwalk to version 0.6.12
  	* xml.cpp (mkstemp): changed mkstemp linkage so it's a C program.
  	* python/dfxml.py (volumeobjects_sax): byterun class renamed byte_run to match new DFXML spec.
  	* src/xml.h: added time.h. Fixed DFXML to output compile date in ISO8601 time.
  	* src/fiwalk.cpp (file_infot): time format changed to ISO 8601 for XML output.
  	* src/content.cpp (content::write_record): all <run> tags changed to <byte_run>
  	* src/xml.h (class xml): version 1.0 added to creator
  	* src/fiwalk.cpp: namespace changed to http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML
  	* dfxml version changed to 1.0
  	* xml.cpp: changed #ifdef WIN to appropriate #ifdefs
  	* xml.h (class xml): changed #ifdef WIN to appropriate #ifdefs


author: Simson Garfinkel <simsong@mncrnpsedu.local> 0.6.15-1
changelog:
  * Release 0.6.15-1
  	* configure.ac: upgraded fiwalk to version 0.6.15
  	* src/fiwalk_tsk.cpp (file_act): now combines 512-byte segments from compressed files.
  	* python/fiwalk.py (fileobjects_using_sax): fixed fileobjects_using_sax
  	* dfxml.py (fileobject_reader.__init__): no longer errors on hashdigests not located in fileobjects
  	* configure.ac: rewrote test to handle obsolete version of AFFLIB in MacPorts.


author: Simson Garfinkel <simsong@mncrnpsedu.local> 0.6.16-1
changelog:
  * Release 0.6.16-1
  	* xml.cpp: moved library versions from xml.h to xml.cpp
  	  (xml::add_DFXML_build_environment): now includes exiv2 version in dfxml output
  	* xml.cpp (printf): added #ifdef GNUC_HAS_DIAGNOSTIC_PRAGMA to allow compiling with older GCC
  	* python/ireport.py: renamed from istats and changed to work with dfxml
  	* python/Makefile.am (EXTRA_DIST): Changed istats to ireport.
  	* python/dfxml.py (fileobjects_iter): replaced iteritems() with items() to allow for migration to Python 3.
  	  Replaced unicode() with "" for migration to Python 3.


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.1
changelog:
  * Release 1.6-1.1
  	This is the initial release of this package.
  	It contains all of the OS and architecture-independent parts of FMEM.


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.2
changelog:
  * Release 1.6-1.2
  	Updated these files:
                  lkm.c
          to be in sync with the FMEM Forensics Source code repository.


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.3
changelog:
  * Release 1.6-1.3
  	Updated these files:
                  lkm.c
          to compile with linux kernels 4.7.


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.4
changelog:
  * Release 1.6-1.4
  	Updated lkm.c to current as of 2019-10-22.
  	Also updated isntall-mem to reference the correct location of the kernel modules.


author: Lawrence R. Rogers <lrr@cert.org> 1.6-60
changelog:
  * Release 1.6-60
  	Kernel modules were added for the following kernels:
  		2.6.32-754.24.3
  		2.6.32-754.24.2


author: Lawrence R. Rogers <lrr@cert.org> 1.6-26
changelog:
  * Release 1.6-26
  	Kernel modules added for the following kernels:
  		4.18.0-305.19.1
  		4.18.0-305.17.1


author: Lawrence R. Rogers <lrr@cert.org> 1.6-8
changelog:
  * Release 1.6-8
  	Kernel modules were added for the following kernels:
  		5.14.0-115
  		5.14.0-118
  		5.14.0-119
  		5.14.0-120
  		5.14.0-124


author: Lawrence R. Rogers <lrr@cert.org> 1.6-14
changelog:
  * Release 1.6-14
  	Kernel modules were added for the following kernels:
  		5.14.0-162
  		5.14.0-163
  		5.14.0-165


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.40
changelog:
  * Release 1.6-1.40
  	Kernel modules were added for the following kernels:
  		4.10.15-100
  		4.10.16-100


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.34
changelog:
  * Release 1.6-1.34
  	Kernel modules were added for the following kernels:
  		4.15.16-200
  		4.15.15-200


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.35
changelog:
  * Release 1.6-1.35
  	Kernel modules were added for the following kernels:
  		4.20.17-100
  		4.20.16-100
  		4.20.15-100


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.35
changelog:
  * Release 1.6-1.35
  	Kernel modules were added for the following kernels:
  		5.8.10-100
  		5.8.9-101
  		5.8.8-100


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.37
changelog:
  * Release 1.6-1.37
  	Kernel modules were added for the following kernels:
  		5.10.21-100
  		5.10.20-100


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.40
changelog:
  * Release 1.6-1.40
  	Kernel modules were added for the following kernels:
  		5.11.11-100
  		5.11.10-100


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.41
changelog:
  * Release 1.6-1.41
  	Kernel modules were added for the following kernels:
  		5.11.13-100
  		5.11.12-100


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.42
changelog:
  * Release 1.6-1.42
  	Kernel modules were added for the following kernels:
  		5.11.15-100
  		5.11.14-100


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.45
changelog:
  * Release 1.6-1.45
  	Kernel modules were added for the following kernels:
  		5.11.19-100
  		5.11.18-100


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.46
changelog:
  * Release 1.6-1.46
  	Kernel modules were added for the following kernels:
  		5.11.22-100
  		5.11.21-100


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.39
changelog:
  * Release 1.6-1.39
  	Kernel modules were added for the following kernels:
  		5.13.15-100
  		5.13.14-100


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.40
changelog:
  * Release 1.6-1.40
  	Kernel modules were added for the following kernels:
  		5.13.19-100
  		5.13.16-100


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.43
changelog:
  * Release 1.6-1.43
  	Kernel modules were added for the following kernels:
  		5.14.12-100
  		5.14.11-100


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.45
changelog:
  * Release 1.6-1.45
  	Kernel modules were added for the following kernels:
  		5.14.16-101
  		5.14.15-100


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.46
changelog:
  * Release 1.6-1.46
  	Kernel modules were added for the following kernels:
  		5.14.18-100
  		5.14.17-101


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.45
changelog:
  * Release 1.6-1.45
  	Kernel modules were added for the following kernels:
  		5.16.20-100
  		5.16.19-100


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.50
changelog:
  * Release 1.6-1.50
  	Kernel modules were added for the following kernels:
  		5.17.9-100
  		5.17.8-100

  5.17.7-100


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.34
changelog:
  * Release 1.6-1.34
  	Kernel modules were added for the following kernels:
  		5.18.16-100
  		5.18.15-100


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.41
changelog:
  * Release 1.6-1.41
  	Kernel modules were added for the following kernels:
  		5.19.11-100
  		5.19.10-100


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.10
changelog:
  * Release 1.6-1.10
  	Kernel modules were added for the following kernels:
  		5.18.16-200
  		5.18.15-200


author: Lawrence R. Rogers <lrr@cert.org> 1.6-1.17
changelog:
  * Release 1.6-1.17
  	Kernel modules were added for the following kernels:
  		5.19.11-200
  		5.19.10-200


author: Lawrence R. Rogers <lrr@cert.org> - 1.0.0-1
changelog:
  * Release 1.0.0-1
  	* Fixed crash when renaming a file within a single directory and a new name differs only in case.
  	* Fixed clusters allocation: a cluster beyond valid clusters range could be allocated.
  	* Fixed crash when a volume is unmounted while some files are open.
  	* SConscript now respects AR and RANLIB environment variables.
  	* Improved error handling.

  	Linux:

  	* Enabled big_writes. This improves write speed (larger block size means less switches between kernel- and user-space).
  	* Do BLKROGET ioctl to make sure the device is not read-only: after "blockdev --setro" kernel still allows to open the device in
  	  read-write mode but fails writes.

  	OS X:

  	* Fixed OS X 10.8 support.
  	* Switched to 64-bit inode numbers (now Mac OS X 10.5 or later is required).
  	* Switched from unmaintained MacFUSE to OSXFUSE (http://osxfuse.github.com).
  	* Fixed device size detection. Now mkfs works.
  	* Workarounded some utilities failures due to missing chmod() support.
  	* Disabled (senseless) permission checks made by FUSE.


author: Guido Trotter <ultrotter@debian.org>0.1-1
changelog:
  * Release 0.1-1
    [ Ludovico Gardenghi ]
    * Initial release

    [ Guido Trotter ]
    * Fix build dependencies


author: Filippo Giunchedi <filippo@debian.org> 0.3-1
changelog:
  * Release 0.3-1
    [ Ludovico Gardenghi ]
    * New upstream release
      + Added support for rename()
      + Added support for symlink()

    [ Filippo Giunchedi ]
    * Upgrade to S-V 3.8.0 (add Homepage) 
    * libumlib0-dev -> libumlib-dev transition 
    * Fix link to GPLv2 in copyright


author: Jens Petersen <petersen@redhat.com> - 0.17-15
changelog:
  - bring back autopoint requires cvs (#517361)
  - requires info rather than /sbin/install-info
  - drop install_info and remove_install_info macros


author: Jens Petersen <petersen@redhat.com> - 0.17-16
changelog:
  - fix FTBFS by removing openmp.m4 which conflicts with recent autoconf (#539211)
  - cleanup gettext-0.17-rpathFix.patch
    - separate gl_AC_TYPE_LONG_LONG replacement to another patch
    - use trailing ':' for tests LD_LIBRARY_PATH
  - run autogen.sh with --quick and --skip-gnulib


author: Jens Petersen <petersen@redhat.com> - 0.17-17
changelog:
  - create emacs subpackages for po-mode.el (thanks for patch from
    Jonathan Underwood, #579452)
  - provide emacs-po-mode
  - move libgettextlib and libgettextsrc from base to libs subpackage
    (requested by Peter Robinson for blender, #579388)


author: Jens Petersen <petersen@redhat.com> - 0.18.1.1-1
changelog:
  - update to 0.18.1.1 release (#591044)
  - gettext-0.17-autopoint-CVS-441481.patch, gettext-0.17-long-long-int-m4.patch
    gettext-0.17-open-args.patch, and
    gettext-xgettext-python-unicode-surrogate-473946.patch are upstream
  - move libintl.jar to lib subpackage to avoid multilib problems
    (reported by Jim Radford in #595922)
  - disable java for now
  - use chrpath to get us out of rpath hell instead of complicated libtool hacks
  - enable git support


author: Jens Petersen <petersen@redhat.com> - 0.18.1.1-2
changelog:
  - correct license tag from GPLv3 to GPLv3+
  - subpackage autopoint which requires git (#574031)
  - no longer require cvs (#606746)
  - add bcond for git


author: Jens Petersen <petersen@redhat.com> - 0.18.1.1-3
changelog:
  - merge autopoint subpackage into devel to simplify deps (#625325)
  - have ABOUT-NLS only in the base package datadir


author: Lawrence Rogers <lrr@cert.org> 0.8.0-1
changelog:
  - Changes making 0.8.0
      Add attempt data rescue section to help manual (#171215)
      
      Add documentation for new feature to attempt data rescue for lost
      partitions.
      
      Closes Bug #171215 - Support lost partition recovery

      Added support to lost data recovery using gpart

      Prevent visual disk display area from disappearing
      
      Added a display refresh to the event queue to address this
      problem.
      
      Previously, the display area of the visual disk seemed to
      disappear when enough operations had been added to the queue so
      that a scrollbar was required (about 4 operations).
      
      If the three lines in HBoxOperations::load_operations method for
      "//make scrollwindow focus on the last operation in the list"
      were commented out then this also prevented the problem from
      occurring.
      
      Interestingly, if I changed the "set_cursor" method to
      a "scroll_to_row" method, then this problem does not occur for an
      additional 2 operations (about 6 operations total).
      
      Ubuntu launchpad bug 583746 - Partition graph disappears after a
                                    swap partition has been deleted
      https://bugs.launchpad.net/ubuntu/+source/gparted/+bug/583746

      Increase robustness of help manual launch
      
      Add direct invocation of yelp if normal open help manual methods
      fail.

      Add possible cause for failure to read file system

      Add another reason to list when unable to detect file system

      Update copyright year

      Change documentation to URL gparted.org and update copyright year

      Fix minor cylinder alignment rounding error (size < 1 cylinder)
      
      Previously when creating a new partition on a device with 512
      byte sectors with 7 MiB chosen and cylinder alignment, the
      snap_to_cylinder logic would round up to 2 cylinders (~15.69
      MiB), instead of the correct 1 cylinder (~7.84 MiB).

      Fix paste destination partition smaller than source (#639393)
      
      Re-work logic for copying a cylinder aligned partition to a new
      MiB aligned partition.  Previously this was partially fixed in
      bug #626946 - Destination partition smaller than source partition
      
      Closes Bug #639393 - Redux: Destination partition smaller than
                           source partition


author: Lawrence Rogers <lrr@cert.org> 0.8.1-1
changelog:
  - Changes making 0.8.1
      Add note to AUTHORS file for Seth's contributions

      Simplified cleanup_cursor() implementation
      
      I hit this performance bug when I cloneda 40G NTFS partition. The actual
      copy was done in under 11 minutes. After that I was shocked to find that
      gparted would spend over 12 minutes in cleanup_cursor, pegging a CPU
      core. (On a quad core desktop...)
      
      Simply replacing the ustring with std::string would reduce the time to
      about 1.5 minutes. Still bad. Also, I didn't want to lose UTF8
      awareness.
      
      So I rewrote the algorithm in 'streaming mode'. This has the (potential)
      drawback that locale conversions are done, but performs well and
      - IMHO - is a lot more readable.
      
      On a minor note: this implementation correctly handles backspaces at the
      start of a line.

      Remove one level of quoting when spawning commands
      
      Change spawn_command_line_sync to spawn_sync to reduce the level of
      quoting required when passing commands to the function.  Since
      spawn_command_line_sync uses the parent's environment, the replacement
      call also uses the parent's environment.
      
      This change permits unmounting of file systems mounted with an
      apostrophe in the mount point name.
      
      Ubuntu launchpad bug 151796 - Can't unmount partition with apostrophe
                                    in label
      https://bugs.launchpad.net/ubuntu/+source/gparted/+bug/151796

      Ensure graphical error message displayed when run by non-root user
      
      Ubuntu launchpad bug 696937 - Running gparted as non-root user
                                    displays no graphical error message
      https://bugs.launchpad.net/ubuntu/+source/gparted/+bug/696937

      Add openSUSE command to install dependencies to README

      Remove all usage of kpartx to avoid partition entry duplicates
      
      Usage of the kpartx package to create partition names has been
      completely removed.  Hence kpartx is no longer even an optionally used
      package by gparted.
      
      This change is related to the following bug report:
      
      Ubuntu launchpad bug 719129 - [Natty] Gparted duplicates dmraid
                                    partition devices
      https://bugs.launchpad.net/ubuntu/+source/gparted/+bug/719129

      Add flag --enable-libparted-dmraid to use native libparted dmraid
      
      The new configure option --enable-libparted-dmraid enables the native
      use of /dev/mapper dmraid support in the libparted library.
      
      If this option is not specified, or is disabled, then gparted code
      will be used to support dmraid.  The gparted code uses the old dmraid
      partition naming scheme of always appending the partition number to
      the device name.  The letter 'p' is not inserted between the device
      name and the partition number.  The gparted code is particularly
      useful when used with older versions of libparted that do not support
      /dev/mapper dmraid.
      
      Ubuntu launchpad bug 719129 - [Natty] Gparted duplicates dmraid
                                    partition devices
      https://bugs.launchpad.net/ubuntu/+source/gparted/+bug/719129


      Add comment for documentation maximum image width recommendation

      Add Esperanto translation
      Fixed typos in French translation
      Updated Latvian translation.
      [l10n] Updated Italian translation
      Updated Romanian translation
      Updated French translation
      Updated Danish translation
      [l10n] Updated Dutch translation
      Updated Arabic translation


author: Lawrence Rogers <lrr@cert.org> 0.5.0-1
changelog:
  * Release 0.5.0-1
  	This is a major code refresh release to catch up with the times. Changes include:
  		Redesigned grokevt-builddb to use RegLookup's pyregfi library instead of executing the command line tools
  		Added work-around for the fact that many Linux distributions no longer make case-insensitive filesystem mounts easy
  		Support for Python 3
  		Changed license to GPLv3
  		Various unicode and other bug fixes


author: Lawrence R. Rogers <lrr@cert.org> 0.7.3-2
changelog:
  * Release 0.7.3-2
  	Use latest version of libewf
  	Installed workaround where \ at the end of a line in the config file caused errors


author: Lawrence R. Rogers <lrr@cert.org> 0.7.4-1
changelog:
  * Release 0.7.4-1
    * Added output for hostname, domainname and system to info file
    * New cfg param InfoFieldsForDd
    * Corrected bug: DisconnectTimeout only must be active if LimitJobs is active
    * libewf version check changed, all versions >= 20130416 are accepted
    * New cfg parameter InfoFieldsForDd


author: Lawrence R. Rogers <lrr@cert.org> 0.8.1-1
changelog:
  * Release 0.8.1-1
  	* New DeviceScanMethod libudev
  	* Adapted to Qt 5 API
  	* For computers with non standard mouse: Double click open context menu
  	* New configuration parameter AvoidCifsProblems
  	* Show version number in main window title bar
  	* Debug CIFS flcose problem
  	* Added EWFX support from libewf


author: Lawrence R. Rogers <lrr@cert.org> 0.8.4-1
changelog:
  * Release 0.8.4-1
  	guymager-beta (0.8.4-1) unstable; urgency=low
  	   * Removed bug that occurred if remaining time was longer than 99 hours
  	   * Adapted to gcc7

  	guymager-beta (0.8.3-1) unstable; urgency=low
  	   * Corrected bug where Guymager not always recognised if duplicate image or
  	     info file was the same as first one.
  	   * In the duplicate acquisition dialog mark the device selected in the first
  	     acquisition dialog and make it unselectable.
  	   * New features in acquisition dialog: Allow relative paths in filenames,
  	     allow direct editing of directory fields. See new configuration parameters
  	     DirectoryFieldEditing, AllowPathInFilename and ConfirmDirectoryCreation.
  	   * Forbid overwriting image / info files of other acquisitions (up until now,
  	     only an warning was shown that could have been ignored by the user).

  	guymager-beta (0.8.2-1) unstable; urgency=low
  	   * Support for SHA1 checksum in EWF images (for AEWF and LIBEWF)
  	   * Corrected bug where directory button in dlgacquire would be drawn
  	     half underneath entry field for certain configuration settings.
  	   * Corrected bug where %SizeHumanNoSep% behaved the same as %SizeHuman%


author: Lawrence R. Rogers <lrr@cert.org> 0.8.7-1
changelog:
  * Release 0.8.7-1
  	guymager-beta (0.8.7-1) unstable; urgency=low
  	   * Typing errors corrected

  	guymager-beta (0.8.6-1) unstable; urgency=low
  	   * Upon disconnection of device, do not pause verification if it is done
  	     on the image only (pausing still for source verifications).
  	   * New cfg parameter AdditionalStateInfoName
  	   * System signal HUP triggers device rescanning
  	   * Special tokens %UserField% and %AddStateInfo% added

  	guymager-beta (0.8.5-1) unstable; urgency=low
  	   * New cfg parameters BadSectorLogThreshold and BadSectorLogModulo.


author: Lawrence R. Rogers <lrr@cert.org> 0.8.8-1
changelog:
  * Release 0.8.8-1
  	guymager-beta (0.8.8-1) unstable; urgency=low
  	   * Using pkexec instead of gksudo
  	   * New compile option ENABLE_LIBEWF


author: Lawrence R. Rogers <lrr@cert.org> 3.00-1
changelog:
  * Release 3.00-1
  	Here are the changes from the previous version (2.01)

  	This release markes the fusion of "hashcat" and "oclHashcat" into "hashcat".
  	It combines all features of all hashcat projects in one project.
  	
  	** THE VERSION 3.00 IS CURRENTLY STILL IN BETA **
  	
  				
  	- Support for Apple OpenCL runtime
  	- Support for NVidia OpenCL runtime (replaces CUDA)
  	- Support for Mesa (Gallium) OpenCL runtime
  	- Support for pocl OpenCL runtime
  	- Support for Khronos' OSS OpenCL reference implementation for building
  	- Support to utilize OpenCL devices-types other than GPU, ex: CPU and FPGA
  	- Support to utilize multiple different OpenCL platforms in parallel, ex: AMD + NV
  	- Support to utilize multiple different OpenCL device-types in parallel, ex: GPU + CPU
  	- Added option --opencl-platform to select a specific OpenCL platform
  	- Added option --opencl-device-types select specific OpenCL device types
  	- Added option --opencl-vector-width to override automatically selected vector-width size
  	- Added makefile native compilation target
  	- Added makefile install and uninstall targets
  	- Added autotuning engine and user-configurable tuning database
  	- Added current engine clock, current memory clock and pci-e lanes to the status display
  	- Added support for --gpu-temp-retain for NVidia GPU, both Linux and Windows
  	- Added execution timer of the running kernel to the status display
  	- Added command prompt to quit at next restore checkpoint
  	- Added human-readable error message for the OpenCL error codes
  	- Added option --potfile-path to override potfile path
  	- Added option --veracrypt-keyfile to set Keyfiles used, can be multiple
  	- Added option --veracrypt-pim to set the VeraCrypt personal iterations multiplier
  	- Added option --machine-readable for easier parsing of output
  	- Added option --powertune-enable to work with NVidia devices as well, not just AMD
  	- Added option --stdout to print candidates instead of trying to crack a hash
  	
  				
  	- Added new hash-mode   125 = ArubaOS
  	- Added new hash-mode 12900 = Android FDE (Samsung DEK)
  	- Added new hash-mode 13000 = RAR5
  	- Added new hash-mode 13100 = Kerberos 5 TGS-REP etype 23
  	- Added new hash-mode 13200 = AxCrypt
  	- Added new hash-mode 13300 = AxCrypt in memory SHA1
  	- Added new hash-mode 13400 = Keepass 1 (AES/Twofish) and Keepass 2 (AES)
  	- Added new hash-mode 13500 = PeopleSoft PS_TOKEN
  	- Added new hash-mode 13600 = WinZip
  	- Added new hash-mode 137** = VeraCrypt
  	- Added new hash-mode 13800 = Windows 8+ phone PIN/Password
  	
  				
  	- Full Table: https://docs.google.com/spreadsheets/d/1B1S_t1Z0KsqByH3pNkYUM-RCFMu860nlfSsYEqOoqco/edit#gid=0
  	
  				
  	- Reordering of files to help integration into linux distributions ~/.hashcat etc
  	- Use a profile directory to write temporary files (session, potfile etc.)
  	- Workaround depencies on AMD APP-SDK AMD ADL, NV CUDA-SDK, NV ForceWare, NVML and NVAPI; they are no longer required
  	- Load external libraries dynamic at runtime instead of link them static at compile-time
  	- Benchmark accuracy improved; Is now on par to: singlehash -a 3 -w 3 ?b?b?b?b?b?b?b
  	- Benchmark no longer depends on a fixed time
  	- Removed option --benchmark-mode, therefore support --workload-profile in benchmark-mode
  	- Enabled support of --machine-readable in combination with --benchmark for automated benchmark processing
  	- Replaced --status-automat entirely with --machine-readable to make it more consistent among benchmark and non-benchmark mode
  	- Extended support from 14 to 255 functions calls per rule
  	- Extended password length up to 32 for 7zip
  	- Extended salt length up to 55 for raw hash types, eg: md5($pass.$salt)
  	- Extended version information
  	- Removed some duplicate rules in T0XlCv1, d3ad0ne and dive
  	- Redesigned changes.txt layout
  	- Redesigned --help menu layout
  	
  				
  	- Fixed a bug in speed display: In some situation, especially with slow hashes or lots of salts, it showed a speed of 0H/s
  	- Fixed a bug in restore handling: user immediately aborting after restart broke the restore file
  	- Fixed a bug in line counter: conditional jump or move depends on an uninitialised value
  	- Fixed a bug in rule-engine for NVidia devices: code for left- and right-shift were switched
  	- Fixed a bug in dive.rule: rules were not updated after the function 'x' was renamed to 'O'
  	- Fixed a bug in memory allocation "OpenCL -4 error": used unitialized value in a special situation
  	- Fixed a bug in memory handling: heap buffer overflow
  	- Fixed a bug in memory handling: out of bounds access
  	- Fixed a bug in implementation of DCC2: forced default iteration count for hashes to 10240
  	- Fixed a bug in implementation of WPA/WPA2: MAC and nonce stay one their original position as in the hccap file
  	- Fixed a bug in implementation of GOST R 34.11-94: zero length passwords were not cracked
  	
  				
  	- Removed deprecated GCC version check requirement
  	- Removed NPROCS from Makefile, let make automatically detect the optimal number of parallel threads
  	- Dropped all C++ overloading functions to normal function which helps support more OpenCL platforms
  	- Renamed functions in common.h to emphasize their purpose
  	- Refactorized fast-hash kernels to enable SIMD on all OpenCL platforms
  	- Refactorized SIMD handling: SIMD the inner-loop not the outer-loop to save registers
  	- Workaround missing clEnqueueFillBuffer() support in certain OpenCL runtimes
  	- Added amd_bytealign() support in non-AMD OpenCL runtimes
  	- Added amd_bfe() support in non-AMD OpenCL runtimes
  	- Added several macros to allow writing optimized code for the different OpenCL platforms
  	- Replaced typedef for bool with stdbool.h
  	- Added special DEBUG environment variables to the makefile
  	- Hashcat now acquires an exclusive lock before writing to any file
  	- Changed buffers to not use same buffer for both input and output at the same time with snprintf()
  	- Check for allocatable device-memory depending on kernel_accel amplifier before trying to allocate
  	- Added additional check for max. ESSID length to prevent possible crashes
  	- Use a GCC equivalent for __stdcall where applicable
  	- Synchronize maximum output line size with input line size
  	- Increased maximum hash line size to 0x50000
  	- Run weak-hash checks only in straight-attack mode, this greatly reduces code complexity
  	- Restrict loopback option to straight attack-mode
  	- Moved rules_optimize to hashcat-utils
  	- Stick to older libOpenCL in binary package to avoid errors like this: version `OPENCL_2.0' not found
  	- Tightened hash parser for several algorithms
  	- Updated old RC4 code in Kerberos 5
  	- Limited the salt length of Juniper Netscreen/SSG (ScreenOS) hashes to 10
  	- Updated algorithm used to automatically select an ideal --scrypt-tmto value
  	- Renamed option --gpu-accel to --kernel-accel
  	- Renamed option --gpu-loops to --kernel-loops
  	- Renamed option --gpu-devices to --opencl-devices
  	- Added inline declaration to functions from simd.c, common.c, rp.c and types_ocl.c to increase performance
  	- Dropped static declaration from functions in all kernel to achieve OpenCL 1.1 compatibility
  	- Added -cl-std=CL1.1 to all kernel build options
  	- Created environment variable to inform NVidia OpenCL runtime to not create its own kernel cache
  	- Created environment variable to inform pocl OpenCL runtime to not create its own kernel cache
  	- Dropped special 64-bit rotate() handling for NV, it seems that they've added it to their OpenCL runtime
  	- Completely get rid of HAVE_ADL, HAVE_NVML and HAVE_NVAPI in sources
  	- Replaced NVAPI with NVML on windows


author: Thomas Spura <tomspur@fedoraproject.org> - 0.13.1-3
changelog:
  - obsolete old Thu Feb 21 2013 python packages (José Matos, #882724)
  - notebook and gui subpackage require matplotlib not the console anymore (#872176)


author: Thomas Spura <tomspur@fedoraproject.org> - 0.13.1-4
changelog:
  - More changes to build for Python 3 (mostly by Andrew McNabb, #784947)
  - Update package structure of python3-ipython subpackage to match python2-ipython one's
  - enable python3 build of ipython
  - exclude pylab tests for now, as it is broken on python3


author: Thomas Spura <tomspur@fedoraproject.org> - 0.13.2-1
changelog:
  - update to 0.13.2 fixes #927169, #947633
  - run tests in xvfb
  - reword description of ipython-tests a bit


author: Lawrence R. Rogers <lrr@cert.org> 20190102-3
changelog:
  * Release 20190102-3
  	Release 3 - Removed conflicts when that arise when python2 and python 3
  			versions are attempted to be installed on a system.


author: Lawrence R. Rogers <lrr@cert.org> 20190317-3
changelog:
  * Release 20190317-3
  	Version from 20190317-3: Uses python3_pkgversion for the current version of Python 3.


author: Joachim Metz <joachim.metz@gmail.com> 20150102-1
changelog:
  * Release 20150102-01
  	20150104
  	* update man page: libbfio.3

  	20150102
  	* 2015 update

  	20141229
  	* updated dpkg files

  	20141201
  	* code clean up

  	20141015
  	* changes for deployment

  	20141011
  	* worked on utility scripts

  	20140920
  	* changes for project site move

  	20140506
  	* fixes to build static library with mingw and cygwin
  	* fixes for missing unistd.h includes

  	20140105
  	* 2014 update
  	* updated dependencies

  	20131003
  	* updated dependencies

  	20130809
  	* updated dependencies
  	* worked on tests

  	20130721
  	* worked on multi threading support
  	* removed open on demand code from seek offset
  	* refactored pool to use a cdata array
  	* worked on tests
  	* update msvscpp files

  	20130718
  	* fixes for multi threading support

  	20130609
  	* updated dependencies
  	* fix for compiling with stand-alone version of libcdata
  	* fix in .pc.in file

  	20130509
  	* small changes

  	20130507
  	* updated dependencies

  	20130502
  	* updated dependencies
  	* worked on git release
  	* moved examples to project page

  	20130413
  	* updated dependencies

  	20130407
  	* updated dependencies

  	20130406
  	* updated dependencies
  	* removed codegear files
  	* updated msvscpp files
  	* remove libbfio_legacy.[ch]
  	* updated macosx PackageMaker files

  	20130103
  	* 2013 update
  	* added .gitignore


author: Joachim Metz <joachim.metz@gmail.com> 20150927-1
changelog:
  * Release 20150927-1
  	20150927
  	* merged history from backups
  	* updated m4 scripts and msvscpp files


author: Joachim Metz <joachim.metz@gmail.com> 20160108-1
changelog:
  * Release 20160108-1
  	20160108
  	* changes to seek
  	* added function to remove handle from pool

  	20160105
  	* 2016 update


author: Lawrence R. Rogers <lrr@cert.org> 20181229-3
changelog:
  * Release 20181229-3
  	Release 3 - Removed conflicts when that arise when python2 and python 3
  		    versions are attempted to be installed on a system.


author: Lawrence R. Rogers <lrr@cert.org> 20181229-5
changelog:
  * Release 20181229-5
  	Version from 20181229-5: Uses python3_pkgversion for the current version of Python 3.


author: Lawrence R. Rogers <lrr@cert.org> 20181227-3
changelog:
  * Release 20181227-3
  	Release 3 - Removed conflicts when that arise when python2 and python 3
  		    versions are attempted to be installed on a system.


author: Lawrence R. Rogers <lrr@cert.org> 20181227-5
changelog:
  * Release 20181227-5
  	Version from 20181227-5: Uses python3_pkgversion for the current version of Python 3.


author: Lawrence R. Rogers <lrr@cert.org> 20181227-5
changelog:
  * Release 20181227-5
  	Version 20181227-5: Uses python3_pkgversion for the current version of Python 3.


author: Lawrence R. Rogers <lrr@cert.org> 20150105-2
changelog:
  * Release 20150105-2
  	20150126
  	* fix in ewf.net

  	20150107
  	* 2015 update

  	20141229
  	* updated dpkg files
  	* updated dependencies
  	* updated .gitignore

  	20141226
  	* changes for updated dependencies

  	20141225
  	* worked on Python 3 support

  	20141210
  	* fix in spec file for zlib-static

  	20141204
  	* small changes in progress status output
  	* moved chunk groups cache into handle
  	* moved libewf_chunk_table_chunk_exists_for_offset out of write-only code path

  	20141201
  	* code clean up
  	* removed unrestrict_offset_table, added maximum of 128 M to size of offset table
  	* removed ewf_definitions.h


author: Lawrence R. Rogers <lrr@cert.org> 20160209-1
changelog:
  * Release 20160209-1
  	20160124
  	* worked on refactor

  	20160119
  	* worked on combined Python 2 and 3 build support

  	20160110
  	* 2016 update


author: Lawrence R. Rogers <lrr@cert.org> 20160331-1
changelog:
  * Release 20160331-1
  	20160329
  	* worked on thread locking support

  	20160328
  	* worked on tests
  	* worked on thread locking support

  	20160326
  	* changes for segment files read issue
  	* implement table2 fallback support in libewf_chunk_group_fill_v1

  	20160325
  	* fixed leaks libewf_chunk_table_get_chunk_data_by_offset
  	* worked on v2 support

  	20160320
  	* worked on tests
  	* fix for printing sha256 in ewfexport

  	20160319
  	* worked on tests
  	* fix for deployment using synclibs.sh
  	* removed v1 API
  	* removed delta file support
  	  - outside the concern of this library
  	* removed "random" functions from:
  	  - libewf
  	  - ewf.net
  	  - pyewf

  	20160318
  	* applied updates
  	* worked on tests


author: Lawrence R. Rogers <lrr@cert.org> 20160421-1
changelog:
  * Release 20160421-1
  	20160411
  	* worked on tests

  	20160410
  	* worked on version 2 format support
  	* worked on new read/write chunk API

  	20160409
  	* worked on multi threading support in ewfacquirestream
  	* worked on tests

  	20160404
  	* disabled bzip2 support for now
  	* add check to see if target file can be written in ewfacquire,
  	  ewfacquirestream, ewfexport, ewfrecover
  	* created a queue of storage media buffers
  	  - this blocks the reader thread if the queue is empty
  	  - this limits the maximum size of output list

  	20160403
  	* worked on deployment

  	20160402
  	* worked on multi threading support in ewfacquirestream
  	* fixes for Python-bindings tests
  	* fixes for ewfexport writing notification messsages to stdout
  	* changes for deployment
  	* increased granularity of process status

  	20160401
  	* worked on tests
  	* worked on thread locking support
  	* worked on multi threading support in ewfverify and ewfacquire

  	20160331
  	* worked on tests
  	* worked on thread locking support

  	20160330
  	* worked on thread locking support


author: Lawrence R. Rogers <lrr@cert.org> 20160623-1
changelog:
  * Release 220160623-1
  	This version is based on the source code of 20140608 but is numbered so that 
  	it becomes the default version.


author: Lawrence R. Rogers <lrr@cert.org> 20160718-1
changelog:
  * Release 20160718-1
  	This version is based on the source code of 20140608 but is numbered so that 
  	it becomes the default version. The base-on-source is part of the release number.


author: Lawrence R. Rogers <lrr@cert.org> 20160718-20140806-1
changelog:
  * Release 20160718-20140806-1
  	This version is based on the source code of 20140806 but is numbered so that 
  	it becomes the default version. The base-on-source is part of the release number.
  	-python packages renamed to -python2


author: Lawrence R. Rogers <lrr@cert.org> 20160718-20140806-3
changelog:
  * Release 20160718-20140806-3
  	Version 20160718-20140806-3: Uses python3_pkgversion for the current version of Python 3.


author: Lawrence R. Rogers <lrr@cert.org> 20181128-4
changelog:
  * Release 20181128-4
  	Version 20181128-4: Uses python3_pkgversion for the current version of Python 3.


author: Lawrence R. Rogers <lrr@cert.org> 1.7.0-1
changelog:
  * Release 1.7.0-1
  	Update IPFIX Information Elements to be compatible with IANA registry
  	Add recursive freeing function fBufListFree() to free structured data elements
  	Ignore extra filling bytes in sFlow records
  	Bug Fix for NetFlow v9 Options Template Parsing
  	Other Bug Fixes


author: Lawrence R. Rogers <lrr@cert.org> 1.8.0-1
changelog:
  * Release 1.8.0-1
  	The ability to add template metadata to exported templates
  	Macro to check fixbuf version number
  	Minor bug fixes


author: Lawrence R. Rogers <lrr@cert.org> 2.0.0-1
changelog:
  * Release 2.0.0-1
  	This version is not backwards-compatible with fixbuf 1.x.
  	There are no functional differences between this release and the 1.8 release. All the changes are API changes and internal cleanups.
  	Change source for infomodel to the IANA XML version of the IPFIX Information Elements.
  	Require information element specifications for internal records to have non-defaulted (non-zero) sizes.
  	Simplify new template callbacks, subsuming the three variants with one: fbSessionAddNewTemplateCallback().
  	The default is now to consider the source port when separating incoming UDP streams. The function fbCollectorManageUDPStreamByPort() has been removed.
  	Change fbInfoElementWriteOptionsRecord() to take both the internal and external template id.
  	Update to LGPL 3.


author: Lawrence R. Rogers <lrr@cert.org> 2.1.0-1
changelog:
  * Release 2.1.0-1
  	Add functions to update the Information Model with Information Elements read from a file or a string containing XML data
  	Set an element's endian flag when incorporating elements from options records
  	GLib 2.18 or later is now required


author: Lawrence R. Rogers <lrr@cert.org> 2.2.0-1
changelog:
  * Release 2.2.0-1
  	Add functions to return buffer size required to read a template and maximum buffer size to process all known templates in a session.
  	Return an error when a user attempts to use a reserved template ID.
  	Fix a potential use-after-free bug triggered by pyfixbuf.


author: Lawrence R. Rogers <lrr@cert.org> 2.3.0-1
changelog:
  * Release 2.3.0-1
  	Added the ipfixDump application which used to be included with YAF, and made many changes to the application.
  	  Use configure --disable-tools to prevent building and installing ipfixDump.
  	Fixed bugs in reading and writing information elements whose type was list and elementId was a value other than 291, 292, or 293.
  	Information element type information and exporting template metadata.


author: Lawrence R. Rogers <lrr@cert.org> 2.3.1-1
changelog:
  * Release 2.3.1-1
  	Fixed a double-freeing of memory and memory leaks in some of the error handling code.


author: Lawrence R. Rogers <lrr@cert.org> 2.4.0-1
changelog:
  * Release 2.4.0-1
  	Enhanced the output of ipfixDump by
  		(1) including the template's name with its list of elements
  		(2) adding the templates' names to the stats output
  		(3) marking scope elements in templates and their corresponding values in data records, and
  		(4) including the name for list semantics.
  	Fixed an issue in the libfixbuf.spec.in file, and removed the generated libfixbuf.spec file from the distribution.
  	Changed how the information model handles the re-insertion an existing element to reuse the existing element instead of using new memory.
  	Added stricter checking of the elements lengths' specified in a template.
  	  Currently a log message is written for an invalid length; in the future, this may cause the template to be rejected.


author: Lawrence R. Rogers <lrr@cert.org> 20190510-2
changelog:
  * Release 20190510-2
  	Version 20190510-2: Uses python3_pkgversion for the current version of Python 3.


author: Lawrence R. Rogers <lrr@cert.org> 20190115-2
changelog:
  * Release 20190115-2
          Release 2 - Rebuilt for Python 3.6 for CentOS/RHEL 7.
  		    -python packages renamed to -python2.
  		    Removed conflicts when that arise when python2 and python 3
  			versions are attempted to be installed on a system.


author: Lawrence R. Rogers <lrr@cert.org> 20181101-3
changelog:
  * Release 20181101-3
  	Release 3 - Removed conflicts when that arise when python2 and python 3
  		    versions are attempted to be installed on a system.
  		    -python packages renamed to -python2


author: Lawrence R. Rogers <lrr@cert.org> 20150222-1
changelog:
  * Release 20150222-1
  	20150222
  	* Code clean up
  	* Worked on documenation
  	* Changes for handling 0x001a metadata with different plist key sequence

  	20150106
  	* 2015 update

  	20141226
  	* changes for updated dependencies

  	20141130
  	* code clean up

  	20141120
  	* code clean up

  	20141018
  	* removed README.macosx

  	20141017
  	* changes for deployment


author: Lawrence R. Rogers <lrr@cert.org> 20151013-1
changelog:
  * Release 20151013-1
  	20151018
  	* worked on format support

  	20151017
  	* worked on Python bindings

  	20151013
  	* worked on format support

  	20151013
  	* worked on XML plist

  	20151012
  	* worked on XML plist

  	20151011
  	* worked on format support

  	20150926
  	* added ps1 scripts

  	20150720
  	* worked on signature check


author: Lawrence R. Rogers <lrr@cert.org> 20190104-4
changelog:
  * Release 20190104-4
  	Version 20190104-4: Uses python3_pkgversion for the current version of Python 3.


author: Lawrence R. Rogers <lrr@cert.org> 20181227-4
changelog:
  * Release 20181227-4
  	Version 20181227-4: Uses python3_pkgversion for the current version of Python 3.


author: Lawrence R. Rogers <lrr@cert.org> 1.1.0beta1-0
changelog:
  * Release 1.1.0beta1-0
  	libguytools1 (1.1.0beta1-0) unstable; urgency=low
  	  * Preventing from repetitive messages if log file can't be opened
  	  * Debian packaging checked and corrected (again and again)
  	  * Using fopen64 for the log file, so that it may grow above any old limits
  	  * Build scripts made more portable (thanks to GIDA)
  	  * Debianisation changes by Mika
  	 -- Guy Voncken <vogu00@gmail.com>  Tue, 18 Aug 2009 11:00:00 +0200


  libguytools1 (1.0.3) unstable; urgency=low
    * Debian packaging checked and corrected
   -- Guy Voncken <vogu00@gmail.com>  Wed, 08 Apr 2008 17:00:00 +0200


  libguytools1 (1.0.2) unstable; urgency=low
    * Support for amd64 architecture
   -- Guy Voncken <vogu00@gmail.com>  Wed, 16 Nov 2007 09:00:00 +0200


  libguytools1 (1.0.1) unstable; urgency=low
    * Const type cleaned up.
   -- Guy Voncken <vogu00@gmail.com>  Wed, 06 Jun 2007 16:25:08 +0200


  libguytools1 (1.0.0) unstable; urgency=low
    * Initial release.
   -- Guy Voncken <vogu00@gmail.com>  Wed, 06 Jun 2007 16:25:08 +0200


author: Lawrence R. Rogers <lrr@cert.org> 2.0.0beta1-1
changelog:
  * Release 2.0.0beta1-1
  	libguytools2 (2.0.0beta1-1) unstable; urgency=low
  	  * Putting everything into only one lib
  	  * Some small changes for compilation under Ubuntu 10.04
  	 -- Guy Voncken <vogu00@gmail.com>  Fri, 02 Aug 2010 17:00:00 +0200


author: Lawrence R. Rogers <lrr@cert.org> 2.0.1-1
changelog:
  * Release 2.0.1-1
  	libguytools2 (2.0.1-1) unstable; urgency=low
  	  * Trunk released
  	 -- Guy Voncken <vogu00@gmail.com>  Tue, 04 Aug 2010 11:30:00 +0200


author: Lawrence R. Rogers <lrr@cert.org> 2.0.2-1
changelog:
  * Release 2.0.2-1
  	libguytools2 (2.0.2-1) unstable; urgency=low
  	  * Correctly handling decimal point for different locale settings in toolcfg
  	  * Some small signed/unsigned changes for cleaner linting
  	  * Copyright notices cleaned up
  	 -- Guy Voncken <vogu00@gmail.com>  Tue, 17 Jul 2012 10:00:00 +0200


author: Lawrence R. Rogers <lrr@cert.org> 2.0.3-1
changelog:
  * Release 2.0.3-1
  	libguytools2 (2.0.3-1) unstable; urgency=low
  	  * Corrected problem with trailing backslashes
  	  * Switched to my new developer email address (Guy Voncken <develop@faert.net>)


author: Lawrence R. Rogers <lrr@cert.org> 2.0.4-1
changelog:
  * Release 2.0.4-1
  	libguytools2 (2.0.4-1) unstable; urgency=low
  	  * Removed arch specific code in toolsignal.cpp
  	 -- Guy Voncken <develop@faert.net>  Thu, 13 Jul 2015 16:00:00 +0200


author: Lawrence R. Rogers <lrr@cert.org> 2.0.5-1
changelog:
  * Release 2.0.5-1
  	libguytools2 (2.0.5-1) unstable; urgency=low
  	  * Moved to Qt5
  	  * Adapted to Debian 8 (Jessie)
  	 -- Guy Voncken <develop@faert.net>  Tue, 18 Jul 2017 12:00:00 +0200


author: Lawrence R. Rogers <lrr@cert.org> 1.14-2
changelog:
  * Release 1.14-2
  	Now creates the needed /etc/ld.so.conf.d/libiconv-%arch.conf file
  	Also creates a link from lib to lib64 on x86_64 architectures

  	Revision 1.14  2008/04/08 08:24:53  glen
  	- unify ftp.gnu.org urls

  	Revision 1.13  2007-11-30 21:14:54  qboosh
  	- libiconv is on LGPL v2+, but iconv utility is GPL v3+ now

  	Revision 1.12  2007-11-30 20:26:16  qboosh
  	- up to 1.12
  	- updated pl.po-update patch

  	Revision 1.11  2007-02-13 06:46:51  glen
  	- tabs in preamble

  	Revision 1.10  2007/02/12 00:49:02  baggins
  	- converted to UTF-8

  	Revision 1.9  2006/07/22 07:46:57  qboosh
  	- updated to 1.11, updated pl.po-update patch

  	Revision 1.8  2005/08/15 00:00:52  qboosh
  	- updated to 1.10, added pl.po-update patch

  	Revision 1.7  2004/09/01 16:11:10  adamg
  	- kill pld.org.pl leftovers

  	Revision 1.6  2004/03/14 23:12:48  qboosh
  	- added iconv.h to -devel (yes, C: glibc-devel - but it doesn't make sense with glibc)
  	- strict internal deps

  	Revision 1.5  2004/02/14 21:47:01  undefine
  	- copy config.sub. mayby it help on amd64.. mayby not... who know?
  	- release 2

  	Revision 1.4  2004/01/27 21:01:50  qboosh
  	- 1.9.2

  	Revision 1.3  2003/10/08 21:41:20  qboosh
  	- 1.9.1, added pl description, removed obsolete DESTDIR patch

  	Revision 1.2  2003/09/10 16:30:49  gotar
  	- md5

  	Revision 1.1  2003/09/10 16:26:07  gotar
  	- just in case


author: Lawrence R. Rogers <lrr@cert.org> 1.14-3
changelog:
  - only packages /usr/libiconv/lib for x86_64 architectures.
    This packaging error caused duplication of files in the libiconv and libiconv-devel packages


author: Lawrence R. Rogers <lrr@cert.org> 1.14-3
changelog:
  New in 1.15:
  	* The UTF-8 converter now rejects surrogates and out-of-range code points.
  	* Added ISO-2022-JP-MS converter.
  	* Updated the CP1255 converter to map one more character.
  	* The functions now support strings longer than 2 GB.


author: Lawrence R. Rogers <lrr@cert.org> 20181227-3
changelog:
  * Release 20181227-3
  	Release 3 - Removed conflicts when that arise when python2 and python3
  		    versions are attempted to be installed on a system.


author: Lawrence R. Rogers <lrr@cert.org> 20180514-2
changelog:
  * Release 20180514-2
          Release 2 - Rebuilt for Python 3.6 for CentOS/RHEL 7
  		    -python package renamed -python2


author: Lawrence R. Rogers <lrr@cert.org> 20181101-2
changelog:
  * Release 20181101-2
          Release 2 - Rebuilt for Python 3.6 for CentOS/RHEL 7
  		    -python package renamed -python2


author: Lawrence R. Rogers <lrr@cert.org> 20181231-3
changelog:
  * Release 20181231-3
  	Release 3 - Removed conflicts when that arise when python2 and python3
  		    versions are attempted to be installed on a system.


author: Lawrence R. Rogers <lrr@cert.org> 20181231-4
changelog:
  * Release 20181231-4
  	Version 20181231-4: Uses python3_pkgversion for the current version of Python 3.


author: Joachim Metz <joachim.metz@gmail.com> 20131028-1
changelog:
  * Release 20131028-1
  	20131018
  	* worked on compressed OST support
  	  - local descriptors 

  	20131014
  	* worked on compressed OST support
  	  - local descriptors 

  	20131013
  	* worked on python bindings
  	* worked on compressed OST support
  	  - local descriptors 
  	* updated dependencies

  	20130929
  	* worked on setup.py, largely for MSI builds
  	* worked on compressed OST support
  	  - local descriptors 
  	* code clean up
  	* update msvscpp files

  	20130922
  	* code clean up
  	* worked on compressed OST support
  	  - local descriptors 

  	20130915
  	* worked on compressed OST support
  	  - local descriptors 

  	20130902
  	* worked on compressed OST support
  	  - local descriptors 

  	20130901
  	* added libcthreads build support

  	20130831
  	* worked tests

  	20130817
  	* refactored local descriptors
  	* worked on compressed OST support
  	  - local descriptors 

  	20130812
  	* worked on compressed OST support
  	  - local descriptors 

  	20130807
  	* worked on compressed OST support
  	  - table reference

  	20130806
  	* worked on compressed OST support
  	  - data array
  	  - table reference

  	20130805
  	* worked on recovery in compressed OST files

  	20130804
  	* updated dependencies
  	* worked on record entry values array number out of bounds issue
  	* refactored table index values to use libcdata array
  	* fixed invalid return code in error path
  	* worked on recovery in compressed OST files

  	20130731
  	* worked on fixing out of bounds read of name to id map string in an error
  	  toloreant way
  	* Added is corrupted function

  	20130730
  	* worked on name to id map string out of bounds issue
  	* worked on record entry values array number out of bounds issue

  	20130728
  	* Worked on 64-bit 4k pages support
  	* Worked on item recovery

  	20130722
  	* Worked on compressed OST support

  	20130721
  	* worked on major refactor
  	* updated msvscpp files
  	* worked on pypff

  	20130720
  	* worked on major refactor
  	* worked on pypff

  	20130719
  	* worked on major refactor

  	20130718
  	* worked on major refactor

  	20130713
  	* worked on major refactor
  	* worked on tests
  	* fix for handling floating point values in item file

  	20130718
  	* worked on major refactor

  	20130716
  	* worked on major refactor

  	20130714
  	* worked on major refactor

  	20130712
  	* worked on major refactor

  	20130704
  	* worked on major refactor

  	20130625
  	* worked on major refactor

  	20130620
  	* worked on major refactor

  	20130619
  	* worked on major refactor

  	20130618
  	* worked on major refactor

  	20130617
  	* worked on major refactor

  	20130616
  	* worked on major refactor

  	20130609
  	* updated dependencies

  	20130514
  	* updated dependencies

  	20130413
  	* updated dependencies

  	20130326
  	* worked on API by_utf8_name and by_utf16_name functions
  	* worked on libcdata rewrite

  	20130325
  	* worked on API by_utf8_name and by_utf16_name functions

  	20130224
  	* worked on compresses OST support
  	* worked on libfdata update

  	20130223
  	* worked on 64-bit 4k page file format support
  	* worked on compresses OST support
  	* code clean up
  	* bug fixes in error path
  	* improved debug output

  	20130220
  	* pffexport:
  	  - worked on IPM.DistList support
  	* changes to spec file

  	20130203
  	* libpff
  	  - fixes in error code paths
  	* libfmapi
  	  - improved debug output
  	  - fixes in error code paths

  	20130202
  	* pffexport:
  	  - added message flags
  	  - improved output of flag types
  	  - worked on IPM.DistList support
  	* tests:
  	  - added pffinfo test
  	* libfmapi
  	  - improved debug output
  	* updated macosx files

  	20130114
  	* 2013 update
  	* updated dependencies

  	20120113
  	* removed contrib in favor of sed conversion scripts

  	20121123
  	* pypff: code clean

  	20121108
  	* worked on libcdata integration
  	* code clean up

  	20121107
  	* worked on libcdata integration
  	* code clean up

  	20121105
  	* worked on libcdata integration

  	20121104
  	* updated dependencies
  	* pypff: bug fixes
  	* worked on libcdata integration

  	20120808
  	* renamed crc32 to checksum in libfmapi
  	* code clean up


author: Lawrence R. Rogers <lrr@cert.org> 20180714-3
changelog:
  * Release 20180714-3
  	Release 3 - Removed conflicts when that arise when python2 and python3
  		    versions are attempted to be installed on a system.
  		   Also, -python packages renamed to -python2.


author: Lawrence R. Rogers <lrr@cert.org> - 0.6.60-1.1
changelog:
  * Release 0.6.60-1.1
  	Patch from Dominique Leuenberger to add AC_USE_SYSTEM_EXTENSIONS
  	Add readpst -a option for attachment stripping


author: Lawrence R. Rogers <lrr@cert.org> - 0.6.63-1.1
changelog:
  * Release 0.6.63-1.1
  	Daniel Gryniewicz found buffer overrun in LIST_COPY_TIME
  	Old dependency filter breaks file coloring


author: Lawrence R. Rogers <lrr@cert.org> - 0.6.66-1.1
changelog:
  * Release 0.6.66-1.1
  	LibPST 0.6.66 (2015-12-21)
  	===============================
  	    * Igor Stroh  - Added Content-ID header support

  	LibPST 0.6.65 (2015-09-11)
  	===============================
  	    * Jeffrey Morlan - fix multiple Content-Type headers
  	    * Hans Liss - debug level output

  	LibPST 0.6.64 (2015-03-09)
  	===============================
  	    * AJ Shankar fixes for attachment processing and body
  	      encodings that contain embedded null chars


author: Lawrence R. Rogers <lrr@cert.org> - 0.6.68-1.1
changelog:
  * Release 0.6.68-1.1
  	LibPST 0.6.68 (2016-08-29)
  	===============================
      	    * allow folders containing multiple item types, e.g. email and calendar
      	    * better detection of valid internet headers


author: Lawrence R. Rogers <lrr@cert.org> - 0.6.69-1.1
changelog:
  * Release 0.6.69-1.1
  	LibPST 0.6.69 (2016-10-29)
  	===============================
  	    * fix bugs in code allowing folders containing multiple item types


author: Lawrence R. Rogers <lrr@cert.org> - 0.6.70-1.1
changelog:
  * Release 0.6.70-1.1
  	LibPST 0.6.70 (2017-02-08)
  	===============================
  	    * Jeffrey Morlan - pst_getID2 must not recurse into children


author: Lawrence R. Rogers <lrr@cert.org> - 0.6.71-1.1
changelog:
  * Release 0.6.71-1.1
  	LibPST 0.6.71 (2017-07-21)
  	===============================
  	    * Zachary Travis - Add support for the OST 2013 format, and
  	      Content-Disposition filename key fix for outlook compatibility


author: Lawrence R. Rogers <lrr@cert.org> 20190103-4
changelog:
  * Release 20190103-4
  	Version 20190103-4: Uses python3_pkgversion for the current version of Python 3.


author: Lawrence R. Rogers <lrr@cert.org> 20190315-3
changelog:
  * Release 20190315-3
  	Version 20190315-3: Uses python3_pkgversion for the current version of Python 3.


author: Lawrence R. Rogers <lrr@cert.org> 20190127-3
changelog:
  * Release 20190127-3
  	Release 3 - Removed conflicts when that arise when python2 and python3
  		    versions are attempted to be installed on a system.


author: Lawrence R. Rogers <lrr@cert.org> 20190323-3
changelog:
  * Release 20190323-3
  	Version 20190323-3: Uses python3_pkgversion for the current version of Python 3.


author: Lawrence R. Rogers <lrr@cert.org> 20181203-4
changelog:
  * Release 20181203-4
  	Version 20181203-4: Uses python3_pkgversion for the current version of Python 3.


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-6
changelog:
  * Release 1.1.r17-6
  	Updated
  		* disk.c - added O_SYNC for output files
  		* main.c - bug fix
  		* tcp.c - support for 5.8 kernels


author: Lawrence R. Rogers <lrr@cert.org> 1.9.1-7
changelog:
  * Release 1.9.1-7
  	Changed version to match LiME web site version
  	Updated
  		* disk.c - Fixed to remove get_fs/set_fs in kernel 5.10 and beyond 
  		* tcp.c  - Fixed to remove get_fs/set_fs in kernel 5.10 and beyond


author: Lawrence R. Rogers <lrr@cert.org> 1.6-11
changelog:
  * Release 1.6-11
          Kernel modules were added for the following kernels:
                  2.6.18-406


author: Lawrence R. Rogers <lrr@cert.org> 1.6-12
changelog:
  * Release 1.6-12
          Kernel modules were added for the following kernels:
                  2.6.18-407


author: Lawrence R. Rogers <lrr@cert.org> 1.6-13
changelog:
  * Release 1.6-13
          Kernel modules were added for the following kernels:
  		2.6.18-409
  		2.6.18-408


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-60
changelog:
  * Release 1.1.r17-60
  	Kernel modules were added for the following kernels:
  		2.6.32-754.24.3
  		2.6.32-754.24.2


author: Lawrence R. Rogers <lrr@cert.org> 1.9.1-26
changelog:
  * Release 1.9.1-26
  	Kernel modules were added for the following kernels:
  		4.18.0-305.19.1
  		4.18.0-305.17.1


author: Lawrence R. Rogers <lrr@cert.org> 1.9.1-8
changelog:
  * Release 1.9.1-8
          Kernel modules were added for the following kernels:
  		5.14.0-115
  		5.14.0-118
  		5.14.0-119
  		5.14.0-120
  		5.14.0-124


author: Lawrence R. Rogers <lrr@cert.org> 1.9.1-9
changelog:
  * Release 1.9.1-9
          Kernel modules were added for the following kernels:
  		5.14.0-127
  		5.14.0-130


author: Lawrence R. Rogers <lrr@cert.org> 1.9.1-12
changelog:
  * Release 1.9.1-12
          Kernel modules were added for the following kernels:
  		5.14.0-145
  		5.14.0-148


author: Lawrence R. Rogers <lrr@cert.org> 1.9.1-14
changelog:
  * Release 1.9.1-14
          Kernel modules were added for the following kernels:
  		5.14.0-162
  		5.14.0-163
  		5.14.0-165


author: 2014 Lawrence R. Rogers <lrr@cert.org> 1.1.r17-1
changelog:
  * Release 1.1.r17-1
  	Kernel modules are available for the following kernels:
  		3.3.4-5    3.3.7-1    3.4.0-1    3.4.2-4    3.4.3-1    3.4.4-3
  		3.4.4-5    3.4.5-2    3.4.6-2    3.5.0-2    3.5.1-1    3.5.2-1
  		3.5.2-3    3.5.3-1    3.5.4-1    3.5.4-2    3.5.5-2    3.5.6-1
  		3.6.1-1    3.6.2-4    3.6.3-1    3.6.5-1    3.6.6-1    3.6.7-4
  		3.6.8-2    3.6.9-2    3.6.10-2   3.6.11-1   3.6.11-5   3.7.3-101
  		3.7.6-102  3.7.9-101  3.7.9-104  3.8.3-103  3.8.4-102  3.8.8-100
  		3.8.11-100 3.8.12-100 3.8.13-100 3.9.8-100  3.9.10-100


author: 2014 Lawrence R. Rogers <lrr@cert.org> 1.1.r17-1
changelog:
  * Release 1.1.r17-1
  	Kernel modules are available for the following kernels:
  		3.6.10-4     3.7.4-204   3.7.5-201   3.7.6-201   3.7.7-201
  		3.7.8-202    3.7.9-201   3.7.9-205   3.8.1-201   3.8.2-206
  		3.8.3-201    3.8.3-203   3.8.4-202   3.8.5-201   3.8.6-203
  		3.8.7-201    3.8.8-202   3.8.8-203   3.8.9-200   3.8.11-200
  		3.9.2-200    3.9.4-200   3.9.5-201   3.9.6-200   3.9.9-201
  		3.9.10-200   3.9.11-200  3.10.4-100  3.10.6-100  3.10.7-100
  		3.10.9-100   3.10.10-100 3.10.11-100 3.10.12-100 3.10.13-101
  		3.10.14-100  3.11.4-101  3.11.7-100  3.11.9-100  3.11.10-100


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-27
changelog:
  * Release 1.1.r17-27
  	Initial release. Kernel modules were added for the following kernels:
  		4.7.4-100


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-28
changelog:
  * Release 1.1.r17-28
  	Initial release. Kernel modules were added for the following kernels:
  		4.7.5-100


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-29
changelog:
  * Release 1.1.r17-29
  	Initial release. Kernel modules were added for the following kernels:
  		4.7.6-100


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-30
changelog:
  * Release 1.1.r17-30
  	Initial release. Kernel modules were added for the following kernels:
  		4.7.7-100


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-31
changelog:
  * Release 1.1.r17-31
  	Initial release. Kernel modules were added for the following kernels:
  		4.7.8-100
  		4.7.9-100


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-32
changelog:
  * Release 1.1.r17-32
  	Initial release. Kernel modules were added for the following kernels:
  		4.7.10-100


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-33
changelog:
  * Release 1.1.r17-33
  	Initial release. Kernel modules were added for the following kernels:
  		4.8.10-100
  		4.8.8-100


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-34
changelog:
  * Release 1.1.r17-34
  	Initial release. Kernel modules were added for the following kernels:
  		4.8.11-100


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-35
changelog:
  * Release 1.1.r17-35
  	Initial release. Kernel modules were added for the following kernels:
  		4.8.12-100


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-36
changelog:
  * Release 1.1.r17-36
  	Initial release. Kernel modules were added for the following kernels:
  		4.8.13-100


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-40
changelog:
  * Release 1.1.r17-40
  	Kernel modules were added for the following kernels:
  		4.10.15-100
  		4.10.16-100


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-42
changelog:
  * Release 1.1.r17-42
  	Kernel modules were added for the following kernels:
  		4.11.5-100
  		4.11.4-100


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-44
changelog:
  * Release 1.1.r17-44
  	Kernel modules were added for the following kernels:
  		4.13.8-100
  		4.13.10-100


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-31
changelog:
  * Release 1.1.r17-31
  	Kernel modules were added for the following kernels:
  		4.15.10-200
  		4.15.9-200


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-34
changelog:
  * Release 1.1.r17-34
  	Kernel modules were added for the following kernels:
  		4.15.16-200
  		4.15.15-200


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-37
changelog:
  * Release 1.1.r17-37
  	Kernel modules were added for the following kernels:
  		4.18.10-100
  		4.18.9-100


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-37
changelog:
  * Release 1.1.r17-37
  	Kernel modules were added for the following kernels:
  		4.18.9-100
  		4.18.10-100


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-35
changelog:
  * Release 1.1.r17-35
  	Kernel modules were added for the following kernels:
  		4.20.17-100
  		4.20.16-100
  		4.20.15-100


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-40
changelog:
  * Release 1.1.r17-40
  	Kernel modules were added for the following kernels:
  		5.0.13-100
  		5.0.11-100


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-29
changelog:
  * Release 1.1.r17-29
  	Kernel modules were added for the following kernels:
  		5.1.20-200
  		5.1.18-200


author: Lawrence R. Rogers <lrr@cert.org> 1.9.1-37
changelog:
  * Release 1.9.1-37
  	Kernel modules were added for the following kernels:
  		5.10.21-100
  		5.10.20-100


author: Lawrence R. Rogers <lrr@cert.org> 1.9.1-40
changelog:
  * Release 1.9.1-40
  	Kernel modules were added for the following kernels:
  		5.11.11-100
  		5.11.10-100


author: Lawrence R. Rogers <lrr@cert.org> 1.9.1-41
changelog:
  * Release 1.9.1-41
  	Kernel modules were added for the following kernels:
  		5.11.13-100
  		5.11.12-100


author: Lawrence R. Rogers <lrr@cert.org> 1.9.1-42
changelog:
  * Release 1.9.1-42
  	Kernel modules were added for the following kernels:
  		5.11.15-100
  		5.11.14-100


author: Lawrence R. Rogers <lrr@cert.org> 1.9.1-45
changelog:
  * Release 1.9.1-45
  	Kernel modules were added for the following kernels:
  		5.11.19-100
  		5.11.18-100


author: Lawrence R. Rogers <lrr@cert.org> 1.9.1-46
changelog:
  * Release 1.9.1-46
  	Kernel modules were added for the following kernels:
  		5.11.22-100
  		5.11.21-100


author: Lawrence R. Rogers <lrr@cert.org> 1.9.1-39
changelog:
  * Release 1.9.1-39
  	Kernel modules were added for the following kernels:
  		5.13.15-100
  		5.13.14-100


author: Lawrence R. Rogers <lrr@cert.org> 1.9.1-40
changelog:
  * Release 1.9.1-40
  	Kernel modules were added for the following kernels:
  		5.13.19-100
  		5.13.16-100


author: Lawrence R. Rogers <lrr@cert.org> 1.9.1-43
changelog:
  * Release 1.9.1-43
  	Kernel modules were added for the following kernels:
  		5.14.12-100
  		5.14.11-100


author: Lawrence R. Rogers <lrr@cert.org> 1.9.1-45
changelog:
  * Release 1.9.1-45
  	Kernel modules were added for the following kernels:
  		5.14.16-101
  		5.14.15-100


author: Lawrence R. Rogers <lrr@cert.org> 1.9.1-46
changelog:
  * Release 1.9.1-46
  	Kernel modules were added for the following kernels:
  		5.14.18-100
  		5.14.17-101


author: Lawrence R. Rogers <lrr@cert.org> 1.9.1-34
changelog:
  * Release 1.9.1-34
  	Kernel modules were added for the following kernels:
  		5.18.16-100
  		5.18.15-100


author: Lawrence R. Rogers <lrr@cert.org> 1.9.1-41
changelog:
  * Release 1.9.1-41
  	Kernel modules were added for the following kernels:
  		5.19.11-100
  		5.19.10-100


author: Lawrence R. Rogers <lrr@cert.org> 1.9.1-10
changelog:
  * Release 1.9.1-10
  	Kernel modules were added for the following kernels:
  		5.18.16-200
  		5.18.15-200


author: Lawrence R. Rogers <lrr@cert.org> 1.9.1-17
changelog:
  * Release 1.9.1-17
  	Kernel modules were added for the following kernels:
  		5.19.11-200
  		5.19.10-200


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-26
changelog:
  Initial version. Here are the kernels supported by this version:

  	FC20
  	3.11.10-301	      3.12.5-302	    3.12.6-300		  3.12.7-300		3.12.8-300

  	FC19
  	3.9.5-301	      3.10.6-200	    3.11.1-200		  3.11.7-200		3.12.5-200
  	3.9.9-302	      3.10.7-200	    3.11.2-201		  3.11.8-200		3.12.6-200
  	3.10.3-300	      3.10.9-200	    3.11.3-201		  3.11.9-200		3.12.7-200
  	3.10.4-300	      3.10.10-200	    3.11.4-201		  3.11.10-200		3.12.8-200
  	3.10.5-201	      3.10.11-200	    3.11.6-200	                                3.12.9-201

  	FC18
  	3.6.10-4	      3.8.2-206		    3.8.11-200		  3.9.11-200		3.10.12-100
  	3.7.4-204	      3.8.3-201		    3.9.2-200		  3.10.4-100		3.10.13-101
  	3.7.5-201	      3.8.4-202		    3.9.4-200		  3.10.6-100		3.10.14-100
  	3.7.6-201	      3.8.5-201		    3.9.5-201		  3.10.7-100		3.11.4-101
  	3.7.7-201	      3.8.6-203		    3.9.6-200		  3.10.9-100		3.11.7-100
  	3.7.8-202	      3.8.7-201		    3.9.9-201		  3.10.10-100		3.11.9-100
  	3.7.9-201	      3.8.8-202		    3.9.10-200		  3.10.11-100		3.11.10-100
  	3.8.1-201	      3.8.9-200

  	FC17
  	3.3.4-5		      3.5.0-2		    3.6.1-1		  3.6.9-2		3.8.4-102
  	3.3.7-1		      3.5.1-1		    3.6.2-4		  3.6.10-2		3.8.8-100
  	3.4.0-1		      3.5.2-1		    3.6.3-1		  3.6.11-1		3.8.11-100
  	3.4.2-4		      3.5.3-1		    3.6.5-1		  3.7.3-101		3.8.12-100
  	3.4.3-1		      3.5.4-1		    3.6.6-1		  3.7.6-102		3.8.13-100
  	3.4.4-3		      3.5.5-2		    3.6.7-4		  3.7.9-101		3.9.8-100
  	3.4.5-2		      3.5.6-1		    3.6.8-2		  3.8.3-103		3.9.10-100
  	3.4.6-2

  	CentOS/RHEL 6
  	2.6.32-71	      2.6.32-71.29.1	    2.6.32-279		  2.6.32-358.18.1	2.6.32-431
  	2.6.32-71.14.1	      2.6.32-71.7.1	    2.6.32-358.0.1	  2.6.32-358.2.1	2.6.32-431.1.2.0.1
  	2.6.32-71.18.1	      2.6.32-131.0.15	    2.6.32-358.11.1	  2.6.32-358.23.2	2.6.32-431.3.1
  	2.6.32-71.24.1	      2.6.32-220	    2.6.32-358.14.1	  2.6.32-358.6.1

  	CentOS/RHEL 5
  	2.6.18-8	      2.6.18-164.10.1	    2.6.18-194.8.1	  2.6.18-274.7.1	2.6.18-348.12.1
  	2.6.18-8.1.10	      2.6.18-164.11.1	    2.6.18-238		  2.6.18-308		2.6.18-348.16.1
  	2.6.18-53	      2.6.18-164.15.1	    2.6.18-238.1.1	  2.6.18-308.1.1	2.6.18-348.18.1
  	2.6.18-53.1.13	      2.6.18-164.2.1	    2.6.18-238.12.1	  2.6.18-308.11.1	2.6.18-348.2.1
  	2.6.18-92	      2.6.18-164.6.1	    2.6.18-238.19.1	  2.6.18-308.13.1	2.6.18-348.3.1
  	2.6.18-92.1.10	      2.6.18-164.9.1	    2.6.18-238.5.1	  2.6.18-308.16.1	2.6.18-348.4.1
  	2.6.18-128	      2.6.18-194	    2.6.18-238.9.1	  2.6.18-308.20.1	2.6.18-348.6.1
  	2.6.18-128.1.10	      2.6.18-194.11.1	    2.6.18-274		  2.6.18-308.24.1	2.6.18-371
  	2.6.18-128.2.1	      2.6.18-194.17.1	    2.6.18-274.12.1	  2.6.18-308.4.1	2.6.18-371.1.2
  	2.6.18-128.4.1	      2.6.18-194.26.1	    2.6.18-274.17.1	  2.6.18-308.8.1	2.6.18-371.3.1
  	2.6.18-128.7.1	      2.6.18-194.3.1	    2.6.18-274.18.1	  2.6.18-348		2.6.18-371.4.1
  	2.6.18-164	      2.6.18-194.32.1	    2.6.18-274.3.1	  2.6.18-348.1.1


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-27
changelog:
  Added: 3.13.6-200	for FC20
  	Added: 3.13.5-202	for FC20
  	Added: 3.13.5-200	for FC20
  	Added: 3.13.4-200	for FC20
  	Added: 3.13.3-201	for FC20
  	Added: 3.12.10-300	for FC20
  	Added: 3.13.6-100	for FC19
  	Added: 3.13.5-103	for FC19
  	Added: 3.13.5-101	for FC19
  	Added: 3.12.11-201	for FC19
  	Added: 2.6.32-431.5.1	for EL6


author: Lawrence R. Rogers <lrr@cert.org> 1.1.r17-28
changelog:
  Added: 3.14.4-200	for FC20
  	Added: 3.14.3-200	for FC20
  	Added: 3.14.2-200	for FC20
  	Added: 3.13.9-200	for FC20
  	Added: 3.13.8-200	for FC20
  	Added: 3.13.7-200	for FC20
  	Added: 3.13.10-200	for FC20
  	Added: 3.14.4-100	for FC19
  	Added: 3.13.9-100	for FC19
  	Added: 3.13.7-100	for FC19
  	Added: 3.13.11-100	for FC19
  	Added: 2.6.32-431.17.1	for EL6
  	Added: 2.6.32-431.11.2	for EL6
  	Added: 2.6.18-371.8.1	for EL5
  	Added: 2.6.18-371.6.1	for EL5


author: Kristinn Gudjonsson <kristinn log2timeline.net> 0.60-1
changelog:
  * Release 0.60-1
  	- [Log2Timeline library] Created a new library that contains the main engine in log2timeline.  All the funcionality of the tool is moved to this library, 
   	  making the front-ends mostly there to process parameters sent to the tool.  Some core changes made to how the engine is handled, making it necessary to 
  	  update all the input modules.  The output module all had a constructor, however it was not used that much, so some changes were made to all output modules
  	  as well, to transfer some variables needed by some of the output modules.
  		- Small changes to the time zone settings.  Instead of using the short name for the timezone, the long name is used throughout the tool
  	- [log2timeline] Changed the front-end to be able to use the new engine.  Removed most of the functionality out of the tool into the new structure.
  	  With the changes to the engine more options have been added to log2timeline, including the possibility of guessing the format of a file (no need to specifically 
  	telling the front-end which module to use to parse the file, although it is possible).  Also possible to do recursive searches, making timescanner really unneeded. 
  	- [timescanner] Changed the front-end to be able to use the new engine.  It is basically the same tool now as log2timeline, however it will continue to use the same
  	  parameters as the older version of timescanner and default to recursive behaviour instead of a single file parsing as log2timeline does.
  	- [l2t_process] Changed the tool so that it removes duplicate entries from the timeline. Also print out few statistics in the end.
  		- It checks for suspicious entries indicating timestomping that fall outside the date range (that is entries that have only second precision in the MFT module)
  		- Now accepts a file containing keywords, to compare against.  The keyword file should contain a single keyword per line.  The keywords are then compared against
  	  	  every line that passes the date filter. Only lines that have a match against those keywords is printed out.
  		- changed parameters slightly, to match with those of the main tool (log2timeline)
  		- Added a simple scatter plot creation. Only applicaple if you are parsing the MFT. The scatter plot takes all files that are stored inside the windows/system32
  		  directory and plots the MFT numbers on X-axis and creation time (both $SI and $FN) on the Y-axis, to quickly spot outliers in the data set that might be indication
  		  of a malware.
  		- When the scatter plot is drawn a simple process is run to detect outliers in the dataset and print those
  	- [skype_sql INPUT] Added a new input module that parses the main.db, the SQLite database that belongs to Skype.  Basic module that parses only basic entries from the
  	  db, later versions will parse the database in more details.
  	- [PreProcessing] Added a pre-processing library.  Now it is possible to extract information gathered from the drive before the tool starts.
  	- [win_sysinfo PreProc] New module in the pre-processing library.  A simple library that extracts the hostname of the machine and prints the timezone information
  	  before 
  	- [user_browser PreProc] New module in the pre-processing library.  A simple library that goes through each user profile searching for the default browser of
  	  that particular user.  The information is both printed on screen and then used in the browser input modules (to indicate whether or not this is the default 
  	  browser of that particular user)
  	- [MFT input] New input module that parses the $MFT file (NTFS filesystem), ported from the tool analyzeMFT written by David Kovar
  	- [NTUSER input] Removed the userassist input module and replaced it with a NTUSER one (better name anyway).
  		- The module now contains a recursive scanner, where it begins checking if it can parse the key (has a special parsing capability for a partiular key, and
  		if not, it will print the key's name and LastWritten time (a la regtime).
  		- The module will then end by getting deleted entries (method gathered from deleted.pl, written by Jolanta Thomassen and distributed on the SIFT.
  	- [SOFTWARE input] New input module to extract timestamps from the SOFTWARE registry hive.
  	- [JP_NTFS_CHANGE] New input module that takes the output from the tool jp (NTFS Change Log), which is a CSV file
  	- [SYSTEM input] New input module to extract timestamps from the SYSTEM registry hive.
  	- [SECURE input] New input module to extract timestamps from the SECURITY registry hive.
  	- [SAM input] New input module to extract timestamps from the SAM registry hive, along with basic SAM parsing
  	- [bug reporting] Added a bug tracking system for the tool, available at bugs.log2timeline.net
  	- [xp_firewall INPUT] Fixed a minor bug in the tool where the seconds got omitted (loosing precision on the date)
  	- [CFTL output] Changed the output slightly, adding file name to the output for instance
  	- [SIMILE output] Changed the output slightly, adding file name to the output for instance
  	- [IIS input] The second parameter was not parsed properly, making the module only accurate to the minute, fixed that.
  	- [USERASSIST input] Added one more check in the verify function. There were reports of files that contain the magic value for a registry file, yet the reglibrary
            was unable to retrieve the root key, making the tool crash
  	- [TIME library] Fixed the output of the get_cur_time called by the recursive scanner to print the current time.  The problem was representation of the time, could
  	  be 23:1:42... not it is fixed so that it is 23:01:42
  	- [EVTX input] Made small changes to include a URL pointing to further information about the event, and events in general for Win 2008.
  		- Also fixed a small bug where the tool was unable to retrieve text content from an attribute
  		- Also added a small translation from AccessList codes to "human readable" form, for file auditing
  	- [CSV/TAB output] Changed both modules to use the short time zone name instead of the long one in the output.
  		- Removed tab characters from description/title to prevent text to spread over tabs in Excel
  	- [MACTIME output] Fixed a small issue when the source type is file
  	- [EVT input] Fixed the EVT module, it produced two timestamps per entry, even though both timestamps were the same, now it checks and only includes one
  	  if they are the same
  	- [TLN/TLNX output] Fixed a small issue when the source type is file
  	- [SQLITE output] Fixed a small issue when the source type is file
  	- [extra FOLDER] Created a small folder called extra that contains some extra scripts, such as a script to remove the log2timeline from the system
  	- [glog2timeline] Removed the glog2timeline GUI, at least for the time being. It has to be ported to the new engine, and until then it is removed.


author: Lawrence Rogers <lrr@cert.org> 0.61-1
changelog:
  * Release 0.61-1
  	Version 0.61
          - [log2timeline] Small changes to the version printing (now prints just the last portion of the path)
                  - Now the engine checks if the format field is set and omits it if its set (to facilitate input modules like CSV that define it)
                  - Changed the list modules, added the SAM database readout in the winxp and win7 list files.
                  - Created the winsrv list file
                  - Added the MFT module to all windows list files (just in case they use a driver that displays the $MFT file)
                  - Fixed an issue with the tool not accepting the described format of the offset variable (should be +- int with the appended hms (optional))
                  - Added a try/catch around get_time, http://bugs.log2timeline.net/show_bug.cgi?id=2
          - [L2T_CSV input] Added an input module that reads the CSV format of log2timeline (done to make it easier to convert CSV files into another format)
          - [extra/bash_completion] Added a bash_completion script, stored inside the extra/bash_completion.d directory (need to copy it manually in the first go)
                  - Can make it easier to complete the paramaters to the tool in *NIX
          - [l2t_process] Fixed some timezone settings, or more created some temporary solutions to bug http://bugs.log2timeline.net/show_bug.cgi?id=4
          - [SQLITE output] Changed the schema considerably, along other smaller changes to the SQLite output
          - [TIME library] Fixed a bug in ftk2date (http://bugs.log2timeline.net/show_bug.cgi?id=7) - timestamps without ms values are not properly parsed
          - [PREFETCH input] Slightly modified the debug information in the verification step
          - [MCAFEE input] Slight changes in output from the verification routine.
                  - Added newline skipping in verification subroutine (code donated anonymously)
          - [ALTIRIS input] New input module to parse the AeXAMInventory and AeXProcessList files from Altiris (donated anonymously)
          - [MCAFEEFIREHUP input] New input module to parse the McAfee FireEpo, FireSvc, FireTray, UpdateLog files (donated anonymously)
          - [MCAFEEHEEL input] New input module to parse the McAfee HIPS event.log (donated anonymously)
          - [SYMANTEC input] New input module to parse Symantec log files (donated anonymously)
          - [MCAFEEHS input] New input module to parse the McAfee HIPShield Log File (donated anonymously)
          - [ANALOG_CACHE input] New input module to parse the cache log produced by Analog (log parser), user contributed, written by Willi Ballenthin.
          - [FTK_DIRLISTING input] Bug fixed in the ftk_dirlist module, the actual file name was repeated in the output... http://bugs.log2timeline.net/show_bug.cgi?id=6
          - [SAFARI input] John Ritchie mad a small bug fix to the module, changing how the timestamp object got defined
          - [IE_HISTORY input] Fixed a bug in the module. time1 and time2 somehow got mixed up, reversed the order so that time1 is properly defined as the modification time,
          instead of being marked as the access time (and vice versa) - thanks to Jamison Bosco for notifying me
                  - Small fix, updated the module so that if both time1 and time2 are the same, to join them in a single time


author: Lawrence Rogers <lrr@cert.org> 0.62-1
changelog:
  * Release 0.62-1
  	Version 0.62 (23/11/2011)
  	- [FF_CACHE input] New input module, designed to parse the cache files of Firefox. Contributed by John Ritchie
  	- [OPENVPN input] New input module, desigend to parse the OpenVPN log files.
  	- [L2T_PROCESS] Added a few more allowed characters in the keyword list
  	- [proftpd_xferlog input] Willi Ballenthin added a new module to parse the ProFTPD XFerlog file
  	- [Log2Timeline library] Fixed a bug, when the 'all' moduiles option is used (or -f is omitted) no modules get loaded
  		-Added a small change to try to parse the MFT directly even though the $MFT might not be directly visible
  		-Fixed a small bug whereas the tool would crash if the local timezone was used.
  		-Fixed a small bug whereas the tool is not able to find the default directory (. does not exist) or if the file in 
  		question does not really exist that the tool is pointing to... that made the tool return a double error instead of 
  		just dying on the first one.
  		-The tool will now accept a separate output timezone so the tool can output in a different timezone than the hosts one.
  	- [log2timeline] Added the -Z ZONE parameter so the tool can output in a different timezone than the host timezone.
  	- [CSV output] Changed the output timezone so it now prints using the -Z definition, so it now supports different output
  	  timezone than the host one.
  	- [EVTX input] Fixed a bug in where the tool could go into a endless loop in the case where you have a EVTX that is 
  	  somehow broken and the function get_next_event dies. If the tool runs into such occurance it returned an empty
  	  timestamp object, that in turn let the tool query for it again, thus possibly getting into an endless loop.
  	  Added a counter so the tool tries to get the next event 50 times, otherwise it will die.
  	- [log2timeline-sift] Moved the mount command out of the script and into the configuration file 
  		- Changed the mount command, since there were few errors with the previous one
  		- Added an addional check to see if the $MFT file can be directly called (and if so, skip the icat call)


author: Lawrence Rogers <lrr@cert.org> 0.63-1
changelog:
  * Release 0.63-1
  	Version 0.63 (09/04/2012)
  	- ALL modules/files were run through perltidy using the configuration file of dev/perltidy.conf.
  	- Also several modules have had their documentation updated and code reformed to reflect recent release of a style guide
  	  for the project. perltidy is not enough to enforce that, but at least a start. Rewriting the documentation (pod) is also a vital
  	  portion of making the modules easier to use/understand/develop.
  	- All libraries within the tool and the main API have been rewritten with this in mind, making 'man' documentation considerably
  	  more useful than it was.
  	- [SERIALIZE output] JSON::XS used to serialize the timestamp output, a very simple output module that simply stores
  		- This makes it possible to output using this method and then sorting is simpler since it does not require the module
  		  to read in the csv and change it into something like a hash, since it is already stored as such.
  		- This might become the default output of the tool, and then run l2t_process on that output, turning that into CSV
  		  instead of using CSV as default and trying to filter that output.
  		- This also makes it easier to filter, based on certain attributes, instead of at the line level.
  		  the timestamp object without really doing anything to it. Use that for easy sorting in later stages.
  	- [WIN7 list] Fixed a small bug in Win7 list file (and win7_noreg). The evt module was loaded up and not the evtx one.
  	- [FIREFOX3 input] Added a check to see if the SQlite database contains a -wal or -shm (in addition to -journal)
  	  And if it does, then do the same procedure as if it was a -journal (read-only database that gets copied to a temp location)
  	  This was pointed to me by Svante
  	- [PREFETCH input] Changed the default output so that loaded DLLs are not included by default, unless the -d|--detail
  	  option/parameter is used.
  	- [MFT input] Inside the verification routine a check is made to see if the magic value is FILE0, it should only be FILE.
  	  Fixed that, making the mft module capable of parsing those $MFT files that do not the standard offset to the fixup array.
  	- [SAM input] Changed the handling of SAM database data, it did not properly parse the SAM database file in certain cases
  	  due to the keys being prefilled with the CMI-CREATE....
  	- [NTUSER input] Changed a value check in UserAssist key parsing causing UserAssist keys not properly being parsed.
  	- [WIN_LINK input] The values for mtime and atime got swapped (the correct order is CAM not CMA like it was)
  	- [SETUPAPI input] Added a 'detailed_time' check, to reduce the text inside the alert by default, unless detail option used.
  	- [log2timeline] Updated the man page to reflect updates to the 'detailed_time' changes to setupapi input module.
  	- [WIN library] Added a mapping to map up all Windows use of timezones to the one used in the DateTime library.
  	- [win_sysinfo PreProc] Updated the pre-processing library so that it checks if a known transform of a Windows named
  	  timezone information is available and if it is it will compare it to the chosen timezone (and change it if they differ).
  	- [LOG2TIMELINE] Small bug in the log2timeline library, causing input modules list that has more than one - sign in it
  	  not properly verified.
  	- [IEHISTORY input] Switched time1 and time2, and started to update the module so it adheres to the newly released, not
  	  yet complete, style guide.
  	- [EVTX input] Updated the EVTX library to the latest release, version 1.1.1 (written by Andreas Schuster)
  		- Also changed the 50 attempts to 15 (in case of an error in reading an entry), also only output error
  		  message if debug is turned on.


author: Lawrence Rogers <lrr@cert.org> 0.64-1
changelog:
  * Release 0.64-1
    - [TESTSUITE] Added the first version of a test suite to the tool.
        - All tests are located inside the t/ directory.
        - Tests should be constructed for ALL possible uses of the tool, not limited to:
            - Raw parsing of logs using input modules.
            - Correct output for output modules.
            - Correct output from each function inside modules/libraries.
        - The first TEST suite is raw and not nearly complete, needs loads of stuff to be 'proper' but it is a start.
    - [LS_QUARANTINE input] A new input module that parses the LSQuarantineEvents SQLite db in Mac OS X.
    - [Log2Timeline library] Added the possibility to use a dot (.) in the exclusion list.
        - Changed the exclusion list so it can be easily changed
        - Added a call to ->end on each input module if verification failed.
        - Minor bug fixes in the main engine.
        - Changed wording when an output module is loaded (from "Loading output file" to "Loading output module").
        - Added support to detect shortcuts in Windows systems.
        - Added the "path_orig" to all input modules (making it possible to "fix" paths).
    - [CHROME input] - Slight changes to the output based on the value of the typed_count variable, also updated the path
        to the code that describes the transition types.
    - [SKYPE input] Fixed the verification routine a bit, cleaned it up slightly and fixed a small bug that caused the tool
        not to include SKYPE data when recursive mode was set on.
        - Also fixed UTF-8 support, should properly display UTF-8 by now.
    - [PREFETCH input] Small changes to the verification module.
    - [WinReg] Fixed a small bug in the code that caused the deleted entries lookup sometimes to loop forever.
    - [SQLITE output] Changed the way the SQLite code is written considerably, pre-compiling statements to prevent them
        being compiled for each insert, using transactions instead of writing them constantly to the DB, and other minor tweaks
        to make the DB output faster than before (since it was increadibly slow before).
    - [CHROME input] Small bug to fix UTF-8 support.
    - [FIREFOX3 input] Small bug to fix UTF-8 support.
    - [PREFETCH input] Fixed a bug, added a seekdir so that prefetch information is contained within the timeline if recursive
        is turned on.
    - [RECYCLER input] Fixed a bug, added a seekdir so that recycler information is contained within the timeline if recursive
        is turned on.
    - [LIST files] Added few items into the Windows list files, as well as to create a Mac OS X one.
    - [MFT input] Fixed a bug with Unicode support.
    - [RECYCLER input] Fixed a small bug (issue 5) with the path not showing the correct path as indicated by -m TEXT
    - [SOL input] Fixed a small bug (issue 5) with the path not showing the correct path as indicated by -m TEXT
    - [EVTX input] Changed the dependencies to Parse::Evtx2 instead of Parse::Evtx (same library, changed the namespace).
      - Issue when Parse::Evtx was installed on SIFT, causing the tool to first load the library from Schuster, and not the
        slightly changed one distributed by the tool, causing the module to not work.


author: Lawrence Rogers <lrr@cert.org> 0.65-1
changelog:
  * Release 0.65-1
    - [UTMP input] New input module parsing utmp/wtmp files in Linux, written by Francesco Picasso.
    - [SELINUX input] New input module parsing SELinux audit files in Linux, written by Francesco Picasso.
    - [l2t_process] Renamed to l2t_process_old, being replaced by l2t_process.py from l2t-tools.
    - [EVTX Library] Fixed a small bug in the code, causing some EVTX file parsing to fail.
    - [Altiris input] Fixed a small bug when the date is malformed.
    - [Log2Timeline library] Fixed few bugs:
        - Small error in the format sort, caused oxml to sometimes be skipped in processing.
    - [GENERIC_LINUX input] Added a small extra eval sentence.
    - [LS_QUARANTINE] Fixed a minor bug in the get_time routine, if a database occurs it is caught by an eval sentence.
    - [TEST] Added few more tests.
    - [MOST INPUT MODULES] Changed the line:
            my $line = <$fh> or return undef;
        in most input modules.
    - [WIN library] Added few more transformations of Windows stored time zones into a "olson" ones understood by DateTime.
    - [CHROME input] Fixed a small unicode bug in the "File Downloaded" section.
    - [faersluskra2timalina] Added a new frontend to the tool, exact copy of log2timeline, except all parameters in Icelandic... kinda
    - [timescanner tool] Removed this frontend from the Makefile since it serves no purpose (as in no longer part of the automatic installation).


author: Andrei Lapshin - 2.0.0-0.4.beta9
changelog:
  - Update to new upstream version
  - Rename main executable to luajit
  - Remove BuildRoot tag and %clean section


author: <md5deep@jessekornblumn.com> 3.8-1
changelog:
  * Release 3.8-1
  	  New Features
  	      Added -f mode to get the list of input files froma file on the disk.
  	      Added 64-bit executables for Windows.
  	  Bug Fixes
  	      Fixed a cosmetic bug regarding the error messages for piecewise mode.


author: <md5deep@jessekornblumn.com> 3.9-1
changelog:
  * Release 3.9-1
  	  New Features
   
  	  Bug Fixes
  	      Fixed a critical bug in hashdeep regarding processing standard input
  	      Added -f mode to get the list of input files from


author: <md5deep@jessekornblumn.com> 3.9.1-1
changelog:
  * Release 3.9.1-1
  	New Features
  		Added -f mode to get the list of input files from a file on the disk.
  		Added 64-bit executables for Windows.
  	Bug Fixes
  		Fixed a critical bug regarding hashdeep's ability to compute correct hashes on standard input.
  		Fixed a cosmetic bug regarding the error messages for piecewise mode.
  		Fixed a cosmetic bugs regarding processing standard input in piecewise mode.
  		Fixed a bug regarding processing known hash files which have parenthesis in the filename.
  		Clarified documentation regarding multipliers in piecewise mode. They are IEC multipliers, or blocks of 1,024. Side note: also spelled 'multipliers' correctly.


author: <md5deep@jessekornblumn.com> 3.9.2-1
changelog:
  * Release 3.9.2-1
  	New Features
  		Added a warning message when running 32-bit versions of the programs on a 64-bit system.
  	Bug Fixes
  		Fixed a cosmetic bug in the hashdeep header.


author: <md5deep@jessekornblumn.com> 4.0.0-1
changelog:
  * Release 4.0.0-1
  	* New Features
  		Rewrote most of the program in C++.
  		Enabled multiprocessor support on all platforms.
  		Removed ten character limit on file size mode
  	* Bug Fixes
  		Too numerous to count!


author: <md5deep@jessekornblumn.com> 4.0.1-1
changelog:
  * Release 4.0.1-1
  	* Bug Fixes
  		Fixed hang on DFXML generation on Win32
  		Fixed incorrect hashes via stdin on Win32
  		Fixed "Too many open files" error on OS X
  		Doc files in Win32 have been corrected.


author: <md5deep@jessekornblumn.com> 4.1-1
changelog:
  * Release 4.1-1
  	New Features
  		Added expert mode option to parse Windows PE files
  	Bug Fixes
  		Fixed junction point handling on Win32


author: Lawrence Rogers <lrr@cert.org> 4.3-1
changelog:
  * Release 4.3-1
  	Bug Fixes
  		Fixed check for endian-ness, affecting hash generation on
  		big-endian platforms.

  		Fixed minor bugs related to OpenSolaris.


author: Lawrence Rogers <lrr@cert.org> 4.4-1
changelog:
  * Release 4.4-1
          * src/dig.cpp: Support deduplication reparse points, issue 307.
          * src/multihash.cpp (hash_context_obj::multihash_finalize): removed old code that was commented out.
          * src/dig.cpp: Fixed issue 301 re: removing double dots from path
          * Makefile.am: Removed sha3deep target
          * hashlist.cpp: Fixes problem with known files with commas in filename.
          * configure.ac: Added patch from dago to check for MAP_FILE
          * src/dig.cpp: Experimental change to parse single instance storage (SIS) junction points.
          * src/hashlist.cpp: Added experimental mode for case insensitive matching. Also changes in main.cpp, main.h, and display.cpp
          * src/Makefile.am: Added sha3deep
          * src/main.h: Added SHA3 defines
          * src/main.cpp: Added SHA3 code
          * src/common.h: Increased max size of context structure for SHA-3
          * man/hashdeep.1: Clarified Unicode statements
          * main.cpp: Converting break statements which fall through to consistent style.
          * main.cpp: Added checks in hashdeep against user errors on command line
          * dig.cpp: Adding specific message regarding SIS reparse points.
          * blake: Removed code which won't be used
          * configure.ac: Uncommented check for big endian systems.
          * src/threadpool.cpp: Renamed ERR function to avoid conflicts on SunOS and derivates.
          * man/md5deep.1, hashdeep.1: Typos


author: pth@suse.de
changelog:
  - Update to latest cvs version.
  - Remove the use of run_ldconfig
  - Mark help files as %doc
  - Remove duplicate requires
  - Clean up the code.


author: mhrusecky@suse.com
changelog:
  - migrated to the new upstream version 0.7
    https://github.com/brianb/mdbtools
  - no detailed changelog


author: Jesse Kornblum <research@jessekornblum.com>
changelog:
  * Fixed basic MZ check to work on little endian systems

  	* Removed fcntl.h from configuration

  	* Fixed typo in man page


author: Jesse Kornblum <research@jessekornblum.com>
changelog:
  * Increased buffer size to 8KB to prevent underreads

  	* Added allowed executable extensions:
  	  cpl, hxs, hxi, olb, rll, and tlb.


author: Jesse Kornblum <research@jessekornblum.com>
changelog:
  * Started conversion to allow Unicode filenames, not
  	  finished yet
  	
  	* Moved previous ChangeLog file to NEWS
  	
  	* Fixed potentially fatal error in main.c that called,
  	  ironically enough, fatal_error().

  	* Added counting of number of files processed for displaying
  	  current filename being processed


author: Jesse Kornblum <research@jessekornblum.com>
changelog:
  * Completed conversion to allow Unicode filenames.
  	  Copied a few more functions from the md5deep project.

  	* Checked code into Subversion repository

  	* Version bump to 0.9 in preparation for release

  	* Cast VERBOSE_DISPLAY_NUM to uint64_t in usage message to avoid
  	  crash on OS X.

  	* Added $Id: missidentify.spec,v 1.1 2011/03/04 17:43:17 repoman Exp $ tags to source code


author: Jesse Kornblum <research@jessekornblum.com>
changelog:
  * Fixed illegal filename error handling to use Unicode
  	  error display function.

  	* Updated packaging and README file
  	
  	* Version bump to 1.0


author: Lawrence R. Rogers <lrr@cert.org> 1.4.0.1-1
changelog:
  * Release 1.4.0.1-1
  	2014-03-21:
  		- improved support for eDonkey/eMule/Kademlia
  		- improved support for PPLive

  	2014-03-20:
  		- code optimizations
  		- consistency improvements
  		- added support for new applications: Pando Media Booster
  		- improved support for Steam
  		- added support for new web services: Wikipedia, MSN, Amazon, eBay, CNN

  	2014-03-19:
  		- added new protocols: FTP, code improvements

  	2014-03-17:
  		- added new protocols: SOCKSv4, SOCKSv5, RTMP


author: Lawrence R. Rogers <lrr@cert.org> 1.8-3
changelog:
  * Release 1.8-3
  	Fixed a dependency problem on CentOS/RHEL 6 x86_64 where pf_ring was installed
  	 and created a dependency problem when pfring-6.6.0 was installed.


author: Lawrence R. Rogers <lrr@cert.org> 1.3-1
changelog:
  * Release 1.3-1
  	* Switched to new common installation mechanism (based on distutils)
  	* Improved error handling in netsa.util.script
  	* Added new function netsa.script.get_temp_dir_pipe_name()
  	* Added timedelta support to netsa.data.times
  	* Added new netsa.util.compat to activity “compatibility features”


author: Lawrence R. Rogers <lrr@cert.org> 1.4-1
changelog:
  * Release 1.4-1
  	* NOTE: Version 1.4 of NetSA Python is the last version that
  	  will support Python 2.4.  Future major versions of NetSA Python
  	  will require Python 2.6 or greater.

  	* Added new netsa_silk module, which provides a bridge between
  	  netsa-python and PySiLK.  When PySiLK is available, it uses PySiLK
  	  to provide a fast C implementation of IP address and related
  	  functionality.  When PySiLK is not available, a pure Python
  	  implementation from netsa-python is used instead.

  	* Added new netsa.script.golem script automation framework, for
  	  building scripts to maintain large time-based data sets (among
  	  other things.)

  	* Added regex_help argument to netsa.script.add_text_param and
  	  add_label_param, to support providing a more useful error message
  	  when the regex doesn't match the input.

  	* Added heapq.merge and os.path.relpath to netsa.util.compat.

  	* Replaced all temporary file code with new functions in the
  	  netsa.files module, to avoid duplication of effort.  Similar
  	  functions in other locations have been deprecated and are now
  	  implemented using this version.

  	  Replaced PID locking code with new functions in the netsa.files
  	  module, to avoid duplication of effort.

  	* Improved netsa.data.nice's results, particularly for time ticks.

  	* Added a large number of new tests to improve compatibility testing
  	  for different versions of Python in the future.

  	* Moved the netsa.script.get_temp_dir... functions into netsa.files,
  	  with slight renaming.  The old functions are still available but
  	  deprecated.

  	* Deprecated netsa.files.DirLocker, netsa.files.LocalTmpDir, and
  	  netsa.tools.service.  See the new functions
  	  netsa.files.acquire_pidfile_lock, examine_pidfile_lock, and
  	  release_pidfile_lock.

  	* Deprecated netsa.files.datefiles.

  	* Added documentation for the netsa.dist module, even though it is
  	  primarily for internal use.

  	* Fixed bug involving SIGPIPE handling in netsa.util.shell.

  	* Fixed bug that prevented netsa.logging from importing correctly
  	  under Python 2.7.


author: Lawrence R. Rogers <lrr@cert.org> 1.4.1-1
changelog:
  * Release 1.4.1-1

  	* Fail-on-use dummy IPv6Addr added to netsa_silk, so that the symbol
  	  may still be imported even when IPv6 support is not provided.

  	* Minor bug fixes to prevent setup.py from requiring sphinx, and to
  	  improve documentation generation on projects with different needs.


author: Lawrence R. Rogers <lrr@cert.org> 1.4.2-1
changelog:
  * Release 1.4.2-1

  	* Fix problem where netsa.dist would not install manpages unless the
  	  distribution also had install_data.


author: Lawrence R. Rogers <lrr@cert.org> 1.4.3-1
changelog:
  * Release 1.4.3-1

  	* Added server-side cursor support to netsa.sql's psycopg2 driver, so that results are streamed back instead of fetched all together.
  	* Fixed an exception caused by using num_prefix on values <= 1e-21.
  	* Remove netsa_silk support version SiLK versions older than SiLK 3.
  	* Provide unnamed arguments to scripts via netsa.script.get_extra_args().
  	* Better support for finding non-standard Sphinx installs.


author: Lawrence R. Rogers <lrr@cert.org> 1.5-1
changelog:
  * Release 11.5-1.4.3-1
  	1.5
  	netsa-python no longer supports versions of Python prior to 2.6.
  	Removed functions and modules deprecated in netsa-python 1.4.
  	Bug fixes and improvements to netsa.script.golem.

  	1.4.4
  	Fixed error in netsa.script that caused a default for file params to be checked for before command-line arguments were handled.
  	Fixed default regex for label params in netsa.script.


author: Lawrence R. Rogers <lrr@cert.org> 1.3.2-1
changelog:
  * Release 1.3.3-1
  	* Add hilbert.h to distribution.
  	* Toolbox.new_tickset_from_tick_tuples now takes iterables as input.
  	* Additional/clarified documentation.
  	* Minor bugfixes.


author: Lawrence R. Rogers <lrr@cert.org> 1.4.0-1
changelog:
  * Release 1.4.0-1
  	New scale types: LinearBinnedScale and TimeBinnedScale
  	New marker type: Arrow
  	Pipevis web application distributed with Rayon. Pipevis visualizes the output of the NetSA Analysis Pipeline's Watchlist alerts and YAF's status messages.
  	Additional unit tests. Tests are installed in the rayon.test package.
  	Documentation improvements.
  	Bugfixes and stability enhancements.


author: Lawrence R. Rogers <lrr@cert.org> 1.4.0-2
changelog:
  * Release 1.4.0-2
    * rytools
      + New tool: =rytimeseries= - plot single or multiple time series in one of several styles.

      + New tool: =rymkhilbert-overlays= - create images from IP ranges (such as those output by SiLK prefix maps) that can be used as overlay images for =ryhilbert=.

      + New tool: =rypiechart= - draw pie charts.

      + All tools can now take their input from configuration files.

    * Datasets
      + Datasets can now take iterators as input.

      + The =len= function can now be used on a Dataset, returning the number of rows in the Dataset (identical to the =get_num_rows= method).

      + Dataset.partition can now partition data on a composite key.

      + Column objects containing the same data type may now be added to produce a third column containing the first column's data followed
        by the second. =ConstantColumn= and =MultiColumn= objects do not support this operation.

    * Scales
      + Add =LinearBinnedScale= and =TimeBinnedScale= to represent linearly-scaled numeric and time data in discrete bins. These scales
        are ranged scales, so they can be used in plots that take ranged scales, such as bar plots.

      + =LinearScale= now accepts only int or float data. Attempts to attach non-numeric data to =LinearScale= now fail when the attachment is made, not later when attempting to render the data.

    * Markers
      + Add the =Arrow= (nickname: =arrow=) marker. =Arrow= can be customized to generate an arrowhead with the correct direction,
        width, etc. =LeftArrow=, =RightArrow=, =UpArrow= or =DownArrow= (nicknames: =larrow=, =rarrow=, =uarrow=, =darrow=) may be used to
        quickly get arrows pointing in the obvious cardinal directions.

    * Tick specifications
      + Add =every(n)= specification. (i.e., "Place a tick every 10 units.")

    * Low-level drawing
      + It is now possible to draw shapes containing both lines and arcs. (Previously, only circles, lines and polygons consisting only of lines were possible.)

    * Better error handling
      + Certain errors will now be caught when the chart is created (i.e., where the error is introduced) and not when the chart is
        rendered. Additionally, both some chart building and rendering errors now have more context to help the user isolate the source of the bug.

    * Documentation
      + Man pages are now available on the website with the rest of the documentation.

      + Man pages have been revised.

    * Releases now available as RPMs. Tested on RHEL 6 and Centos 6.

    * Other
      + Numerous bugfixes and smaller improvements.

      + Several APIs have been deprecated in favor of newer ones. The older APIs will continue to work until Rayon 2.x.


author: Lawrence R. Rogers <lrr@cert.org> 1.4.1-1
changelog:
  * Release 1.4.1-1
  	+ Support for parsing and displaying IPv6 addresses.
  	+ Fix error causing rytimeseries to crash when no time tick marks were to be drawn.
  	+ Documentation cleanup.


author: Lawrence R. Rogers <lrr@cert.org> 1.4.3-1
changelog:
  * Release 1.4.3-1
  	Version 1.4.3
  	* All rytools now implement the --first-line-colnames switch. If the
  	  first line of input is column names without any other indication
  	  (e.g., the text output of SiLK tools), the tool will read the
  	  names and use them appropriately. (When using SiLK tools as
  	  input to rytools, the user must still strip the last delimiter
  	  using --no-final-delimiter or --delimited.)

  	* Bugfixes.


author: Lawrence R. Rogers <lrr@cert.org> 1.4.3-2
changelog:
  * Release 1.4.3-2
  	Now builds in a virtual environment so as to use a compatible version of sphinx for documentation.


author: Kamil Páral <kparal@redhat.com> - 2:2017.3.23-10
changelog:
  - add Recommends: ntfs-3g-system-compression. That allows people with
    Windows 10 to read system files.


author: Lawrence R. Rogers <lrr@cert.org> 0.2.71-1
changelog:
  fix configure.ac and add libblkid-dev check
  	fix xfs
  	merger btrfs to 3.14 and update makefile
  	try to merge btrfs 3.14.1
  	fix restore-to-raw option


author: Lawrence R. Rogers <lrr@cert.org> 0.2.71-3
changelog:
  * Release 0.2.71-3
  	New libntfs.so for Fedora 21
  	All others - recompiled to keep the revision in sync


author: Lawrence R. Rogers <lrr@cert.org> 0.2.71-4
changelog:
  * Release 0.2.71-4
  	New libntfs.so for CentOS 7 and 6 and Fedora 20.
  	All others - recompiled to keep the revision in sync


author: Lawrence R. Rogers <lrr@cert.org> 0.2.80-1
changelog:
  * Release 0.2.80-1
  	2015-07-21  Thomas Tsai  <thomas@nchc.org.tw>
  		fix calloc error

  	2015-07-20  Thomas Tsai  <thomas@nchc.org.tw>
  		test vmfs5 and ncursesw
  		set version to 0.2.80 and fix some warnnings
  	
  	2015-07-17  Thomas Tsai  <thomas@nchc.org.tw>
  		update vmfs5 and test double free issue
  		Merge branch 'release' of https://github.com/Thomas-Tsai/partclone into release
  		try to fix double free issus
  	
  	2015-07-01  Thomas Tsai  <thomas@nchc.org.tw>
  		fix rules
  		ready to release 0.2.79
  		patch from DimStar77 and fix  missing includes
  		fix vmfs
  	
  	2015-06-30  Thomas Tsai  <thomas@nchc.org.tw>
  		try to fix vmfs5
  	
  	2015-05-15  Thomas Tsai  <thomas@nchc.org.tw>
  		Merge branch 'release' of github.com:Thomas-Tsai/partclone into release
  		accept patch from Georges to fix a bug report from Debian, about missed builds for
  	
  	2015-04-09  Thomas Tsai  <thomas@nchc.org.tw>
  		ready to release 0.2.78
  		set version to 0.2.78
  		fix 16T partition issue
  	
  	2015-04-02  Thomas Tsai  <thomas@nchc.org.tw>
  		fix hiuge filesystem issue
  	
  	2015-03-25  Thomas Tsai  <thomas@nchc.org.tw>
  		update ChangeLog and version.h
  		release 0.2.77
  		remove some check that is duplicate and made error.
  	
  	2015-01-21  Thomas Tsai  <thomas@nchc.org.tw>
  		fix char related issue for bad sectors by Chris Clayton
  		Conflicts:
  			docs/partclone.imager.8
  			src/partclone.c
  			src/version.h
  	
  	2015-01-16  Thomas Tsai  <thomas@nchc.org.tw>
  		fix xfs and release(0.2.76) to test
  		 * fix xfs clone issue while set size to backup but bigger then device size and not stop
  	
  	2014-12-30  Thomas Tsai  <thomas@nchc.org.tw>
  		release 0.2.75
  	
  	2014-12-29  Thomas Tsai  <thomas@nchc.org.tw>
  		merge 0.2.74
  		test btrfs
  		add source of btrfs
  		update source of btrfs
  		try to fix btrfs
  	
  	2014-11-05  Thomas Tsai  <thomas@nchc.org.tw>
  		hide note: without note option
  		update version script
  		add --note option to fix issue #56 add fail-mbr/Makefile.am to pass prefix to new makefile which note from Fisiu (https://github.com/Thomas-Tsai/partclone/commit/cc5b6545bccd60f567d49944d7d9c36e0f4fc74b#commitcomment-8413428) fix issue #57 and use PKG_CHECK_MODULES to check version
  	
  	2014-09-04  Thomas Tsai  <thomas@nchc.org.tw>
  		test about exfat and f2fs
  	
  	2014-09-03  Thomas Tsai  <thomas@nchc.org.tw>
  		upgrade exfat to 1.1.0
  	
  	2014-09-02  Thomas Tsai  <thomas@nchc.org.tw>
  		initial f2fs support
  	
  	2014-08-28  Thomas Tsai  <thomas@nchc.org.tw>
  		update control
  	
  	2014-07-15  Thomas Tsai  <thomas@nchc.org.tw>
  		update version to 0.2.72
  	
  	2014-07-09  Thomas Tsai  <thomas@nchc.org.tw>
  		add package for debian jessie
  		add package for debian wheezy
  	
  	2014-07-08  Thomas Tsai  <thomas@nchc.org.tw>
  		fix configure.ac and add libblkid-dev check
  	
  	2014-07-07  Thomas Tsai  <thomas@nchc.org.tw>
  		fix xfs


author: Lawrence R. Rogers <lrr@cert.org> 0.2.88-1
changelog:
  * Release 0.2.88-1
  	2016-02-19  Thomas Tsai  <thomas@nchc.org.tw>
  		build 0.2.88
  		release 0.2.88
  		try to add reversed area manually
  	2016-02-03  Thomas Tsai  <thomas@nchc.org.tw>
  		update po
  	2016-02-02  Thomas Tsai  <thomas@nchc.org.tw>
  		try to fix signed block_size issue, the second advisory from David Gnedt
  	2016-01-13  Thomas Tsai  <thomas@nchc.org.tw>
  		fix bitmap issue
  	2016-01-12  Thomas Tsai  <thomas@nchc.org.tw>
  		try to fix fat issue
  	2016-01-05  Thomas Tsai  <thomas@nchc.org.tw>
  		receive report "Security Vulnerability in Partclone from David Gnedt."
  		and try to fix bitmap( set/clear/test bitmap out of boundary) overflow issue.
  	2015-12-24  Thomas Tsai  <thomas@nchc.org.tw>
  		release 0.2.87
  		0.2.87 release ready
  	2015-12-23  Thomas Tsai  <thomas@nchc.org.tw>
  		merge and fix dev-to-dev ntfs raw file create issue
  		fix ntfs raw restore issue
  	2015-11-12  Thomas Tsai  <thomas@nchc.org.tw>
  		Merge branch 'release' of github.com:Thomas-Tsai/partclone into release
  		update mnt string to partclone_nilfs_mnt
  		update nilfs to nilfs2 for all docs
  		release 0.2.86
  		release 0.2.86
  		update README to README.md in all debian/docs
  		release 0.2.86
  		release 0.2.86
  		release 0.2.86
  		add language zh_CN, and ready to release 0.2.86
  		Merge branch 'release' of github.com:Thomas-Tsai/partclone into release
  		fix fat cluster count
  	2015-11-09  Thomas Tsai  <thomas@nchc.org.tw>
  		add `
  		rename README.markdown README.md
  		remove ``
  	2015-11-09  Peter Dave Hello  <PeterDaveHello@users.noreply.github.com>
  		Create zh_CN.po
  		Update README.markdown
  		Update and rename README to README.markdown
  		Use markdown to be rich text!
  	2015-11-09  Thomas Tsai  <thomas@nchc.org.tw>
  		update nilfs mount and mkdir
  		Merge branch 'release' of github.com:Thomas-Tsai/partclone into release
  		update README
  	2015-11-05  Thomas Tsai  <thomas@nchc.org.tw>
  		release 0.2.85
  		update version to 0.2.85
  		Merge branch 'release' of github.com:Thomas-Tsai/partclone into release
  		fix fat16 clone issue and add test for fat12, fat16 and fat32
  	2015-10-13  Thomas Tsai  <thomas@nchc.org.tw>
  		release 0.2.84
  		update control files
  		update version
  		remove all version test in configure.ac
  		update version.h
  		update release script
  	2015-10-12  Thomas Tsai  <thomas@nchc.org.tw>
  		set version to 0.2.84 and add nilfs2 test
  	2015-10-06  Thomas Tsai  <thomas@nchc.org.tw>
  		add test for nilfs
  	2015-10-05  Thomas Tsai  <thomas@nchc.org.tw>
  		remove .deps
  		add nilfs support
  	2015-09-24  Thomas Tsai  <thomas@nchc.org.tw>
  		Merge branch 'release' of https://github.com/Thomas-Tsai/partclone into release
  		add xfs 4.2.0 part of source to partclone
  		update release
  		release 0.2.83
  		fix release
  		fix btrfs
  	2015-09-23  Thomas Tsai  <thomas@nchc.org.tw>
  		fix btrfs: disk bytenr larger than device size
  	2015-09-19  Thomas Tsai  <thomas@nchc.org.tw>
  		replace _row_ to _raw_ in all xml files
  	2015-08-31  Thomas Tsai  <thomas@nchc.org.tw>
  		update debian folder
  	2015-08-25  Thomas Tsai  <thomas@nchc.org.tw>
  		update release flow
  	2015-08-24  Thomas Tsai  <thomas@nchc.org.tw>
  		release 0.2.83
  		xfs: update bitmap calculating time
  		fix 4k and dirty bitmap issue for xfs
  	2015-08-23  Thomas Tsai  <thomas@nchc.org.tw>
  		update log_mesg
  	2015-08-20  Thomas Tsai  <thomas@nchc.org.tw>
  		update log message
  		fix 4k and dirty partiiton issue
  	2015-07-23  Thomas Tsai  <thomas@nchc.org.tw>
  		0.2.81
  	2015-07-23  ThomasTsai  <thomas@nchc.org.tw>
  		changs ncurses update


author: Lawrence R. Rogers <lrr@cert.org> 0.2.90-1
changelog:
  * Release 0.2.90-1
  	2017-03-24  Thomas Tsai  <thomas@nchc.org.tw>
  		0.2.90
  		update malloc
  		update malloc
  	2017-02-02  Thomas Tsai  <thomas@nchc.org.tw>
  		Merge branch 'release' of github.com:Thomas-Tsai/partclone into release
  	2017-01-09  Thomas Tsai  <thomas@nchc.org.tw>
  		Merge branch 'release' of github.com:Thomas-Tsai/partclone into release
  	2016-11-06  Thomas Tsai  <thomas@nchc.org.tw>
  		add pt_BR support
  	2016-10-24  Thomas Tsai  <thomas@nchc.org.tw>
  		update makefile
  	2016-10-04  Thomas Tsai  <tlinux.tsai@gmail.com>
  		Merge pull request #80 from rindeal/autoconf
  		fix AC_ARG_ENABLE so that --disable-* options work as expected

  		Merge pull request #80 from rindeal/autoconf
  		fix AC_ARG_ENABLE so that --disable-* options work as expected
  	2016-08-01  Thomas Tsai  <thomas@nchc.org.tw>
  		accept patch from Budy Wuysang <nguik.gnuik _AT_ gmail.com> to fix compile issue on Cent OS 6.8 system
  	2016-06-23  Thomas Tsai  <thomas@nchc.org.tw>
  		release 0.2.89
  		merge
  		add xz comp for debian package
  		release 0.2.89
  		upgrade btrfs to 4.4.2 for btrfs issue
  		accept patch from Andre Naujoks <nautsch2 at gmail.com> // Debian Bug report logs - #825990
  	2016-06-22  Thomas Tsai  <thomas@nchc.org.tw>
  		update btrfs to 4.2.2


author: Lawrence R. Rogers <lrr@cert.org> 0.3.6-2
changelog:
  * Release 0.3.6-2
  	Rebuilt for new ntfs-3g version 2017.3.23-1 for FC24 and FC25,
  	and EL7 (2017-06-25), and EL6 (2017-06-25).


author: vuntz@opensuse.org
changelog:
  - Change gtk1-compat-devel BuildRequires to gtk2-devel: it has been
    ported to GTK+ 2.x a while ago.
  - Add missing BuildRequires for some features: dante-devel,
    db-devel, libopenssl-devel.


author: Lawrence R. Rogers <lrr@cert.org> 0.4-1
changelog:
  * Release 0.4-1
  	0 Dec 2015 - v0.4 UTF-16
  		Fixes for UTF-16 conversion error from Rob O'Neale and James Wright


author: Andreas Schuster <impressum@forensikblog.de> 1.1.0-1
changelog:
  * Release 1.1.0
      * Event.pm: Bumped version to 1.1.0
      * Node0x01.pm, Node0x06: Fixed check for flags
      * Node0x05.pm: Added support for flag 0x40
      * Node0x07.pm: Added parser for XML CDATA section
      * Node0x09.pm: Added parser for XML entity reference
      * Node0x0a.pm, Node0x0b.pm: Added parser for XML processing instruction
      * BXmlNode.pm: Now prints context in case of unknown opcode
      * Type0x09.pm, Type0x0a.pm: Fixed sign error
      * Type0x0b.pm, Type0x0c.pm: Output now in scientific format
      * Type0x83.pm: Added parser for array of signed byte
      * Type0x84.pm: Added parser for array of unsigned byte
      * Type0x85.pm: Added parser for array of signed int16
      * Type0x86.pm: Added parser for array of unsigned int16
      * Type0x87.pm: Added parser for array of signed int32
      * Type0x88.pm: Added parser for array of unsigned int32
      * Type0x89.pm: Added parser for array of signed int64
      * Type0x8a.pm: Added parser for array of unsigned int64
      * Type0x8b.pm: Added parser for array of single prec. float
      * Type0x8c.pm: Added parser for array of double prec. float
      * Type0x8f.pm: Added parser for array of GUID
      * Type0x91.pm: Added parser for array of FILETIME
      * Type0x92.pm: Added parser for array of SYSTEMTIME
      * VariantType.pm: Added the afore mentioned array data types


author: Andreas Schuster <impressum@forensikblog.de> 1.1.1-1
changelog:
  * Release 1.1.1
      * evtxdump.pl: make STDOUT hot/unbuffered
      * Fixed a memory leak caused by a circular object reference. Thanks
        to Heinz Mueller for reporting the bug.
      * evtxdump.pl, evtxinfo.pl, evtxtemplates.pl: require IO::File version 1.14 or later.


author: Lawrence R. Rogers <lrr@cert.org> 1.2.0-1
changelog:
  Version 1.2.0 - see http://blog.kiddaland.net/2014/12/hey-kids-i-heard-on-news-that-airline.html for details.


author: Lawrence R. Rogers <lrr@cert.org> 1.3.0-1
changelog:
  * Release 1.3.0-1
  	Version 1.3.0 - see http://blog.kiddaland.net/2015/07/bringing-end-to-sorrow-new-plaso-release.html for details.


author: Lawrence R. Rogers <lrr@cert.org> 1.4-1
changelog:
  * Release 1.4-1
  	Version 1.4 - see http://blog.kiddaland.net/2016/01/sprinkling-morning-dew-and-summer.html for details.


author: Lawrence R. Rogers <lrr@cert.org> 1.5.0-1
changelog:
  * Release 1.5.0-1
  	Version 1.5.0
  	See this blog post: http://blog.kiddaland.net/2016/09/what-flies-there-what-fares-there-or.html


author: Lawrence R. Rogers <lrr@cert.org> 1.1.1-1
changelog:
  * Release 1.1.1-1
  	Fixed font-size bug with HTML output.
  	Added mising trend.conf.sample to distribution.


author: BJ Dierkes <wdierkes@rackspace.com> - 2.3.0-6
changelog:
  - Add Group: Development/Libraries to -lite-devel package
  - BuildRequires: python-setuptools on EL5 (not python-setuptools-devel)
  - Don't build -java on EL5/EL6 (until maven2 is packaged into EPEL)
  - Add Patch3: protobuf-2.2.0-libtool.patch (on el5)
  - Don't BuildRequire automake, autoconf on el5
  - Don't run autogen.sh on EL5


author: BJ Dierkes <wdierkes@rackspace.com> - 2.3.0-7
changelog:
  - Added Patch4: protobuf-2.3.0-ez_setup.patch (don't use ez_setup
    as it tries to download setuptools)


author: PLD Team <feedback@pld-linux.org>
changelog:
  All persons listed below can be reached at <cvs_login>@pld-linux.org

  Revision 1.9 
  Revision 1.9  2005/08/04 13:38:37  adamg
  - fixed remote execution of arbitrary code vulnerability (Secunia Advisory
    SA16183)
  - unbroke %changelog
  - release 2

  Revision 1.8  2005/08/02 18:43:45  djurban
  - update pstotext to ghostgum's (libgs API author) version:

   * Changelog since 1.8g
   Version 1.9 is a modification of 1.8h to recognise excessive space in
    "ashow" as being a word separator, as found output from groff 1.08.
    Also fixed widthshow, awidthshow and added xshow, yshow and xyshow.
    Uses ANSI prototypes.  These are now required, not optional.
    Fixes a number of compiler warnings.
    Note that neither of the original authors still work at DEC/Compaq/HP.
   2004-01-09 by Russell Lang at Ghostgum Software Pty Ltd.

   Version 1.8h is a modification of the original 1.8 to allow
    operation with Aladdin Ghostscript 6.0, to add -output to
    Windows and OS/2 executables, and to insert line breaks
    and form feeds is pstotext output.  Modifications made
   2000-07-15 by Russell Lang at Ghostgum Software Pty Ltd.

    main.c changed to use mkstemp not tempnam for Unix,
   2000-06-02 by Russell Lang at Ghostgum Software Pty Ltd.

  Revision 1.7  2005/07/31 16:17:31  glen
  - todo security

  Revision 1.6  2004/04/10 23:10:21  qboosh
  - updated URLs, replaced "302 Found" html file by proper sources

  Revision 1.5  2004/04/10 23:01:04  qboosh
  - cosmetics, release 2 for Ac

  Revision 1.4  2003/05/28 13:01:25  malekith
  - massive attack: source-md5

  Revision 1.3  2003/05/25 06:25:54  misi3k
  - massive attack s/pld.org.pl/pld-linux.org/

  Revision 1.2  2002/11/29 22:46:07  ankry
  - massive attack: new %doc

  Revision 1.1  2002/03/06 00:08:27  qboosh
  - new: spec based on old RH-contrib package, but uptated to 1.8g
    (unfortunately, there is no version information in Source URL)


author: Lawrence Rogers <lrr@cert.org> 1.0.5-3
changelog:
  * Release 1.0.5-3
          Now only sets short_open_tag if not set.
  	Now only unsets short_open_tag if set by the installation of this package.


author: Lawrence Rogers <lrr@cert.org> 1.0.5-4
changelog:
  * Release 1.0.5-4
          Now properly recognizes that either the sleuthkit version 3 or 4 are installed.


author: Lawrence R. Rogers <lrr@cert.org> 2.3.0.0-2
changelog:
  * Release 2.3.0.0-2
          Release 2 - Rebuilt for Python 3.6 for CentOS/RHEL 7 which triggered a rebuilt of capstone.


author: Lawrence R. Rogers <lrr@cert.org> 0.4.0-1
changelog:
  * Release 0.4.0-1
  	Added support for parsing a file or a string as an XML registry of information elements to add to an information model.
  	Fixed bugs in hanlding of floating point values and signed integers.
  	Requires libfixbuf-2.1.0.


author: Lawrence R. Rogers <lrr@cert.org> 0.5.0-1
changelog:
  * Release 0.5.0-1
  	Added several new sample scripts: to find records by IP address, to find records by DNS name, to find records on an unusual port
  	Added the cert_ipfix.xml file as resource, and added a new pyfixbuf.cert module for access to it.
  	Added the ability to invoke a callback function when a new Template object is read.
  	Added new iteration methods to Templates and Records.
  	Added a recursive Record iterator for visiting items in a subTemplateMultiList or subTemplateList.
  	Made many additional changes, both visible and internal, and fixed several bugs.


author: Lawrence R. Rogers <lrr@cert.org> 0.6.0-1
changelog:
  * Release 0.6.0-1
  	Added a new sample script to visualize IPFIX data: dump_ipfix_metadata.py.
  	Fixed a bug when converting a MAC address to text.
  	Fixed several bugs that caused either exceptions or crashes.
  	Requires libfixbuf-2.2.0.


author: Lawrence R. Rogers <lrr@cert.org> 0.7.0-1
changelog:
  * Release 0.7.0-1
  	Changed the STL and STML classes to raise an Exception when the user specifies a Template that has an ID of 0.
  	Changed the Record class to allow an Python object of type bytearray for information elements whose type is OCTET_ARRAY or MAC_ADDR.
  	Fixed a bug that could cause a Session to have a pointer to an invalid Template.
  	Changed libfixbuf requirement to v2.2.0 or later.


author: Lawrence R. Rogers <lrr@cert.org> 0.8.1-1
changelog:
  * Release 0.8.1-1
          Version 0.8.1.
  		Fixed a bug setting IPv6 addresses on a record in Python 3.x.
  		Fixed a bug when using IPv6 addresses in a basicList.


author: Lawrence R. Rogers <lrr@cert.org> - 2.2.0-1
changelog:
  - update to 2.2.0
  	- Bumped minor version number to reflect compatibility issues with
  	  OneOrMore and ZeroOrMore bugfixes in 2.1.10. (2.1.10 fixed a bug
  	  that was introduced in 2.1.4, but the fix could break code
  	  written against 2.1.4 - 2.1.9.)

  	- Updated setup.py to address recursive import problems now
  	  that pyparsing is part of 'packaging' (used by setuptools).
  	  Patch submitted by Joshua Root, much thanks!

  	- Fixed KeyError issue reported by Yann Bizeul when using packrat
  	  parsing in the Graphite time series database, thanks Yann!

  	- Fixed incorrect usages of '\' in literals, as described in
  	  https://docs.python.org/3/whatsnew/3.6.html#deprecated-python-behavior
  	  Patch submitted by Ville Skyttä - thanks!

  	- Minor internal change when using '-' operator, to be compatible
  	  with ParserElement.streamline() method.

  	- Expanded infixNotation to accept a list or tuple of parse actions
  	  to attach to an operation.

  	- New unit test added for dill support for storing pyparsing parsers.
  	  Ordinary Python pickle can be used to pickle pyparsing parsers as
  	  long as they do not use any parse actions. The 'dill' module is an
  	  extension to pickle which *does* support pickling of attached
  	  parse actions.


author: Lawrence R. Rogers <lrr@cert.org> - 2.4.0-1
changelog:
  - update to 2.4.0-1
  	Version 2.4.0 - see https://github.com/pyparsing/pyparsing/blob/master/CHANGES
          Release 2.4.0-1 - Rebuilt for Python 3.6 for CentOS/RHEL 7


author: termim@gmail.com 3.7.8_r1-1
changelog:
  * Release 3.7.8_r1-1
  	Updated documentation and tests due to an undocumented change in VFS xDelete semantics.
  	Added SQLITE3_FCNTL_PERSIST_WAL and SQLITE3_FCNTL_WIN32_AV_RETRY file controls.
  	Wrapped sqlite3_sourceid (issue 120).


author: termim@gmail.com 3.7.14.1_r1-1
changelog:
  * Release 3.7.14.1_r1-1
  	Updated setup and test suite so that all files are explicitly closed instead of relying on garbage collection.
  	Added Windows binaries for Python 3.3. (Only 32 bit as Python doesn’t provide a free way of making 64 bit Windows binaries.)
  	Updated setup.py to work with changed SQLite download page formatting when detecting latest version.
  	Due to a Python 3.3.0 regression bug using the csv ouput mode in the shell can result in bad data or Python crashing. The bug has been fixed for Python 3.3.1 which is due in November 2012.


author: termim@gmail.com 3.7.15.1_r1-1
changelog:
  * Release 3.7.15.1_r1-1
  	* Use https (SSL) for SQLite web site references (downloads and
  	  documentation links). On some platforms/versions/SSL libraries,
  	  Python’s SSL module doesn’t work with the SQLite website
  	  so a fallback to http is used - the downloads still have their
  	  checksum verified.

  	* Work around changed semantics for error handling when the VFS
  	  xDelete method is asked to delete a file that does not exist.

  	* Completely removed all AsyncVFS related code. This extension is
  	  no longer maintained nor supported by the SQLite team. WAL is
  	  a good way of getting similar functionality.

  	* Added config() support for SQLITE_CONFIG_COVERING_INDEX_SCAN.

  	* Added several new constants: SQLITE_CONFIG_COVERING_INDEX_SCAN,
  	  SQLITE_CONFIG_SQLLOG, SQLITE_FCNTL_BUSYHANDLER,
  	  SQLITE_FCNTL_TEMPFILENAME, SQLITE_CANTOPEN_FULLPATH,
  	  SQLITE_IOERR_DELETE_NOENT


author: termim@gmail.com 3.7.16.1_r1-1
changelog:
  * Release 3.7.16.1_r1-1
  	Update shell completion tables for functions and pragmas
  	New SQLite download URLS, new constants, removed CouchDB support


author: termim@gmail.com 3.8.0_r1
changelog:
  * Release 3.8.0_r1
  	Minor shell dump fix, new constants, Python 3.3 64 bit binary build available for Windows.


author: termim@gmail.com 3.8.0_r2
changelog:
  * Release 3.8.0_r2
  	This only includes a changed checksum as the SQLite team updated their release keeping
  	the version number to fix an autoconf issue. The Windows binaries have been left as -r1 since the change would not affect them.


author: termim@gmail.com 3.8.2_r1
changelog:
  * Release 3.8.2_r1
  	This release includes the following:

  		2013-12-09 - Version 3.8.2-r1
  			New constants.
  		2013-10-30 - Version 3.8.1-r1
  			2 new constants and minor doc tweaks
  		2013-09-04 - Version 3.8.0.2-r1
  			No APSW code changes - added diagnostics section to tips doc page
  		2013-09-01 - Version 3.8.0.1-r1s
  			 No APSW changes - SQLite version bump. Python 3.3 64 bit binary for Windows no longer
  			available as Microsoft update broke build ability and I have no patience left to fight Microsoft tools.


author: David P. D. Moss <drkjam@gmail.com> 0.7.6-1
changelog:
  * Release 0.7.6-1
  	Changes since 0.7.5
  	-------------------
  	* A bug fix point release
  	* Refreshed 3rd party data caches
  	* Tested against Python 3.2.x and PyPy 1.6.x
  	* Fixed unit tests under for Mac OSX

  	Specific bug fixes addressed in this release
  	--------------------------------------------
  	* FIXED Issue 15 - http://github.com/drkjam/netaddr/issues/15
  	    - Incorrect and invalid glob produced when last octet is not *
  	* FIXED Issue 13 - http://github.com/drkjam/netaddr/issues/13
  	    - Added support for IPython 0.11 API changes. Thanks juliantaylor
  	* FIXED Issue 11 - http://github.com/drkjam/netaddr/issues/11
  	    - Calling valid_glob on cidr raises ValueError. Thanks radicand
  	* FIXED Issue 7 - http://github.com/drkjam/netaddr/issues/7
  	    - Unpickling Bug in IPSet. Thanks LuizOz and labeneator
  	* FIXED Issue 2 - http://github.com/drkjam/netaddr/issues/2
  	    - UnboundLocalError raised in IPNetwork constructor. Thanks keesbos


author: Marko Kreen <markokr@gmail.com> 2.2-1
changelog:
  * Release 2.2-1
  	Fixes:

  	* Relaxed volume naming.  Now it just calculates new volume name by finding number
  	  in old one and increasing it, without any expectations what that number should be.
  	* Files with 4G of compressed data in one colume were handled wrong.  Fix.
  	* DOS timestamp seconds need to be multiplied with 2.
  	* Correct EXTTIME parsing.

  	Cleanups:

  	* Compressed size is per-volume, sum them together, so that user sees complete
  	  compressed size for files split over several volumes.
  	* dumprar: Show unknown bits.
  	* Use ``struct.Struct()`` to cache unpack formats.
  	* Support missing ``os.devnull``. (Python 2.3)


author: Marko Kreen <markokr@gmail.com> 2.6-1
changelog:
  * Release 2.6-1
  	Version 2.6 (2013-04-10)
  		Add context manager support for RarFile class. Both RarFile and RarExtFile support with statement now. (Wentao Han)
  		RarFile.volumelist() method, returns filenames of archive volumes.
  		Re-throw clearer error in case unrar is not found in PATH.
  		Sync new unrar4.x error code from rar.txt.
  		Use Sphinx for documentation, push docs to rtfd.org

  	Version 2.5 (2012-01-19)
  	    Fixes:
  		RarExtFile.read() and RarExtFile.readinto() now do looping read to work properly on short reads. Important for Python 3.2+ where read from pipe can return short result even on blocking file descriptor.
  		Proper error reporting in RarFile.extract(), RarFile.extractall() and RarFile.testrar().
  		RarExtFile.read() from unrar pipe: prefer to return unrar error code, if thats not available, do own error checks.
  		Avoid string addition in RarExtFile.read(), instead use always list+join to merge multi-part reads.
  		dumprar: dont re-encode byte strings (Python 2.x). This avoids unneccessary failure when printing invalid unicode.

  	Version 2.4 (2011-11-05)
  	    Fixes:
  		USE_DATETIME: survive bad values from RAR
  		Fix bug in corrupt unicode filename handling
  		dumprar: make unicode chars work with both pipe and console

  	Version 2.3 (2011-07-03)
  	    Features:
  		Support .seek() method on file streams. (Kristian Larsson)
  		Support .readinto() method on file streams. Optimized implementation is available on Python 2.6+ where memoryview is available.
  		Support file comments - RarInfo.comment contains decompressed data if available.
  		File objects returned by RarFile.open() are io.RawIOBase-compatible. They can further wrapped with io.BufferedReader and io.TextIOWrapper.
  		Now .getinfo() uses dict lookup instead of sequential scan when searching archive entry. This speeds up prococessing for archives that have many entries.
  		Option UNICODE_COMMENTS to decode both archive and file comments to unicode. It uses TRY_ENCODINGS for list of encodings to try. If off, comments are left as byte strings. Default: 0
  		Option PATH_SEP to change path separator. Default: r'\', set rarfile.PATH_SEP='/' to be compatibe with zipfile.
  		Option USE_DATETIME to convert timestamps to datetime objects. Default: 0, timestamps are tuples.
  		Option TRY_ENCODINGS to allow tuning attempted encoding list.
  		Reorder RarInfo fiels to better show zipfile-compatible fields.
  		Standard regtests to make sure various features work
  	    Compatibility:
  		Drop RarInfo.unicode_filename, plain RarInfo.filename is already unicode since 2.0.
  		.read(-1) reads now until EOF. Previously it returned empty buffer.
  	    Fixes:
  		Make encrypted headers work with Python 3.x bytes() and with old 2.x ‘sha’ module.
  		Simplify subprocess.Popen usage when launching unrar. Previously it tried to optimize and work around OS/Python bugs, but this is not maintainable.
  		Use temp rar file hack on multi-volume archives too.
  		Always .wait() on unrar, to avoid zombies
  		Convert struct.error to BadRarFile
  		Plug some fd leaks. Affected: Jython, PyPy.
  		Broken archives are handled more robustly.


author: Lawrence R. Rogers <lrr@cert.org> 3.0-1
changelog:
  * Release 3.0-1
  	Version 3.0 (2016-12-27)
  		New feature:
  			Support RAR5 archive format. It is actually completely different archive format from RAR3 one, only is uses same file extension and tools are old one.
  			Except incompatibilies noted below, most of code should notice no change, existing RarInfo fields will continue using RAR3-compatible values (eg. RarInfo.host_os). RAR5-specific values will use new fields.
  		Incompatibilities between rarfile v2.x and 3.x:
  			Default PATH_SEP is now ‘/’ instead ‘\’.
  			Removed NEED_COMMENTS option, comments are always extracted.
  			Removed UNICODE_COMMENTS option, they are always decoded.
  			Removed USE_DATETIME option, RarInfo.date_time is always tuple, RarInfo.mtime, RarInfo.atime, RarInfo.ctime and RarInfo.arctime are always datetime.datetime objects.
  		Fixes:
  			Fixed bug when calling rarfp.open() on a RarInfo structure.
  		Cleanups:
  			Code refactor to allow 2 different file format parsers.
  			Code cleanups to pass modern linters.
  			New testing and linting setup based on Tox.
  			Use setuptools instead distutils for install.

  	Version 2.8 (2016-06-07)
  		Fix: support solid archives from in-memory file object. Full archive will be written out to temp file. [#21]
  		Fix: ask unrar stop switches scanning, to handle archive names starting with “-”. (Alexander Shadchin) [#12]
  		Fix: add missing _parse_error variable to RarFile object. (Gregory Mazzola) [#20]
  		Fix: return proper boolean from RarInfo.needs_password(). [#22]
  		Fix: do not insert non-string rarfile into exception string. (Tim Muller) [#23]
  		Fix: make RarFile.extract() and RarFile.testrar() support in-memory archives.
  		Use cryptography module as preferred crypto backend. PyCrypto will be used as fallback.
  		Cleanup: remove compat code for Python 2.4/2.5/2.6.

  	Version 2.7 (2014-11-23)
  		Allow use of bsdtar as decompression backend. It sits on top of libarchive, which has support for reading RAR archives.

  	Limitations of libarchive RAR backend:
  		* Does not support solid archives.
  		* Does not support password-protected archives.
  		* Does not support “parsing filters” used for audio/image/executable data, so few non-solid, non-encrypted archives also fail.
  	Now rarfile checks if unrar and if not then tries bsdtar. If that works, then keeps using it. If not then configuration stays with unrar which will then appear in error messages.
  	Both RarFile and is_rarfile() now accept file-like object. Eg. io.BytesIO. Only requirement is that the object must be seekable. This mirrors similar funtionality in zipfile.
  		Based on patch by Chase Zhang.
  	Uniform error handling. RarFile accepts errors="strict" argument.

  	Allow user to tune whether parsing and missing file errors will raise exception. If error is not raised, the error string can be queried with RarFile.strerror() method.


author: Willi Ballenthin <willi.ballenthin@gmail.com> 1.0.1-1
changelog:
  * Release 1.0.1-1
  	1.0.1
  	  - better detection and handling of malformed Unicode, thanks to @jallmantalbot and matt.a.hastings
  	  - minor changes to formatting in sample scripts

  	1.0.0
  	  - implemented Python3 support thanks to @3ev0


author: Willi Ballenthin <willi.ballenthin@gmail.com> 1.0.4-1
changelog:
  * Release 1.0.4-1
  	1.0.4
  	  - correctly handle value types on Vista+ that require a DEVPROP_MASK_TYPE mask, thanks to @woanware
  	  - support the new RegDateTime value type, used for instance in some USBSTOR values, thanks to @woanware

  	1.0.3
  	  - use setuptools over distutils

  	1.0.2
  	  - can now fetch hive name from a Registry hive, thanks to @woanware, @jallmantalbot
  	  - can now guess the Registry hive type (NTUSER, USRCLASS, etc) from the hive name, thanks to @woanware
  	  - better handling of key/value names through use of Windows-1252 encoding, thanks to @jallmantalbot and Joel Schnieder


author: Willi Ballenthin <willi.ballenthin@gmail.com> 1.1.0-1
changelog:
  * Release 1.1.0-1
  	1.1.0
  	- add raw_data method
  	- fix testing scripts and methods
  	- add amcache.hve parsing script
  	- add script for mounting hive as file system via FUSE
  	- many fixes, including checksum calculations, by @NiKiZe
  	- fixes to RegDateTime parsing by @woanware


author: Willi Ballenthin <willi.ballenthin@gmail.com> 1.1.0-2
changelog:
  * Release 1.1.0-2
  	This is the version available on 2015-02-26 which is a patch to 1.1.0 making release 2.


author: Willi Ballenthin <willi.ballenthin@gmail.com> 1.2.0-1
changelog:
  * Release 1.2.0-1
  	- [DEPRECATED] records() in HBINBlock, use the more correct cells() instead, by @NiKiZe
  	- fix bug in parsing of resident values with length zero, reported and patched by @BridgeyTheGeek
  	- fix handling of path cycles, reported and patched by @sbv-csis


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 3.8.1-3
changelog:
  - Python2 binary package has been removed
    See https://fedoraproject.org/wiki/Changes/Mass_Python_2_Package_Removal


author: Lawrence R. Rogers <lrr@cert.org> 3.11.0-4
changelog:
  * Release 3.11.0-4
  	Release 4 - New release to negate obsoletes in fedora-obsolate-packages for Fedora 32


author: Lawrence R. Rogers <lrr@cert.org> 20131124-1
changelog:
  * Release 20131124-1
  	Fixes for FreeBSD build.
  	Changes to setup.py to find library path for OSX build.
  	Small updates to setup.py
  	Added check for HAVE_SSIZE_T
  	Changes for sleuthkit 64-bit vs2010 build.
  	More fixes
  	Small fix when TSK_LIBRARIES_PATH cannot be determined.
  	Fix in setup.py for Mac OS X.
  	Small update to dpkg files.
  	Removed files

  Oct 17, 2013	
  Joachim Metz <joachim.metz>
  Get email change notifications about comments on this revision.	073f4c1480a4		
  Updates for building SleuthKit 4.1.2 and pytsk on Windows. Improvements to setup.py to work on Windows icw. Visual Studio and to detect SleuthKit version.


author: Lawrence R. Rogers <lrr@cert.org> 20131230-1
changelog:
  * Release 20131230-1
  	Textual changes.
  	Get email change notifications about comments on this revision.	4c6956ccf802		
  	Small change in dpkg files.
  	Bug fixes for keeping references of python object arguments.
  	Bug fix in Img_Info_Con for missing tsk_init_lock.
  	Bug fix in test runner.
  	Changes in dpgk files.
  	Fixed multiple issues: * incorrect proxied base referencing (Issue 10) * free of proxied base * changed call to class members to object members
  	Fix for Issue 14.
  	Get email change notifications about comments on this revision.
  	Initial work on automated tests. Code clean up.
  	Small changes in setup.py
  	Small changes to run_tests.py to prefer pytsk3.so in build.
  	Small changes to run tests script.
  	Small changes to setup.py and MANIFEST.in
  	Small correction in comment.
  	Small fix for run_tests.py
  	Small fix in last change.
  	Updates to make_dist.sh script.
  	Worked on tests.


author: Lawrence R. Rogers <lrr@cert.org> 20140217-1
changelog:
  * Release 20140217-1
  	Changes to make dist script.
  	Small change in dpkg build files.
  	Fix for bdist_msi build target.
  	Added pytsk3 version.
  	Fixed another Visual Studio compiler warning.
  	Fixed some Visual Studio compiler warnings.
  	More fixes for building generated code with Visual Studio.
  	Fix for building generated code with Visual Studio.
  	Fix for keeping an unnecessary reference on a subclassed object.
  	Code clean up.
  	Fixed various issues regarding memory management and object referencing.
  	More changes regarding object management and referencing.
  	More changes for TSK_IMG_TYPE_EXTERNAL support.
  	Added support for TSK_IMG_TYPE_EXTERNAL.
  	Fixed wrapped internal object being seen as proxied object in free.
  	Reverted last changes, the issue seems to be more subtle.
  	Removed double IncRef after last change.
  	Fixed missing IncRef in iternext.
  	Textual changes.
  	Small change in dpkg files.


author: Lawrence R. Rogers <lrr@cert.org> 20140506-1
changelog:
  * Release 20140506-1
  	Fix for issues on Windows.
  	Get email change notifications about comments on this revision.
  	Code clean up
  	Get email change notifications about comments on this revision.
  	Disabled talloc report.
  	Get email change notifications about comments on this revision.
  	Removed creation of additional external img info and bug fixes.
  	Get email change notifications about comments on this revision.
  	More changes for C types.
  	Get email change notifications about comments on this revision.
  	Improved handling of C types.
  	Get email change notifications about comments on this revision.
  	Changes to make dist script.
  	Get email change notifications about comments on this revision.
  	Small change in dpkg build files.
  	Get email change notifications about comments on this revision.
  	Fix for bdist_msi build target.


author: Lawrence R. Rogers <lrr@cert.org> 20150406-2
changelog:
  * Release 20150406-2
  	Redefined the C compiler to deal with default visibility that caused Object_init to be invisible.


author: Lawrence R. Rogers <lrr@cert.org> 20190507-2
changelog:
  * Release 20190507-2
  	Version 20190507-2: Uses python3_pkgversion for the current version of Python 3.


author: Larence R. Rogers <lrr@cert,org> - 5.3.0-1
changelog:
  * Release 5.3.0-1
    1. Directory wildcards are allowed in RAR command line in file names to
        archive. For example:

        rar a backup c:\backup\2015*\*

        Recursion is enabled automatically for such directory wildcards
        even if -r switch is not specified.

     2. New 'R' object for -sc switch defines encoding of console
        RAR messages sent to redirected files and pipes. For example:

        rar lb -scur data > list.txt

        will produce Unicode list.txt with archived file names.

     3. Console RAR "l" and "v" commands display file time in YYYY-MM-DD
        format.

     4. "Test" command also verifies contents of NTFS alternate data streams
        in RAR 3.x - 5.x archives. Previously their contents was checked
        only during extraction command.

     5. Bugs fixed:

        a) console RAR crashed instead of displaying an overwrite prompt
           when attempting to add files to already existing volumes;

        b) console RAR "lt" command did not display seconds in file timestamp.


author: Lawrence R. Rogers <lrr@cert.org> - 1.18.1-1.1
changelog:
  - Release 1.18.1-1.1
  	See http://www.lesbonscomptes.com/recoll/release-1.18.html for the list of changes
  	Also enables tar archive expansion by default.
  	Now requires epub, aspell, and pstotext.


author: Lawrence R. Rogers <lrr@cert.org> 20111103-1
changelog:
  * Release 20111103-1
  	This is release 1.1 of registrydecoder.

  	New Features include: 
  	- Support for processing Encase (E01) files and split images
  	- Full wildcard searching
  	- Adding evidence after a case is created
  	- Exporting of paths and their key/value pairs
  	- Timelining of keys from the GUI into the Sleuthkit format
  	- Running plugins from the command line
  	- Running custom plugins outside the main executable/package
  	- Support for dual boot machines

  	Updates include:
  	- Reports now have their extension appended if the user doesn't enter them
  	- Reports can now be filtered by either deleting results or shift/ctrl selecting results
  	- Users can right click within the Browse View to search directly for paths
  	- The name/value box in the Browse View is now sortable
  	- We also have six new plugins from Kevin Moore of CERT!


author: Lawrence R. Rogers <lrr@cert.org> 20120202-1
changelog:
  * Release 20120202-1
  	This is release 1.2 of registrydecoder.
  	See http://code.google.com/p/registrydecoder/source/list for the changes


author: Lawrence R. Rogers <lrr@cert.org> 20120629-1
changelog:
  * Release 20120629-1
  	This is release 1.3 of registrydecoder.
  	See http://code.google.com/p/registrydecoder/source/list for the changes


author: Lawrence R. Rogers <lrr@cert.org> 20120709-1
changelog:
  * Release 20120709-1
  	This is a build of the file labeled regdecoderR99.zip.
  	See http://code.google.com/p/registrydecoder/source/list for the changes


author: Lawrence R. Rogers <lrr@cert.org> 20120816-1
changelog:
  * Release 20120816-1
  	This is version 1.4 of the registry decoder.
  	This is a build of the file labeled regdecoderR103.zip.
  	See http://code.google.com/p/registrydecoder/source/list for the changes


author: Lawrence R. Rogers <lrr@cert.org> 0.99.0-1
changelog:
  * Release 0.99.0-1
  	This 1.0 release candidate contains major improvements to regfi usability.  Important changes include:
  		Made regfi a proper library and made major improvements to the API
  		Added Python bindings (pyregfi) for regfi
  		Replaced Make-based build system with a SCons-based one
  		Numerous improvements in regfi for multithreaded use, memory management
  		Improved API documentation


author: Lawrence R. Rogers <lrr@cert.org> 1.0.0-1
changelog:
  * Release 1.0.0-1
  	This major release stablizes the previous release candidate and adds minor improvements, including:
  		SK records and security descriptors now accessible in pyregfi
  		Added key caching to regfi, reintroduced SK caching
  		Minor API simplifications and improved documentation
  		Numerous bug fixes


author: Lawrence R. Rogers <lrr@cert.org> 1.0.1-1
changelog:
  * Release 1.0.1-1
  	This bug-fix release addresses some issues identified since the last release and includes no significant changes to functionality. Fixes include:
  		Minor changes and fixes to unicode handling in pyregfi
  		Corrected an infinite loop on corrupted registries discovered by Andrew Case
  		Added ldconfig call during installation
  		Improved error reporting and other minor fixes


author: Lawrence R. Rogers <lrr@cert.org> 20120224-1
changelog:
  * Release 20120224-1
      Now uses regripper plugins 20120224
  	+ NEW PLUGIN by Adrian Leong: "ccleaner.pl" (gets CCleaner User's Settings from NTUSER.DAT)


author: Lawrence R. Rogers <lrr@cert.org> 20120528-1
changelog:
  * Release 20120528-1
      Now uses regripper plugins 20120528
  	+ NEW PLUGIN by Francesco Picasso: “internet_explorer_cu.pl” that parses the Internet Explorer info from NTUSER.DAT registry
  	+ NEW PLUGIN by Francesco Picasso: “internet_settings_cu.pl” that parses the Internet Settings info from NTUSER.DAT registry
  	+ REMOVED plugin “ie_main.pl“, since superseded by “internet_explorer_cu.pl”
  	+ REMOVED plugin “iexplore.pl“, since superseded by “internet_explorer_cu.pl”
  	+ FIXED plugin “timezone.pl“, see  Issue14  and see source code comments
  	+ FIXED plugin “userassist2.pl“, now it parses Windows7 entries, see source code comments
  	+ ADDED profiles with every plugin listed in alphabetical order: all-all (3), ntuser-all (98), sam-all (1), security-all (3), software-all (56), system-all (46)
  	+ NOTE RegRipperPlugins now counts 207 plugins
  	+ KNOWN ISSUES: comdlg32 does not parse Vista/7 subkeys (Issue 15)


author: Lawrence R. Rogers <lrr@cert.org> 20120612-1
changelog:
  * Release 20120612-1
      Now uses regripper plugins 20120528
  	+ NEW PLUGIN by Jason Hale: "typedurlstime.pl" that parses and correlates the TypedURLs and TypedURLsTime subkeys
  	+ NEW PLUGIN by Jason Hale: "typedurlstime_tln.pl" that parses and correlates the TypedURLs and TypedURLsTime subkeys (output in TLN format)


author: Lawrence R. Rogers <lrr@cert.org> 28000000-1
changelog:
  * Release 28000000-1
  	Regripper version 2.8
  		Includes an additional function/subroutine that is available to the plugins: alertMsg().


author: Lawrence R. Rogers <lrr@cert.org> 28000000-4
changelog:
  * Release 28000000-4
  	New auto_rip.pl (2012-08-26 version)
  		Fixes some issues running on Linux
  		There is a new switch (-r) to save the output reports to a folder of your choice


author: Lawrence R. Rogers <lrr@cert.org> 20120812-1
changelog:
  * Release 20120812-1
      Now uses regripper plugins 20120812.
      RegRipperPlugins now counts 215 plugins

      Changes from the previous version:
  	+ NEW PLUGIN by Hal Pomeranz: "ssh_host_keys.pl" that extracts stored Putty and WinSCP host keys from NTUSER hive
  	+ NEW PLUGIN by Hal Pomeranz: "winscp_sessions.pl" that extracts WinSCP saved session data from NTUSER hive (with password decoding)
  	+ NOTE profiles all-all, ntuser-all, sam-all, security-all, software-all and system-all were updated
  	+ NOTE source code repository was aligned to current release
  	+ NEW PLUGIN by John Lukach: "pstools.pl" that displays the content for PsTools EULA Agreements
  	+ NEW PLUGIN by K. Johnson (with Harlan Carvey updates): "filehistory.pl" that parses NTUSER FileHistory Registry keys from Windows 8
  	+ NEW PLUGIN by Elizabeth Schweinsberg: "user_runplus.pl" that gets contents of the Run, RunOnce, and RunServices keys from NTUSER hive
  	+ NEW PLUGIN by Elizabeth Schweinsberg: "soft_runplus.pl" that gets contents of the Run, RunOnce, and RunServices keys from SOFTWARE hive
  	+ NEW PLUGIN by Elizabeth Schweinsberg: "svc_plus.pl" that gets services, displaied in short format, from SYSTEM hive


author: Lawrence R. Rogers <lrr@cert.org> 20120926-1
changelog:
  * Release 20120926
  	Installed 20120926 version of the plugins. Here are the changes:
  	+ NEW PLUGIN by Harlan Carvey: "appcertdlls.pl" that gets entries from AppCertDlls key (SYSTEM)
  	+ NEW PLUGIN by Harlan Carvey: "appcompatcache.pl" that parses files from the Shim Cache (SYSTEM)
  	+ NEW PLUGIN by Harlan Carvey: "appcompatcache_tln.pl" that parses files from the Shim Cache, TLN output (SYSTEM)
  	+ NEW PLUGIN by Harlan Carvey: "applets_tln.pl" that gets the content of Applets key, TLN output (NTUSER)
  	+ NEW PLUGIN by Harlan Carvey: "appspecific.pl" that gets contents of user's Intellipoint\AppSpecific subkeys (NTUSER)
  	+ NEW PLUGIN by Harlan Carvey: "ares.pl" that gets contents of user's Software\Ares key (NTUSER)
  	+ NEW PLUGIN by Corey Harrell: "backuprestore.pl" that gets FilesNotToSnapshot, KeysNotToRestore, FilesNotToBackup (SYSTEM)
  	+ NEW PLUGIN by Harlan Carvey: "compatassist.pl" that checks user's Compatibility Assistant\Persisted values (NTUSER)
  	+ NEW PLUGIN by Harlan Carvey: "direct.pl" that searches Direct keys for MostRecentApplication subkeys (SOFTWARE)
  	+ NEW PLUGIN by Harlan Carvey: "direct_tln.pl" that searches Direct keys for MostRecentApplication subkeys, TLN output (SOFTWARE)
  	+ NEW PLUGIN by Corey Harrell: "disablesr.pl" that gets the on/off value for System Restore (SOFTWARE)
  	+ NEW PLUGIN by Harlan Carvey: "installer.pl" that determines products install information (SOFTWARE)
  	+ NEW PLUGIN by Harlan Carvey: "javafx.pl" that gets contents of user's JavaFX key (NTUSER)
  	+ NEW PLUGIN by Harlan Carvey: "legacy_tln.pl" that lists LEGACY entries in Enum\Root key, TLN output (SYSTEM)
  	+ NEW PLUGIN by Harlan Carvey: "networklist_tln.pl" that collects network info from NetworkList key, TLN output (SOFTWARE)
  	+ NEW PLUGIN by Harlan Carvey: "osversion.pl" that checks for OSVersion value, malware related (NTUSER)
  	+ NEW PLUGIN by Corey Harrell: "prefetch.pl" that gets the Prefetch Parameters (SYSTEM)
  	+ NEW PLUGIN by Harlan Carvey: "runmru_tln.pl" that gets contents of user's RunMRU key, TLN output (NTUSER)
  	+ NEW PLUGIN by Harlan Carvey: "shellbags.pl" that gets contents of users's Shell/BagMRU keys, Windows7 (USRCLASS)
  	+ NEW PLUGIN by Harlan Carvey: "sysinternals.pl" that checks for SysInternals apps keys (NTUSER)
  	+ NEW PLUGIN by Harlan Carvey: "sysinternals_tln.pl" that checks for SysInternals apps keys, TLN output (NTUSER)
  	+ NEW PLUGIN by Harlan Carvey: "tracing.pl" that gets list of apps that can be traced (SOFTWARE)
  	+ NEW PLUGIN by Harlan Carvey: "tracing_tln.pl" that gets list of apps that can be traced, TLN output (SOFTWARE)
  	+ NEW PLUGIN by Harlan Carvey: "trustrecords.pl" that gets user's Office 2010 TrustRecords values (NTUSER)
  	+ NEW PLUGIN by Harlan Carvey: "trustrecords_tln.pl" that gets user's Office 2010 TrustRecords values, TLN output (NTUSER)
  	+ NEW PLUGIN by Harlan Carvey: "tsclient_tln.pl" that gets contents of user's Terminal Server Client key, TLN output (NTUSER)
  	+ NEW PLUGIN by Harlan Carvey: "typedpaths_tln.pl" that gets contents of user's typedpaths key, TLN output (NTUSER)
  	+ NEW PLUGIN by Harlan Carvey: "userassist_tln.pl" that displays contents of UserAssist subkeys, TLN output (NTUSER)
  	+ NEW PLUGIN by Mari DeGrazia: "winbackup.pl" that gets Windows Backup settings (SOFTWARE)
  	+ NEW PLUGIN by Harlan Carvey: "wpdbusenum.pl" that gets WpdBusEnumRoot subkey info (SYSTEM)

  	+ UPDATE by Harlan Carvey to "legacy.pl", added analysis tip (SYSTEM)
  	+ UPDATE by Harlan Carvey to "muicache.pl", the plugin works both on NTUSER and/or USRCLASS hives (NTUSER,USRCLASS)
  	+ UPDATE by Harlan Carvey to "networklist.pl", added NameType value reporting (SOFTWARE)
  	+ UPDATE by Harlan Carvey to "soft_run.pl", added support to newer OS and 64 bits (SOFTWARE)
  	+ UPDATE by Harlan Carvey to "tsclient.pl", added parsing of Servers key (NTUSER)
  	+ UPDATE by Harlan Carvey to "userassist.pl" (NTUSER)

  	+ REMOVED TEMPORARILY plugin "typedurlstime.pl", postponed on next packages
  	+ REMOVED TEMPORARILY plugin "typedurlstime_tln.pl", postponed on next packages

  	+ REMOVED plugin "bagtest.pl", deprecated
  	+ REMOVED plugin "bagtest2.pl", deprecated
  	+ REMOVED plugin "crashcontrol.pl", too similar to "crashdump.pl"
  	+ REMOVED plugin "filesnottosnapshot.pl", superseded by "backuprestore.pl"
  	+ REMOVED plugin "pstools.pl", superseded by the more general "sysinternals.pl" plugin
  	+ REMOVED plugin "userassist2.pl", deprecated since "userassist.pl" was updated
  	+ REMOVED plugin "vista_comdlg32.pl", deprecated since "comdlg32.pl" was updated
  	+ REMOVED plugin "win7_ua.pl", Windows7-RC and Vigenerè encryption are obsolete

  	+ NOTE added profile "usrclass-all" for USRCLASS.DAT hive
  q	+ NOTE profiles all-all, ntuser-all, sam-all, security-all, software-all, system-all, usrclass-all were updated
  	+ NOTE profiles '-all' DO NOT contain plugins TLN versions: you must create your own profiles or use them directly
  	+ NOTE source code repository was switched to GIT and it was aligned to the current release
  	+ NOTE RegRipperPluginsPackage (RRPP) now counts 236 plugins


author: Lawrence R. Rogers <lrr@cert.org> 20130218-1
changelog:
  * Release 20130218
  	+ NEW PLUGIN by Corey Harrell: "uac.pl" that gets UAC configuration values (SOFTWARE)
  	+ UPDATE by Harlan Carvey to "comdlg32.pl", many updates (NTUSER)
  	+ NOTE profile software-all was updated
  	+ NOTE profiles '-all' DO NOT contain plugins TLN versions: you must create your own profiles or use them directly
  	+ NOTE RegRipperPluginsPackage (RRPP) counts 236 plugins


author: Lawrence R. Rogers <lrr@cert.org> 20130404-1
changelog:
  * Release 20130404
  	+ NOTE: these are the packager's comments on what is new in this release, not the authors.

  	+ NEW PLUGIN	attachmgr.pl		The Windows Attachment Manager manages how attachments are handled,
  						and settings are on a per-user basis.  Malware has been shown to access
  						these settings and make modifications.
  	+ NEW PLUGIN	javasoft.pl		Gets contents of JavaSoft/UseJava2IExplorer value
  	+ NEW PLUGIN	lsa_packages.pl		Lists various *Packages key contents beneath LSA key
  	+ NEW PLUGIN	olsearch.pl		Gets contents of user's OutLook Searches
  	+ NEW PLUGIN	outlook2.pl		Gets MAPI (Outlook) settings *BETA*
  	+ NEW PLUGIN	photos.pl		Read data on images opened via Win8 Photos app
  	+ NEW PLUGIN	scanwithav.pl		Checks ScanWithAV value in Software hive, per KB 883260
  	+ NEW PLUGIN	uac.pl			Get User Account Control (UAC) Values from HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

  	+ UPDATE	appinitdlls.pl		updated to address 64-bit systems
  	+ UPDATE	ares.pl			updated based on data provided by J. Weg
  	+ UPDATE	ie_settings.pl		added "AutoConfigURL" value info
  	+ UPDATE	inprocserver.pl		fixed retrieving LW time from correct key
  	+ UPDATE	landesk.pl		added Wow6432Node path
  	+ UPDATE	sevenzip.pl		minor updates added
  	+ UPDATE	soft_run.pl		updated to include Policies keys; added additional keys
  	+ UPDATE	ssh_host_keys.pl	Added rptMsg for key not found errors by Corey Harrell
  	+ UPDATE	termserv.pl		updated with autostart locations
  	+ UPDATE	user_run.pl		added additional keys; updated to include Policies keys;
  						updated to include additional keys; updated to include 64-bit, additional keys/values
  	+ UPDATE	winlogon_u		updated with ThreatExpert info
  	+ UPDATE	winscp_sessions.pl	Added rptMsg for key not found errors by Corey Harrell

  	+ NOTE RegRipperPluginsPackage (RRPP) now counts 236 plugins


author: Lawrence R. Rogers <lrr@cert.org> 20130429-1
changelog:
  * Release 20130429-1
  	Includes the following changes
  		20130429
  			created winlogon_tln.pl, applets_tln.pl
  			added alertMsg() func. to:
  				brisv.pl, inprocserver.pl, inprocserver_u.pl, iejava.pl, spp_clients.pl
  			retired scanwithav.pl (func. included in attachmgr.pl)
  			retired taskman.pl (func. included in winlogon.pl)
  			retired vista_wireless.pl (func. in networklist.pl)
  		20130425
  			RegRipper and rip updated to v2.8; added alertMsg() capability
  			retired userinit.pl (functionality included in winlogon.pl)
  			created new plugins
  				srun_tln.pl, urun_tln.pl,cmdproc_tln.pl
  				-cmd_shell_tln.pl,muicache_tln.pl
  			added alertMsg() functionality to rip.pl, rr.pl, and plugins
  				appcompatcache.pl, appcompatcache_tln.pl
  				appinitdlls.pl
  				soft_run.pl, user_run.pl
  				imagefile.pl
  				winlogon.pl, winlogon_u.pl
  				muicache.pl (look for values with "Ttemp" paths)
  				attachmgr.pl (look for values per KB 883260)
  				virut.pl
  				cmdproc.pl, cmd_shell.pl
  		20130411
  			retired specaccts.pl & notify.pl; incorporated functionality into winlogon.pl
  		20130410
  			retired taskman.pl; merged into winlogon.pl
  			updated winlogon.pl (Wow6432Node support, etc.)
  			updated winlogon_u.pl (Wow6432Node support)
  			updated shellexec.pl, imagefile.pl, installedcomp.pl (Wow6432Node support)
  		20130409
  			added drivers32.pl (C. Harrell) to the archive
  		20130408
  			updated bho.pl to support Wow6432Node
  		20130405
  			updated cmd_shell.pl to include Clients subkey in the Software hive
  			created cmd_shell_u.pl
  			fixed issue with rip.exe syntax info containing 'rr'
  			fixed banner in findexes.pl
  	+ NOTE RegRipperPluginsPackage (RRPP) counts 285 plugins


author: Fabian Affolter <fabian@bernewireless.net> - 1.7-1
changelog:
  - New --forceopen option to wait for removable drives to come back
  - New -c (continue) option to resume when copying directly unto devices
  - Return codes:  (0 for success, 2 for abort/ error, 1 for incomplete copy)
  - Adapted test suite to test for these return codes
  - Code cleanup


author: <scalpel@digitalforensicssolutions.com> 2.0-1
changelog:
  Public release, with multithreading, asynchronous I/O, regular expression
  	support, minimum carve sizes.  Blockmap features are currently
  	removed, since they are being rewritten.  We have also deprecated
  	the -s option, since it is broken.  A new skip option based on
  	blockmaps will be introduced in the next major release and will
  	allow specific areas of disk images to be targeted for carving.


author: Stef Walter <stef@memberwebs.com> 0.8.5
changelog:
  - Ported to Linux/FreeBSD
   - Support for very fragmented MFTs
   - Fixed memory leaks
   - Fixed many bugs


author: Stef Walter <stef@memberwebs.com> 0.8.6
changelog:
  - Don't exit on error reading source drive [Marius Hillenbrand]
   - Fixed core dump when attribute list, but no MFT loaded [Marius Hillenbrand]


author: Stef Walter <stef@memberwebs.com> 0.8.7
changelog:
  - Fix crasher on corrupted drives. A problem with update 
     sequence offset being filled with garbage [Albert Kwok]


author: Lawrence R. Rogers <lrr@cert.org> 3.18.0-1/2
changelog:
  * Release 3.18.0-1/2
  	rwsetcat
  		When --ip-format includes zero-padded and CIDR prefixes are being printed, also apply zero-padding to the prefix.
  		Fix a bug when using --ip-format=decimal,zero-padded that caused an extra leading 0 to appear for IPv6 addresses.
  	rwbagcat
  		When --key-format includes zero-padded and CIDR prefixes are being printed, also apply zero-padding to the prefix.
  		Fix a bug when using --key-format=decimal,zero-padded that caused an extra leading 0 to appear for IPv6 addresses.
  	rwpmapcat, rwpmaplookup
  		When --ip-format includes zero-padded and CIDR prefixes are being printed, also apply zero-padding to the prefix.
  		Fix a bug when using --ip-format=decimal,zero-padded that caused an extra leading 0 to appear for IPv6 addresses.
  		Fix a bug when using --ip-format=unmap-v6 where the prefix for IPs in the ::ffff:0:0/96 netblock was not adjusted to IPv4.
  	rwcut, rwrecgenerator, rwstats, rwuniq
  		Fix a bug when using --ip-format=decimal,zero-padded that caused an extra leading 0 to appear for IPv6 addresses.
  	rwsender, rwreceiver
  		Change optional TLS support to require GnuTLS-2.12.0 or later.
  		Add a --tls-priority switch to set the priority (preference order) of ciphers, key exchange, etc.
  		Add a --tls-security switch to set the security level of GnuTLS which determines cryptographic key sizes and security parameters.
  		Add a --tls-crl switch to set a certificate revocation list.
  		Add a --tls-debug-level to set the debugging level of GnuTLS.
  		Not setting RWSENDER_TLS_PASSWORD/RWRECEIVER_TLS_PASSWORD is now treated as a NULL password, not an empty password.
  		Exit with an error when any of the switches --tls-ca, --tls-cert, --tls-key, or --tls-pkcs12 are specified multiple times.
  		Use GnuTLS's socket reading/writing functions instead of our own.
  	rwflowpack
  		Fix a bug that could cause rwflowpack to crash when multiple probes were processing IPFIX files.


author: Lawrence R. Rogers <lrr@cert.org> 3.19.0-1/2
changelog:
  * Release 3.19.0-1/2
  	rwaggbag, rwaggbagbuild, rwaggbagcat, rwaggbagtool
  		Support using country codes as key fields.
  	rwflowpack, flowcap
  		Support a show-templates log-flag value in the sensors.conf file which enables printing of templates for specific probes.


author: Lawrence R. Rogers <lrr@cert.org> 3.19.1-1/2
changelog:
  * Release 3.19.1-1/2
  	Add the SilkFile.skip() method to PySiLK.
  	Fix PySiLK compatiblity with Python 3.7 and 3.8.
  	Fix a compilation error when building SiLK without libfixbuf.


author: Lawrence R. Rogers <lrr@cert.org> - 3.10.2-1
changelog:
  * Release 3.10.2-1
  	libskipset
  		Change skipaddrString() when flags is SKIPADDR_FORCE_IPV6 so that a single 16-bit 0 field is not shortened (RFC5952).
  	rwsetcat
  		Change the printing of IPs when the --ip-format is 'force-ipv6' so that a single 16-bit 0 field is not shortened (RFC5952).
  		Fix a bug in the output of --network-structure when reading an IPv4 IPset file and the --ip-format was 'force-ipv6' where the net block prefix was not adjusted for the move into IPv6.
  		Fix a bug in the output of --network-structure=v4:... when reading an IPv6 IPset file that produced net blocks counts that were incorrect and sometimes impossibly large.
  		Fix a display bug of a narrow IP column when processing an IPv4 IPset file and the --ip-format was 'force-ipv6'.


author: Lawrence R. Rogers <lrr@cert.org> - 3.11.0-1
changelog:
  * Release 3.11.0-1
  	libskipset
  		Add functions to process an IPset without reading it into memory.
  		Change definition of skipset_iterator_t.
  		Change some skIPTree* APIs from macros to functions and vice versa.
  		Fix a bug in skIPSetIteratorNext() and skIPSetWalk() when visiting the individual IPs of an IPv6 IPset and numeric prefix of the current leaf is 64 or less.
  		Additional changes.
  	rwsetcat
  		Add support for the SILK_IP_FORMAT environment variable that provides a default value for the --ip-format switch.
  		Allowing printing of IPset contents without reading the IPset into memory.
  	rwsettool
  		Avoid reading an IPset into memory when possible.
  	rwsetbuild
  		Print an error and exit when the --ip-ranges delimiter is set to the comment character('#'), newline, or the empty string.


author: Lawrence R. Rogers <lrr@cert.org> - 3.12.0-1
changelog:
  * Release 3.12.0-1
  	ibskipset
  		Fix a bug in the code that copies an memory-mapped IPset prior to modifying it.


author: Lawrence R. Rogers <lrr@cert.org> - 3.13.0-1
changelog:
  * Release 3.13.0-1
  	Change across all tools
  		Add support for compressing files with "Snappy" compression when the Snappy library and header are found during configuration.
  		Add support for the SILK_COMPRESSION_METHOD environment variable that provides a default value for the --compression-method switch.
  	rwsettool
  		Add a --symmetric-difference switch to compute the set of IP addresses that occur in only one of two input IPsets.
  		Add more examples to the manual page.
  	rwsetcat
  		Add many more examples to the manual page.
  	libskipset
  		Rename functions sksiteCompmethod...() to skCompMethod...().
  		Rename functions sksiteFileformat...() to skFileFormat...().
  		Remove some skHeader...() functions from the public headers.


author: Lawrence R. Rogers <lrr@cert.org> - 3.14.0-1
changelog:
  * Release 3.14.0-1
  	libskipset changes
  		Add a new file format, record-version=5, for IPsets that contain IPv6 addresses.
  		Fix a bug when working with IPsets that contain IPv6 addresses and have more than 44,739,242
  		 internal nodes. The bug may cause the tool to crash or to loop endlessly.
  		Reduce how quickly memory grows when building an IPset that contains IPv6 addresses.
  		Perform additional integrity checks when reading an IPset file from disk.
  		Add support for printing a more detailed error message when attempting to read an IPset file. The
  		 message is printed when the SILK_IPSET_PRINT_READ_ERROR environment variable is set.
  	rwsetbuild
  		Fix a bug introduced in SiLK IPset-3.11.0 that may occur when computing the intersection or
  		 difference of an IPv4 IPset with an IPv6 IPset that is in record-version=4 format. Addresses in
  		 the ::ffff:0:0/96 netblock of the IPv6 IPset were ignored when the IPset contained clusters of
  		 addresses less then ::ffff:0:0.
  	rwsetcat
  		Add support for counting the IP addresses in an IPset without loading the IPset into memory.
  		Fix a bug where a completely full IPv6 IPset would report it contained 0 IPs.
  	Building
  		Add a configure switch, --enable-ipset-compatibility, that allows changing the default IPset file
  		 format written by the tools. The argument is the version of SiLK IPset with which IPsets are to
  		 be compatible. New file formats were added at 3.7.0 and 3.14.0.


author: Lawrence R. Rogers <lrr@cert.org> - 3.15.0-1
changelog:
  * Release 3.15.0-1
  	libskipset changes
  		Add a second argument to skOptionsIPFormatRegister().
  		Remove functions that operate on an IPset Header Entry.
  		Fix a potential bug in skIPSetWrite() by ensuring that the IPset file's header is set to use native byte order.
  	rwsetcat
  		Add the --output-path switch to specify the output file.
  		Do not use the the pager when the output contains only the count of the number of IPs in a singe IPset.


author: Lawrence R. Rogers <lrr@cert.org> - 3.16.0-1
changelog:
  * Release 3.16.0-1
  	libskipset changes
  		Internal changes
  	rwsetbuild, rwsetcat, rwsetmember, rwsettool
  		Enhance the manual pages.


author: Lawrence R. Rogers <lrr@cert.org> - 3.17.0-1
changelog:
  * Release 3.17.0-1
  	rwsetcat
  		POTENTIAL INCOMPATIBILITY. Default to using the IPv4 format for IPv6-addresses in the ::ffff:0:0/96 netblock.
  		Add new values to the --ip-format switch and change how some values (zero-padded) work.
  	libskipset changes
  		Add new values to skipaddr_flags_t.
  		Add function skipaddrStringMaxlen() to compute column width.
  		Mark the num2dot0() and num2dot0_r() functions as deprecated.
  		Do not export the structures used by SiLK header entries.


author: Lawrence R. Rogers <lrr@cert.org> - 3.18.0-1
changelog:
  * Release 3.18.0-1
  	rwsetcat
  		When --ip-format includes zero-padded and CIDR prefixes are being printed, also apply zero-padding to the prefix.
  		Fix a bug when using --ip-format=decimal,zero-padded that caused an extra leading 0 to appear for IPv6 addresses.
  	libskipset changes
  		Add function skipaddrCidrString() to get a string representation of an IP address and its CIDR designation.
  		Add function skipaddrCidrStringMaxlen() to compute column width.
  		Add macro SKIPADDR_CIDR_STRLEN for defining minimum buffer size.


author: Lawrence R. Rogers <lrr@cert.org) 4.6.1-1
changelog:
  - Release 4.6.1-1
  	Lots of bounds checking fixes from Google's fuzzing tests. Thanks Goole.
  	Cleanup and fixes from uckelman-sf and others
  	PostgreSQL, libvhdi, & libvmdk are supported for Linux / OS X
  	Fixed display of NTFS GUID in istat - report from Eric Zimmerman.
  	NTFS istat shows details about all FILE_NAME attributes, not just the first. report from Eric Zimmerman.


author: Lawrence R. Rogers <lrr@cert.org) 4.6.2-1
changelog:
  - Release 4.6.2-1
  	C/C++ Code:
  	- Various compiler warning fixes
  	- Added small delay into image writer to not starve other threads

  	Java: 
  	- Added more locking to ensure that handles were not closed while other threads were using them. 
  	- Added APIs to support more queries by data source
  	- Added memory-based caching when detecting if an object has children or not.


author: Lawrence R. Rogers <lrr@cert.org) 4.6.2-2
changelog:
  - Release 4.6.2-2
  	Built with Java support. Release number is greater than the release for Fedora 28 and 27.


author: Lawrence R. Rogers <lrr@cert.org) 4.6.3-1
changelog:
  - Release 4.6.3-1
  	C/C++ Code:
  		Hashdb bug fixes for corrupt indexes and 0 hashes
  		New code for testing power of number in ExtX code
  	Java Code:
  		New class that allows generic database access
  		New methods that check for duplicate artifacts
  		Added caches for frequently used content
  	Database Schema:
  		Added Examiner table
  		Tags are now associated with Examiners
  		Changed parent_path for logical files to be consistent with FS files.


author: Lawrence R. Rogers <lrr@cert.org) 4.6.4-1
changelog:
  - Release 4.6.4-1
  	Java Code:
  		Increase max statements in database to prevent errors under load
  		Have a max timeout for SQLite retries


author: Lawrence R. Rogers <lrr@cert.org) 4.6.5-1
changelog:
  - Release 4.6.5-1
  	C/C++ Code:
  		HFS boundary check fix
  	Java Code:
  		New artifacts and attributes defined
  		Fixed bug in SleuthkitCase.getContentById() for data sources
  		Fixed bug in LayoutFile.read() that could allow reading past end of file
  	Case Database Schema:
  		New fields for hash values and acquisition details in case database
  		Store "created schema version" in case database


author: Lawrence R. Rogers <lrr@cert.org) 4.6.6-1
changelog:
  - Release 4.6.6-1
  	C/C++ Code:
  		Acquisition deteails are set in DB for E01 files
  		Fix NTFS decompression issue (from Joe Sylve)
  		Image reading fix when cache fails (Joe Sylve)
  		Fix HFS+ issue with large catalog files (Joe Sylve) 
  		Fix free memory issue in srch_strings (Derrick Karpo)
  	Java:
  		Fix so that local files can be relative
  		More Blackboard artifacts and attributes for web data
  		Added methods to CaseDbManager to enable checking for and modifying tables.
  		APIs to get and set acquisition details
  		Added methods to add volume and file systems to database
  		Added method to add LayoutFile for allocated files
  		Changed handling of JNI handles to better support multiple cases


author: Lawrence R. Rogers <lrr@cert.org> 0.1.1-1
changelog:
  * Release 0.1.1-1
  	Add automated test suite.
  	Improve documentation.
  	Daemonize snarfd properly.
  	Python API improvements.
  	Various bug fixes.


author: Lawrence R. Rogers <lrr@cert.org> 0.2.0-1
changelog:
  * Release 0.2.0-1
  	Move all hard-coded sink configuration into configuration file
  	Documentation updates


author: Lawrence R. Rogers <lrr@cert.org> 0.2.1-1
changelog:
  * Release 0.2.1-1
  	Add facility to reload snarf conf file when it's modified.
  	Add basic channel statistics (alerts processed per channel) functionality
  	Fix segfault when trying to print TCP flags for non-TCP protocols.


author: Lawrence R. Rogers <lrr@cert.org> 0.2.2-3
changelog:
  * Release 0.2.2-3
  	Rebuild to eliminate protobuf-c-devel as a run time dependency (this was an error).


author: Lawrence R. Rogers <lrr@cert.org> 0.2.4-1
changelog:
  * Release 0.2.4-1
  	Support non-flow ip address fields in alerts.
  	Fix ZeroMQ compatibility problems, now requires ZeroMQ 2.2.x.
  	Fix problem with certain GLib2 version / platform combinations.


author: Lawrence R. Rogers <lrr@cert.org> 2.9.12-1
changelog:
  - Release 2.9.12-1
  	New Additions
  		Parsing HTTP CONNECT to extract the tunnel IP and port information.
  		Alerting and dechunking for chunked encoding in HTTP1.0 request and response.
  	Improvements
  		Fixed an issue where, if we have a junk line before HTTP response header, the header was wrongly parsed.
  		Fixed GZIP evasions where an HTTP response with content-encoding:gzip contains a body that has a GZIP-related anomaly.
  		Fixed an issue in certain scenarios where a BitTorrent pattern is seen only on the third packet of the session, causing us to miss our client detection.
  		SMB improvements for file detection and processing.


author: Lawrence R. Rogers <lrr@cert.org> 2.9.13.0-1
changelog:
  - Release 2.9.13.0-1
  	New Additions
  		Snort now supports reload on snort rules update.
  		Addition of a scenario to add a packet to blacklist verdict to ensure the new session will be allowed.
  		Handled a new pre-processor alert in case of the improper end of t HTTP header.
  	Improvements
  		Modified the calculation of file hash for FTP/HTTP with offset values.
  		Fixed portal authentication connection stuck in half closed state.
  		Updated UDP global timeout for a non-standard port.


author: Lawrence R. Rogers <lrr@cert.org> 2.9.14.1-1
changelog:
  - Release 2.9.14.1-1
  	New Additions
  		Added support for wild card port numbers in host cache and overwriting port service AppId.
  		Added support for new STLS client patterns to help better detect POP3S over SSL.
  		Added support for detecting Mac based SMTP Microsoft Outlook client application.
  		Added a new preprocessor alert 120:27 to alert if there is no proper end of header.
  	Improvements / Fix
  		Improved appId detection for proxied traffic.
  		Fix for enabling flow profiling mode without restarting snort detection engine.
  		Fixed packet drop scenario.


author: Lawrence R. Rogers <lrr@cert.org> 2.9.15-1
changelog:
  - Release 2.9.15-1
  	 New Additions
  		Added new debugs to print detection, file_processing and Preproc time consumption info and verdict.
  		Added support to detect new Korean file formats .egg and .alg in the file preprocessor.
  		Added support to detect new RAR file-type in the file preprocessor.
  	Improvements / Fix
  		Fix to generate ALERT if TEID value is zero in GTP v1 and v2 packets.
  		Fix to whitelist ftp data sessions when no file policy exists.
  		Fix RTF file magic to a more generic value to prevent evasions.
  		Added debug logs during HTTP reload
  		Added rule SID check during validation
  		Fix an issue where HTTP was processing non-HTTP traffic on port 443
  		Added new debugs to print detection, file processing, and Prepro time consumption info and verdicts


author: Lawrence R. Rogers <lrr@cert.org> 2.9.15.1-1
changelog:
  - Release 2.9.15.1-1
  	New Additions
  		Added support for glibc version 2.30.
  	Improvements / Fix
  		Fixed snort core seen during ssl re-configuration.
  		Fixed file access issues on files from SMB share.


author: Lawrence R. Rogers <lrr@cert.org> 2.9.16-1
changelog:
  - Release 2.9.16-1
  	New Additions
  		Added support for early inspection of HTTP payload before flushing in pre-ack mode.
  		  This feature can be enabled using fast_blocking in http inspect configuration.
  		Added 64-bit support for Windows 10 operating system.
  		Added support for glibc version 2.30.
  	Improvements and fixes
  		Fixed file policy not working with character prefix in chunk size.
  		Updated the file magic to detect ALZ file types.
  		Addressed an issue when out-of-order FIN is received by dropping it.
  		Normalize randomly encoded nulls interspersed in the HTTP server response to UTF-8.


author: Lawrence R. Rogers <lrr@cert.org> 2.9.16.1-1
changelog:
  - Release 2.9.16.1-1
  	New Additions
  		Added support for GCC version 10.1.1.
  	Improvements / Fix
  		Added packet counters to make sure flows with one-way data don't pend forever.
  		Fixed potential race condition between reload and exit path.


author: Lawrence R. Rogers <lrr@cert.org> 2.9.16.1-2
changelog:
  - Release 2.9.16.1-2
  	Version 2.9.16.1 enables OpenAppID by default and it needs to be explicitly disabled.


author: Lawrence R. Rogers <lrr@cert.org> 2.9.17.0-1
changelog:
  - Release 2.9.17.0-1
  	New Additions
  		Added support for s7Commplus protocol.
  		Support for allowing common names across rule options.
  		Added support to detect TCP Fast Open packets. 
  	Improvements / Fix
  		Added support for HTTP range field parsing to detect if HTTP response/request is indeed partial or full content.
  		Fixed TCP segment queue hole issue as per the RFC793 recommendation for OOO Ack packet handling.
  		Fixed multiple static analysis issues.
  		Miscellaneous SMB bug fixes.


author: Lawrence R. Rogers <lrr@cert.org> - 1.7.3.0-1
changelog:
  * Release 1.7.3.0
  security:
  	(CVE Id pending)
  	Fixed problems with signal handling caused by use of not async signal
  	safe functions in signal handlers that could freeze socat, allowing
  	denial of service attacks.
  	Many changes in signal handling and the diagnostic messages system were
  	applied to make the code async signal safe but still provide detailled
  	logging from signal handlers:
  	Coded function vsnprintf_r() as async signal safe incomplete substitute
  	of libc vsnprintf()
  	Coded function snprinterr() to replace %m in strings with a system error
  	message
  	Instead of gettimeofday() use clock_gettime() when available
  	Pass Diagnostic messages from signal handler per unix socket to the main
  	program flow
  	Use sigaction() instead of signal() for better control
  	Turn off nested signal handler invocations
  	Thanks to Peter Lobsinger for reporting and explaining this issue.

  	Red Hat issue 1019975: add TLS host name checks
  	OpenSSL client checks if the server certificates names in
  	extensions/subjectAltName/DNS or in subject/commonName match the name
  	used to connect or the value of the openssl-commonname option.
  	Test: OPENSSL_CN_CLIENT_SECURITY

  	OpenSSL server checks if the client certificates names in
  	extensions/subjectAltNames/DNS or subject/commonName match the value of
  	the openssl-commonname option when it is used.
  	Test: OPENSSL_CN_SERVER_SECURITY

  	Red Hat issue 1019964: socat now uses the system certificate store with
  	OPENSSL when neither options cafile nor capath are used

  	Red Hat issue 1019972: needs to specify OpenSSL cipher suites
  	Default cipherlist is now "HIGH:-NULL:-PSK:-aNULL" instead of empty to
  	prevent downgrade attacks

  new features:
  	OpenSSL addresses set couple of environment variables from values in
  	peer certificate, e.g.: 
  	SOCAT_OPENSSL_X509_SUBJECT, SOCAT_OPENSSL_X509_ISSUER,
  	SOCAT_OPENSSL_X509_COMMONNAME, 
  	SOCAT_OPENSSL_X509V3_SUBJECTALTNAME_DNS
  	Tests: ENV_OPENSSL_{CLIENT,SERVER}_X509_*

  	Added support for methods TLSv1, TLSv1.1, TLSv1.2, and DTLS1
  	Tests: OPENSSL_METHOD_*

  	Enabled OpenSSL server side use of ECDHE ciphers. Feature suggested
  	by Andrey Arapov.

  	Added a new option termios-rawer for ptys.
  	Thanks to Christian Vogelgsang for pointing me to this requirement

  corrections:
  	Bind with ABSTRACT commands used non-abstract namespace (Linux).
  	Test: ABSTRACT_BIND
  	Thanks to Denis Shatov for reporting this bug.

  	Fixed return value of nestlex()

  	Option ignoreeof on the right address hung.
  	Test: IGNOREEOF_REV
  	Thanks to Franz Fasching for reporting this bug.

  	Address SYSTEM, when terminating, shut down its parent addresses,
  	e.g. an SSL connection which the parent assumed to still be active.
  	Test: SYSTEM_SHUTDOWN

  	Passive (listening or receiving) addresses with empty port field bound
  	to a random port instead of terminating with error.
  	Test: TCP4_NOPORT

  	configure with some combination of disable options produced config
  	files that failed to compile due to missing IPPROTO_TCP.
  	Thanks to Thierry Fournier for report and patch.

  	fixed a few minor bugs with OpenSSL in configure and with messages

  	Socat did not work in FIPS mode because 1024 instead of 512 bit DH prime
  	is required. Thanks to Zhigang Wang for reporting and sending a patch.

  	Christophe Leroy provided a patch that fixes memory leaks reported by
  	valgrind

  	Help for filan -L was bad, is now corrected to:
  	"follow symbolic links instead of showing their properties"

  	Address options fdin and fdout were silently ignored when not applicable
  	due to -u or -U option. Now these combinations are caught as errors.
  	Test: FDOUT_ERROR
  	Issue reported by Hendrik.

  	Added option termios-cfmakeraw that calls cfmakeraw() and is preferred
  	over option raw which is now obsolote. On SysV systems this call is
  	simulated by appropriate setting.
  	Thanks to Youfu Zhang for reporting issue with option raw.

  porting:
  	Socat included <sys/poll.h> instead of POSIX <poll.h>
  	Thanks to John Spencer for reporting this issue.

  	Version 1.7.2.4 changed the check for gcc in configure.ac; this
  	broke cross compiling. The particular check gets reverted.
  	Thanks to Ross Burton and Danomi Manchego for reporting this issue.

  	Debian Bug#764251: Set the build timestamp to a deterministic time:
  	support external BUILD_DATE env var to allow to build reproducable
  	binaries

  	Joachim Fenkes provided an new adapted spec file.

  	Type bool and macros Min and Max are defined by socat which led to
  	compile errors when they were already provided by build framework.
  	Thanks to Liyu Liu for providing a patch.

  	David Arnstein contributed a patch for NetBSD 5.1 including stdbool.h
  	support and appropriate files in Config/

  	Lauri Tirkkonen contributed a patch regarding netinet/if_ether.h
  	on Illumos

  	Changes for Openindiana: define _XPG4_2, __EXTENSIONS__,
  	_POSIX_PTHREAD_SEMANTICS; and minor changes

  	Red Hat issue 1182005: socat 1.7.2.4 build failure missing
  	linux/errqueue.h
  	Socat failed to compile on on PPC due to new requirements for
  	including <linux/errqueue.h> and a weakness in the conditional code.
  	Thanks to Michel Normand for reporting this issue.

  doc:
  	In the man page the PTY example was badly formatted. Thanks to
  	J.F.Sebastian for sending a patch.

  	Added missing CVE ids to security issues in CHANGES

  testing:
  	Do not distribute testcert.conf with socat source but generate it
  	(and new testcert6.conf) during test.sh run.


author: Lawrence Rogers <lrr@cert.org> 2.7-1
changelog:
  * Release 2.7-1
  	Version 2.7 - 30 Sep 2011
  		* New Features
  		  - Added the capability to process the first 100MB of data
  		    from standard input.
  		  - Added a warning message when the program does not process
  		    any file large enough to produce a meaningful result.
  		* Bug Fixes
  		  - Standard errors are now sent to stderr, not stdout.


author: Lawrence Rogers <lrr@cert.org> 2.8-1
changelog:
  * Release 2.8-1
  	Version 2.8 - 25 May 2012
  		* ChangeLog: Clean up
  		* Commented out all references to clustering
  		* configure.ac: Added AC_SYS_LARGEFILE to handle large files on 32-bit platforms. See bug 3416762.
  		* engine.cpp: Added const definitions
  		* Experimental conversion to C++
  		* fuzzy.h: Cleanup and commenting
  		* main.c: Bump copyright to 2012 in usage message. Add flag for clustering
  		* main.c: Fixed error handling in getopt processing
  		* main.cpp: Fixed some bugs in the command line argument processing
  		* main.cpp: Updated command line argument processing
  		* main.h: Added mode_cluster
  		* Makefile.am: LF to CR/LF change now done by zip program
  		* match.cpp: Convert to C++
  		* match.cpp: Fixed bug in Win32 filename construction
  		* ssdeep.1: Clarifications on description.
  		* ssdeep.1: Updating support for stdin, clarifying modes
  		* ssdeep.h: Adding Doxygen comments
  		* ui.c: Changed Win32 to use fputc instead of _tfprintf for filenames


author: Lawrence Rogers <lrr@cert.org> 2.9-1
changelog:
  * Release 2.9-1
  	Version 2.9 - 23 Jul 2012
  	* New Features
  		- Added warning message for when some data on stdin is not hashed.
  		- Can now hash up to 512MB of data on stdin.
  		- Added clustering mode to group together matching files
  	* Bug Fixes
  		- Fixed incorrect match scores for hashes with long filenames.


author: Lawrence Rogers <lrr@cert.org> 2.10-1
changelog:
  * Release 2.10-1
  	Changes:
  	    * Fuzzy Hashing engine re-written to be thread safe.
  	    * Able to handle long file paths on Win32.
  	    * Fixed bug on comparing signatures with the same block size.
  	    * Fixed crash on comparing short signatures.


author: Lawrence Rogers <lrr@cert.org> 2.11-1
changelog:
  * Release 2.11-1
  	* New Features
  		- Added fuzzy_clone function to the API.
  		- Moved to modern Win32 compiler.
  	* Bug Fixes
  		- Fixed edge case on signature generaion. Behavior now matches v2.9 again.


author: Lawrence Rogers <lrr@cert.org> 2.12-1
changelog:
  * Release 2.12-1
  	2014-10-24: Jesse Kornblum <research@jessekornblum.com>:
  		* Makefile.am: Adding edit_dist.h

  	2014-10-20: Jesse Kornblum <research@jessekornblum.com>:
  		* edit_dist.c: Replaced with new, explicitly GPL licensed code.
  		* fuzzy.c: Removed edit distance function prototype
  		* edit_dist.h: Added edit distance function prototype

  	2014-10-16: Jesse Kornblum <research@jessekornblum.com>:
  		* configure.ac: Version bump to 2.12
  		* fuzzy.c: Fixed bug when comparing identical hashes, bug #16.
  		* normal.sh: Use multiple cores when compiling


author: Lawrence Rogers <lrr@cert.org> 2.13-1
changelog:
  * Release 2.13-1
  	2015-04-24: Jesse Kornblum <research@jessekornblum.com>:
  		* ssdeep.1, NEWS: Updated release date

  	2015-04-01: Tsukasa OI <floss_ssdeep@irq.a4lg.com>:
  		* dig.cpp: Support arbitrary length input from the standard input.

  	2014-11-07: Tsukasa OI <floss_ssdeep@irq.a4lg.com>:
  		* edit_dist.c: Made code more portable
  		* fuzzy.c: Multiple bug fixes

  	2014-10-24: Jesse Kornblum <research@jessekornblum.com>:
  		* Makefile.am: Adding edit_dist.h

  	2014-10-20: Jesse Kornblum <research@jessekornblum.com>:
  		* edit_dist.c: Replaced with new, explicitly GPL licensed code.
  		* fuzzy.c: Removed edit distance function prototype
  		* edit_dist.h: Added edit distance function prototype


author: Lawrence Rogers <lrr@cert.org> 2.14.1-1
changelog:
  * Release 2.14.1-1
  	** Version 2.14.1 - 7 Nov 2017
  	  * Bug Fixes
  	    - Fixed a spelling error.
  	    - Made relative path mode on Win32 to work.
  	** Version 2.14 - 12 Sep 2017
  	  * New Features
  	    - Optimizations to the fuzzy hashing engine. (hash generator can run as twice
  	      as fast and comparison can run 1.5 through 5 times faster [heavily depends
  	      on the data and platform] than the previous release)
  	  * Bug Fixes
  	    - Fixed issue when certain memory allocation is failed.


author: Lawrence R. Rogers <lrr@cert.org> - 1.7.0-1
changelog:
  * Release 1.7.0-1
  	Support for FixBuf 2.3.0 added, and is now required.
  	New YAF stats messages supported.
  	New Tombstone format supported.
  	Race condiditon addressed when exporter configured to GZIP and MOVE files.
  	Dynamically generated dedup template names added.
  	Option record bugfixes.


author: Lawrence R. Rogers <lrr@cert.org> 1.7.1-1
changelog:
  * Release 1.7.1-1
  	Added ability to preserve observation domain of incoming records.
  	Changed scope of Tombstone records to 3 for consistency with YAF.
  	Fixed a crash when TCP collector and CLI --input are used concurrently.


author: Simson Garfinkel <simsong@alphonse-mucha.home> 1.0.6-1
changelog:
  * Release 1.0.6-1
  	* src/tcpflow.h (flow_state_struct): added bytes_printed counter
  	* src/tcpip.c (print_packet): modified to respect bytes_per_flow
  	* src/main.c (main): removed prepending of (ip or ip6 or vlan) from user expressions. We now just use what the user provided.
  	* src/flow.c (open_file): replaced FGETPOS(flow_state->fp, &(flow_state->pos)) with ftell()
  	* src/tcpip.c (store_packet): FSETPOS replaced with fseek (it's better now than in 1999)
  	* src/util.c: applied ipv6 patches
  	* src/tcpip.c: applied ipv6 patches
  	* src/tcpflow.h: applied ipv6 patches
  	* src/sysdep.h: applied ipv6 patches
  	* src/main.c: applied ipv6 patches
  	* src/datalink.c: applied ipv6 patches
  	* configure.ac: applied ipv6 patches.
  	* src/sysdep.h: removed standards.h and added sys/cdefs.h.
  	* Makefile.am (EXTRA_DIST): added TODO.txt
  	* doc/tcpflow.1.in: updated doc to reflect new author and distribution point.
  	* src/main.c (print_usage): removed  "by Jeremy Elson <jelson@circlemud.org>" from usage.
  	* src/util.c (flow_filename): vlan changed from [42] to --42 to avoid some shell issues.
  	* Applied debian patch 20_fix-usage, which fixed the usage statement.
  	* manually applied debian patch 10_extra-opts, which improves color rendering and passes the state structure, rather than forcing it to be re-calculated.


author: Simson Garfinkel <simsong@alphonse-mucha.home> 1.2.3-1
changelog:
  * Release 1.2.3-1
  	* src/xml.cpp (xml::add_cpuid): better handling of CPUID instruction. Now it really should not show up on non-Intel architectures.
  	* src/xml.cpp: added unistd.h
  	* src/main.cpp (main): added printing stats for debug level 3.
  	* src/datalink.cpp (find_handler): changed 'looking for handler' to debug level 2.
  	* src/tcpip.cpp (tcpdemux::close_all): Jeremey's FD ring has been replaced with an unordere dset.
  	* src/tcpdemux.h (class tcpdemux): tcpdemux is now a class. By 1.3 it will be a linkable class separate from this program.
  	* configure.ac: added -funit-at-a-time 
  	* COPYING: updated to GPLv3
  	* src/xml.cpp (xml::xmlout): writing with size-length tag just outputs the value now.


author: Simson Garfinkel <simsong@alphonse-mucha.home> 1.2.6-1
changelog:
  * Release 1.2.6-1
  	* configure.ac: incremented version to 1.2.6 (1.2.5 had a bad tag)
  	* src/tcpip.cpp (tcpip::print_packet): fixed error in fwrite().
  	* src/main.cpp (print_usage): fixed misspelling of name
  	* src/tcpip.cpp (tcpdemux::tcpdemux): default outdir is now "."


author: Simson Garfinkel <simsong@alphonse-mucha.home> 1.2.7-1
changelog:
  * Release 1.2.7-1
  	* src/main.cpp (main):  -r option now allows for multiple files to be specified.
  	* src/main.cpp (main):  -R option now allows for incomplete tcp connections to be finished.
  	* src/main.cpp (main): removed global "tcpdemux demux" variable. Now it's passed as *user in the datalink methods, as it
  	  should be.
  	* src/tcpdemux.h (class tcpip): bytes_printed renamed to bytes_processed, as it will be used in packet processing as well.


author: Simson Garfinkel <simsong@alphonse-mucha.home> 1.2.8-1
changelog:
  * Release 1.2.8-1
  	* src/main.cpp (main): added calling process_infile(expression,device,"",true) when no files are provided to fix bug of no live capture.
  	* src/sysdep.h: removed; put code in tcpflow.h for simplicity
  	* src/datalink.cpp (dl_null): moved ETHERTYPE_IPV6 from sysdep.h to datalink.cpp 
  	* bootstrap.sh: added --add-missing to bootstrap.sh


author: Simson Garfinkel <simsong@alphonse-mucha.home> 1.2.9-1
changelog:
  * Release 1.2.9-1
  	* src/main.cpp (main): fixed compile bugs that resulted from adoption of standard DFXML header.
          * configure.ac (HAVE_PTHREAD): fixed typo in configure.ac
          * src/tcpdemux.h: removed struct ip as it was redundent to struct iphdr
          * configure.ac: tcpflow now compiles under mingw for Windows
          * src/tcpdemux.cpp: moved tcpdemux class methods into this new file.
          * src/tcpip.cpp (tcpip::close_file): added support for FUTIMENS, but I don't yet have a system on which to test it. Hope that it's good.


author: Simson Garfinkel <simsong@alphonse-mucha.home> 1.3.0-1
changelog:
  * Release 1.3.0-1
  	* src/tcpdemux.cpp (tcpdemux::process_tcp): fixed bug in which myflow.tlast wasn't being set.


author: Ville Laurikari <vl@iki.fi>
changelog:
  - fixed to work with recent rpmbuild versions (unpackaged files)
  - handling for multilib environments


author: Christophe Grenier <grenier@cgsecurity.org> - 6.14-2
changelog:
  - Rebuild for ntfs-3g-2014.2.15-6.el6 update (Bug #1157756)
  - Patch for additional ext2 check (Bug #1027026)


author: Guido Trotter <ultrotter@debian.org> 0.4a-1
changelog:
  * Release 0.4a-1
    [ Debian VSquare Team ]
    * Initial release

    [ Guido Trotter ]
    * Fix Build Dependencies
    * The "valentine for reenzo" release


author: Filippo Giunchedi <filippo@debian.org> 0.5-1
changelog:
  * Release 0.5-1
    [ Ludovico Gardenghi ]
    * New upstream release
      + fix loading of lwipv6 (Closes: #470462)
      + fix building on amd64 (Closes: #417047)
      + fix wrong include (Closes: #479979)

    [ Filippo Giunchedi ]
    * Move libumlib0-dev to libumlib-dev 
    * Update standard-versions to 3.8.0 (add Homepage and change Source-Version)


author: Ludovico Gardenghi <garden@debian.org>0.6-1
changelog:
  * Release 0.6-1
    [ Filippo Giunchedi ]
    * Add DM-Upload-Allowed field

    [ Ludovico Gardenghi ]
    * New upstream release
      + Fix "FTBFS: Cannot find linux/dirent.h" (new upstream corrects the
        path name and includes a .h with the needed definitions which are no
        more accessible.) (Closes: #527518)
    * Update standard-version to 3.8.1 (no changes needed).
    * Added missing misc:Depends to libumlib-dev.
    * Changed garden@acheronte.it with garden@debian.org.
    * Fixed versionless license file names.


author: Ludovico Gardenghi <garden@debian.org> 0.8.2-1
changelog:
  * Release 0.8.2-1
    * New upstream release
      + Remove um_lwip module (no more needed for lwip networking)
        (Closes: #663671)
      + New viewfs (replaces modifshide)
    * Update copyright file
      + New upstream URL (Closes: #674216)
      + canonicalize.c has been rewritten, removed LGPL part
    * Add libcap-dev and dpkg-dev to Build-Depends
    * Bump to Standards-Version 3.9.3
      + Remove .la files from libumlib-dev
      + Add missing comma in Depends field
    * Switch to machine-readable copyright file
    * Remove empty .dirs files


author: gregor herrmann <gregoa@debian.org> 0.8.2-1.1
changelog:
  * Release 0.8.2-1.1
    * Non-maintainer upload.
    * Fix "FTBFS: um_select.c:177: undefined reference to `__FDELT'":
      apply patch from Ubuntu / Ilya Barygin:
      - Fix FTBFS because of renamed macro.
      (Closes: #707402)
    * Build-depend on libvdeplug-dev, libvdeplug2-dev is only provided by
      libvdeplug-dev.
      Also taken from Ubuntu / Jeremy Bicha.
    * Apply patch from Thomas Funk that removes EPOLL_NONBLOCK.
      (Taken from upstream.)
    * Apply patch from Roland Stigge: add architecture powerpcspe in
      debian/control. (Closes: #734997)


author: Lawrence R. Rogers <lrr@cert.org> 0.2.5-3
changelog:
  * Release 0.2.5-3
  	Made links so that the tools, documentation, header files, and libraries have an alias of vmfs5.

  - Remove redundant tags/sections from specfile


author: Lawrence R. Rogers <lrr@cert.org> 0.9.3-1
changelog:
  * Release 0.9.3-1

  	Release 0.9.3 - July 8 2016
  	---------------------------

  	* Added check to :func:`add_table` to prevent duplicate header names which
  	  leads to a corrupt Excel file.
  	  Issue `#362 <https://github.com/jmcnamara/XlsxWriter/issues/362>`_.


  	Release 0.9.2 - June 13 2016
  	----------------------------

  	* Added workbook :func:`set_size` method to set the workbook window size.


  	Release 0.9.1 - June 8 2016
  	---------------------------

  	* Added font support to chart :func:`set_table`.

  	* Documented used of font rotation in chart :ref:`data labels
  	  <chart_series_option_data_labels>`.
  	  Issue `#337 <https://github.com/jmcnamara/XlsxWriter/issues/337>`_.


  	Release 0.9.0 - June 7 2016
  	---------------------------

  	* Added :ref:`trendline properties <chart_series_option_trendline>`:
  	  ``intercept``, ``display_equation`` and ``display_r_squared``.
  	  Feature request `#357 <https://github.com/jmcnamara/XlsxWriter/issues/357>`_.


  	Release 0.8.9 - June 1 2016
  	---------------------------

  	* Fix for :func:`insert_image` issue when handling images with zero dpi.
  	  Issue `#356 <https://github.com/jmcnamara/XlsxWriter/issues/356>`_.


  	Release 0.8.8 - May 31 2016
  	---------------------------

  	* Added workbook :func:`set_custom_property` method to set custom document
  	  properties.
  	  Feature request `#355 <https://github.com/jmcnamara/XlsxWriter/issues/355>`_.


  	Release 0.8.7 - May 13 2016
  	---------------------------

  	* Fix for issue when inserting read-only images on Windows.
  	  Issue `#352 <https://github.com/jmcnamara/XlsxWriter/issues/352>`_.

  	* Added :func:`get_worksheet_by_name()` method to allow the retrieval of a
  	  worksheet from a workbook via its name.

  	* Fixed issue where internal file creation and modification dates were in the
  	  local timezone instead of UTC.

  	Release 0.8.6 - April 27 2016
  	-----------------------------

  	* Fix for ``external:`` urls where the target/anchor contains spaces.
  	  Issue `#350 <https://github.com/jmcnamara/XlsxWriter/issues/350>`_.

  	Release 0.8.5 - April 17 2016
  	-----------------------------

  	* Added additional documentation on :ref:`ewx_pandas` and
  	  :ref:`pandas_examples`.

  	* Added fix for :func:`set_center_across` format method.


author: Lawrence R. Rogers <lrr@cert.org> 0.9.8-1
changelog:
  * Release 0.9.8-1
  	Release 0.9.8 - July 1 2017
  	---------------------------
  	* Fixed issue where spurious deprecation warning was raised in ``-Werror`` mode.
  	  Issue `#451 <https://github.com/jmcnamara/XlsxWriter/issues/451>`_.

  	Release 0.9.7 - June 25 2017
  	----------------------------
  	* Minor bug and doc fixes.

  	Release 0.9.6 - Dec 26 2016
  	---------------------------
  	* Fix for table with data but without a header.
  	  Issue `#405 <https://github.com/jmcnamara/XlsxWriter/issues/405>`_.
  	* Add a warning when the number of series in a chart exceeds Excel's limit
  	  of 255.
  	  Issue `#399 <https://github.com/jmcnamara/XlsxWriter/issues/399>`_.

  	Release 0.9.5 - Dec 24 2016
  	---------------------------
  	* Fix for missing `remove_timezone` option in Chart class.
  	  PR from Thomas Arnhold
  	  `#404 <https://github.com/jmcnamara/XlsxWriter/issues/404>`_.

  	Release 0.9.4 - Dec 2 2016
  	--------------------------
  	* Added user definable removal of timezones in datetimes. See the
  	  :func:`Workbook` constructor option ``remove_timezone`` and :ref:`Timezone
  	  Handling in XlsxWriter <timezone_handling>`.
  	  Issue `#257 <https://github.com/jmcnamara/XlsxWriter/issues/257>`_.
  	* Fix duplicate header warning in :func:`add_table` when there is only one
  	  user defined header.
  	  Issue `#380 <https://github.com/jmcnamara/XlsxWriter/issues/380>`_.
  	* Fix for `center_across` property in :func:`add_format`.
  	  Issue `#381 <https://github.com/jmcnamara/XlsxWriter/issues/381>`_.


author: Lawrence R. Rogers <lrr@cert.org> 1.0.2-1
changelog:
  * Release 1.0.2-1
  	Release 1.0.2 - October 14 2017
  	-------------------------------
  	* Fix for cases where the hyperlink style added in the previous release didn't work.
  	  Feature request `#455 <https://github.com/jmcnamara/XlsxWriter/issues/455>`_.

  	Release 1.0.1 - October 14 2017
  	-------------------------------
  	* Changed default :func:`write_url` format to the Excel hyperlink style so that
  	  it changes when the theme is changed and also so that it indicates that the
  	  link has been clicked.
  	  Feature request `#455 <https://github.com/jmcnamara/XlsxWriter/issues/455>`_.

  	Release 1.0.0 - September 16 2017
  	---------------------------------
  	* Added icon sets to conditional formatting. See
  	  :ref:`working_with_conditional_formats` and :ref:`ex_cond_format`.
  	  Feature request `#387 <https://github.com/jmcnamara/XlsxWriter/issues/387>`_.

  	Release 0.9.9 - September 5 2017
  	--------------------------------
  	* Added ``stop_if_true`` parameter to conditional formatting.
  	  Feature request `#386 <https://github.com/jmcnamara/XlsxWriter/issues/386>`_.


author: Lawrence R. Rogers <lrr@cert.org> 1.0.4-1
changelog:
  * Release 1.0.4-1
  	Release 1.0.4 - April 14 2018
  	-----------------------------
  	* Set the xlsx internal file member datetimes to 1980-01-01 00:00:00 like
  	  Excel so that apps can produce a consistent binary file once the workbook
  	  :func:`set_properties` ``created`` date is set.  
  	  Pull request `#495 <https://github.com/jmcnamara/XlsxWriter/issues/495>`_.
  	* Fix for jpeg images that reported unknown height/width due to unusual SOF markers.
  	  Issue `#506 <https://github.com/jmcnamara/XlsxWriter/issues/506>`_.
  	* Added support for blanks in list autofilter.
  	  Issue `#505 <https://github.com/jmcnamara/XlsxWriter/issues/505>`_.

  	Release 1.0.3 - April 10 2018
  	-----------------------------
  	* Added Excel 2010 data bar features such as solid fills and control over the
  	  display of negative values. See :ref:`working_with_conditional_formats` and
  	  :ref:`ex_cond_format`.
  	  Feature request `#502 <https://github.com/jmcnamara/XlsxWriter/issues/502>`_.
  	* Fixed :func:`set_column` parameter names to match docs and other methods.
  	  Note, this is a backward incompatible change.
  	  Issue `#504 <https://github.com/jmcnamara/XlsxWriter/issues/504>`_.
  	* Fixed missing plotarea formatting in pie/doughnut charts.


author: Lawrence R. Rogers <lrr@cert.org> 1.0.5-1
changelog:
  * Release 1.0.5-1
  	Release 1.0.5 - May 19 2018
  	---------------------------
  	* Added example of how to subclass the Workbook and Worksheet objects. See
  	  :ref:`ex_inheritance1` and :ref:`ex_inheritance2`.
  	* Added support for WMF and EMF image formats to the Worksheet
  	  :func:`add_image` method.


author: Lawrence R. Rogers <lrr@cert.org> 1.0.8-1
changelog:
  * Release 1.0.8-1
  	Release 1.0.8 - August 27 2018
  	------------------------------
  	* Added named exceptions to XlsxWriter. See :ref:`exceptions`.
  	* Removed the implicit :func:`close()` in the destructor since it wasn't
  	  guaranteed to work correctly and raised a confusing exception when any other
  	  exception was triggered. **Note that this is a backward incompatible
  	  change.** The ``with`` context manager is a better way to close
  	  automatically, see :func:`close()`.
  	* Added border, fill, pattern and gradient formatting options to
  	  :func:`set_legend()`.
  	  Issue `#545 <https://github.com/jmcnamara/XlsxWriter/issues/545>`_.
  	* Added ``top_right`` position to :func:`set_legend()`.
  	  Issue `#537 <https://github.com/jmcnamara/XlsxWriter/issues/537>`_.


author: Lawrence R. Rogers <lrr@cert.org> 1.1.2-1
changelog:
  * Release 1.1.2-1
  	Release 1.1.2 - October 20 2018
  	-------------------------------

  	* Fix for issue where ``in_memory`` files weren't compressed.
  	  Issue `#573 <https://github.com/jmcnamara/XlsxWriter/issues/573>`_.

  	* Fix ``write()`` so that it handles array formulas as documented.
  	  Issue `#418 <https://github.com/jmcnamara/XlsxWriter/issues/418>`_.

  	* Fix for issue with special characters in worksheet table functions.
  	  Issue `#442 <https://github.com/jmcnamara/XlsxWriter/issues/442>`_.

  	* Added warnings for input issues in :func:`write_rich_string()` such as blank
  	  strings, double formats or insufficient parameters.
  	  Issue `#425 <https://github.com/jmcnamara/XlsxWriter/issues/425>`_.


  	Release 1.1.1 - September 22 2018
  	---------------------------------

  	* Added comment font name and size options.
  	  Issue `#201 <https://github.com/jmcnamara/XlsxWriter/issues/201>`_.

  	* Fix for issue when using text boxes in the same workbook as a chartsheet.
  	  Issue `#420 <https://github.com/jmcnamara/XlsxWriter/issues/420>`_.


  	Release 1.1.0 - September 2 2018
  	--------------------------------

  	* Added functionality to align chart category axis labels. See the
  	  ``label_align`` property of the :func:`set_x_axis()` method.

  	* Added worksheet :func:`hide_row_col_headers()` method to turn off worksheet
  	  row and column headings.
  	  Issue `#480 <https://github.com/jmcnamara/XlsxWriter/issues/480>`_.

  	* Added the :func:`set_tab_ratio()` method to set the ratio between the
  	  worksheet tabs and the horizontal slider.
  	  Issue `#481 <https://github.com/jmcnamara/XlsxWriter/issues/481>`_.

  	* Fixed issue with icon conditional formats when the values were zero.
  	  Issue `#565 <https://github.com/jmcnamara/XlsxWriter/issues/565>`_.

  	Release 1.0.9 - August 27 2018
  	------------------------------

  	* Fix for issue with formulas quoted as strings in conditional formats,
  	  introduced in version 1.0.7.
  	  Issue `#564 <https://github.com/jmcnamara/XlsxWriter/issues/564>`_.


author: Lawrence R. Rogers <lrr@cert.org> 1.1.0-1
changelog:
  * Release 1.1.0-1
  	xplico 1.1.0
  		* Performance improved
  		* nDPI updated
  		* IRC bug fixed
  		* HTTP bug fixed
  		* VoIP (SIP, RTP) bug fixed
  		* FTP bug fixed
  		* changed the FaceBook DB tables
  		* Null/Loopback dissector
  		* Cisco HDLC dissector
  		* Libero.it and RossoAlice webmail decoding
  		* Yahoo messenger (web and mobile)
  		* Dig using file signatures (unknown flows)


author: Lawrence R. Rogers <lrr@cert.org> 1.1.1-1
changelog:
  * Release 1.1.1-1
  	* Whatsapp OS and Phone number
  	* Added MGCP dissector
  	* IMAP bug fixed
  	* Updated for nDPI-1.7.0.


author: Lawrence R. Rogers <lrr@cert.org> - 0.6.1-1
changelog:
  - Release 0.6.1-1
  	Built for xrdp 0.6.1.
  	This package has been adapted from xrdp-0.5.0 found on EPEL.


author: Lawrence R. Rogers <lrr@cert.org> 2.9.3-1
changelog:
  * Release 2.9.3-1
  	Fixed configure-time dependency for libndpi to limit use of v1.8.0 and greater.
  	init script now gives YAF more time to shut down gracefully.


author: Lawrence R. Rogers <lrr@cert.org> 2.10.0-1
changelog:
  * Release 2.10.0-1
  	Support for FixBuf 2.0.0 added, and is now required.
  	Derive information elements from included XML files.
  	Various reporting/output bug fixes for ipfixDump.
  	Support for tombstone records added.


author: Lawrence R. Rogers <lrr@cert.org> 2.11.0-1
changelog:
  * Release 2.11.0-1
  	Support for FixBuf 2.3.0 added, and is now required.
  	Added support for nDPI 2.0.
  	CERT Info Model support added.
  	More strict DNS applabel.
  	Initial NTP Mode 7 applabel supprt.
  	Improved POSIX compliance for init script.
  	Removed ipfixDump; it is now distributed with libfixbuf.
  	DNS DPI free segfault fix.
  	New YAF stats and tombstone format.


author: Lawrence R. Rogers <lrr@cert.org> 2.11.2-1
changelog:
  * Release 2.11.2-1
  	Fixed bugs in NTP and DNS deep packet inspection.
  	Fixed a compilation error when building with metadata export enabled.
  	Fixed possible compilation errors when building with nDPI support.
  	Fixed compilation errors when building with newer versions of PF_Ring.


author: Michal Ambroz <rebus at, seznam.cz> - 3.5.0-3
changelog:
  - package review - bugzilla #1362265
  - dropped Buildroot, pkgconfig, zlib-devel, defattr
  - added buildrequires gcc
  - change license back to ASL 2.0 only


author: Michal Ambroz <rebus at, seznam.cz> - 3.5.0-4
changelog:
  - package review - bugzilla #1362265
  - cosmetics of the changelog
  - using default spinx theme to remove the static fonts


author: Michal Ambroz <rebus at, seznam.cz> - 3.5.0-7
changelog:
  - Adding patch from pull request 627 until 3.5.1 is released
  - https://patch-diff.githubusercontent.com/raw/VirusTotal/yara/pull/627.patch
  - Fixes CVE-2016-10210 CVE-2016-10211 CVE-2017-5923 CVE-2017-5924


author: Fyodor (fyodor(a)insecure.org)
changelog:
  - Removed changelog entries as SVN is a more authoritative source. Execute:
  - svn log --username guest --password "" svn://svn.insecure.org/nmap/zenmap.spec.in


author: Thomas Spura <tomspur@fedoraproject.org> - 2.2.0-3
changelog:
  - add bcond_without pgm macro (Jose Pedro Oliveira, #867182)
  - remove bundled pgm
  - build against openpgm


