Forensic Explorer 64 bit

Forensic Explorer - Full - v5.4.2.1536 - 17 Apr 2021

Forensic Explorer - Evaluation - v5.4.2.1536 - 17 Apr 2021

Set GUI language on install (Chinese, English, French, German, Indonesian, Spanish, Turkish)

Request 30 Day Evaluation Version Key

The Forensic Explorer 30 day evaluation version does not support: Case Save; Export; or Live Boot.

To fully evaluate the software a 90 day dongle license is available for purchase. Request more detail in the comment field.

Product Details Purchase

Change log...
Other download links

Change log...

FEX v5 Change Log

19 Apr 2021 – v5.4.2.1536

Activation – Improved action when local dongle connectivity lost.
Activation – Network dongles switch when connectivity is lost.
Artifacts – Added GroupMe JSON.
Download – New certificate. (Note: Download may trigger Defender SmartScreen).
Keyword – Fixed issue with default keyword txt not populating on install.
Project Vic – Added graphics/video tag to export.
RamDisk Tools – Added Zimmerman Shell Bag Explorer.
Signature – Added Zip (Encrypted).
Translations Updates – Chinese, French, German, Indonesian, Spanish, Turkish.
Word Quick Report – Improved stability.
Other minor updates and improvements.

20 March 2021 – v5.4.2.1404

Clam Antivirus – New database update links.
Email Module – Added duplicate email script, filter and toolbar button.
Display – Improved DOCX display.
Other minor updates.

15 March 2021 – v5.4.2.1380

Email Module – Added right-click > Export > PDF File.
Evidence Module – Updated Check For Updates config. to check on launch.
File System Module – Updated Analysis Programs > Recycle Bin Match $I with $R
Non-English OS – Fixed launch issue from previous update.
Reports Module – Improved High-Res PDF export.
Other minor updates.

6 March 2021 – v5.4.2.1352

Codemeter – Update to 7.20a.
Extract Metadata – Added user permissions.
File Signature – Added ODT (Encrypted).
GetDataNetworkServer – Fixed issue when run as Windows Service.
Interpol Classification – CAM script update.
File Carve – Fixed issue with Minolta RAW returning large file size.
Quick Report – Added export email to PDF.
Quick Registry – Added Windows UserSID.
Recover Folders – Fix issue returning invalid files on HPFS.
Triage Report – Added UserSID section.

25 February 2021 – v5.4.2.1316

Display View – Updated Adobe.psd display for multiple images.
Display View – Updated OpenOffice.odt display.
Email Module – Added a display tab for the message header.
GUI Updates – Column separators, highlight and select colors, icons.
Script – Added File System > Analysis Programs > Folder Sizes.
Word Report – Added File System > Tools > Quick Word Report.

03 February 2021 – v5.4.2.1238

Classification – Added Interpol Baseline 4 category.
Email – Updated PST/OST Send-To-Module.
Reports – Improved high-res PDF export.
Reports – Improved sort by field.

14 January 2021 – v5.4.2.1180

Fixed German translation error causing freeze.
Update RamDisk scripts for new NirSoft versions.
Other minor script updates.

23 December 2020 – v5.4.2.1140

Email – PST processor update.
Filter – Fixed hash set match filter.
GUI – Improved forms ‘stay in front’.
Other minor updates.

16 December 2020 – v5.4.2.1122

Bitlocker/File Vault – Password is added to the column and Triage report.
Branch Plate – Added an icon to indicate sub-folders are plated.
Categories – Added date categories and improved speed.
Display – Fixed column offset for some SQL files.
Display – Improved Display view for MSOffice docs (added PPTX).
Email – Added tab views for Contacts and Calendar.
Email – Added NodeXL chart.
Email – Improved support for EDB, ESE, MBOX, PST, OST.
Email – Added script to collect email address.
French – Fixed translation error for hash sets.
JSON Export – Path extended to include device.
Logging – Fixed MBR count in log file.
MOV – Improved processing speed.
Reports – Added export options for blurred graphics.
Reports – Fixed intermittent error changing between report folders.
Updated FEX memory management.
Video – Improved video speed, sound and display.

21 October 2020 – v5.2.2.9978

Artifacts – Added Instagram direct chat.
Bookmark – Fixed error causing occasional crash adding bookmark.
Scripts – File System > Analysis Programs > Recycle Bin Match $I with $R.
Reports – Samples: Added Recycle Bin report to link $R file with $I metadata.

9 October 2020 – v5.2.2.9944

Reports – Fixed error creating ‘Report Templates’ folder.

5 October 2020 – v5.2.2.9936

Artifacts – Added Windows 10 Time Line.
exFat – Fixed issue reporting incorrect cluster allocation.
Display View – Improved display of SQLite tables.
Display View – Improved ODT display.
Gallery view – Improved blur.
Install – Fixed issue in last release with language versions installing in English.
Reports – Fixed freeze clicking between report folders.
Un-dock – Fixed issue where slow render of SQLite tables un-docked data view.
Other minor updates and improvements.

3 September 2020 – v5.2.2.9866

Artifacts – Added unallocated carve for search URLs.
FEX Imager Servlet – Now caters for remote imaging with Dynamic IP Changes.
Filename Search – Search Zip and RAR to 20 levels.
File System module – Updated File Info button.
FEX Viewer (free stand-alone product) now available for case review.
FEX Viewer Case Export – Added to config button shortcut in header toolbar.
Metadata:
- Updated Extract Metadata button.
- Added extraction of Video metadata.
- Added extraction of Adobe XMP metadata.
MKV – Detect multiplexing and expand video thumbnails to track folders.
Text view – Added right-click, show printable characters only.

28 July 2020 – v5.2.2.9748

Launch Speed
- Improved first install launch speed.
- Improved launch speed.
Triage Report – Sorted registry so that current appears first.
Triage MAC – Updated Triage report with additional artifacts.
Other minor updates and improvements.

21 July 2020 – v5.2.2.9736

APFS – Improvements based on new Apple documentation.
Case – Fixed error opening FEX-Triage case.
Classification – Drop down menu added for Gallery View CEM Classification:
- Project Vic
- Copine
- SAP
- SOD
Display View – Updated preview of DOCX files in display view tab.
Expand Compound – Fixed error expanding 7z.
Project Vic – Changed export date times from local to UTC.
Scripts – Improved forcing display windows to front of screen.

14 July 2020 – 5.2.2.9714

Artifacts – Added Browsers:
- Safari Bookmarks
- Safari Downloads
- Safari Top Sites
Artifacts – Added MAC Operating System:
- Mail BackupTOC
- Recent iWork Numbers
- Recent iWork Pages
- Recent QuickTime
- Recent TextEdit
- Recent VLC
Custom Byte Carve – Quick Add Google Maps.
Display View – Updated DOCX display.
FEX-Imager changed to 64-bit to allow for Ex0, Lx01 conversion to E01 or L01.
Live Boot – Added button to Evidence module.
Reports – Fixed issue with blur on exported PDF.
Website Update – Check for Updates button now links with new download page.

29 June 2020 – 5.2.2.9680

Email – Improved MBOX support.

22 June 2020 – 5.2.2.9662

Bookmarks – Artifact bookmarking auto-creates bookmark folder.
Email – Improved MBOX support.
License Manager – Identifies locked dongle.
Live Boot – Select storage controller (Auto, IDE, SATA, BusLogic, LsiLogic, LsiLogicSAS).
Load Case – Improved load case time.
Preview – Button in Evidence module now default.
Registry – Improved Office MRU script.
Reports – Fixed AV in copy and paste of table row.
Reports – PDF resolution improved.
Reports – Updated report column sorting.
Reports – Updated sample templates.

11 June 2020 – 5.2.2.9632:

Email – Fixed error loading an old case with PST email.

06 June 2020 – 5.2.2.9622

Email – Improved export from property view.
PDF – Fixed issue with expanded PDF causing freeze.
Reports – Export PDF in high resolution.
Video – Added .ts video file type.

03 June 2020 – 5.2.2.9618

Artifacts – Improved search speed for Artifact files.
Artifacts – Added Chromium bookmarks and improved categorization.
Artifacts – Clear of 1601 blank Delphi date fields.
Evidence Processor – Changed button to Skip processing.
Gallery Cache – Improved gallery cache speed.
Metadata – Added metadata for HEIC files.
FEX-Imager – Speed improvements.
Recover File – Added drag and drop for case recovery files.
Remote – Improved network connection speed for remote devices.
Other minor updates and improvements.

7 May 2020 – 5.2.2.9526

Artifacts – Minor fixes and improvements.
ClamAV – Updates to improve speed. Removed default check for PUA.
FEX-Imager – Released FEX-Imager v2 (located in install folder).
Gallery View – Fixed cache thumbnail error on small cache graphics causing a freeze.
Email – Added Email module support for mbox mail.
Email – Added Email module support for EDB mail.
Email – Fixed issue with blank OST email subject displaying message page offset.

21 Apr 2020 – 5.2.2.9472

Bookmarks – Fixed issue re-bookmarking a bookmarked file.
Remote – Updated protocols (increase remote serve-let connection speed).
Other minor updates.

15 Apr 2020 – 5.2.2.9452

Btilocker Partitions – Now return isEncrypted status.
Progress – Fixed issue with progress bar staying on-top of other applications.
Project VIC2 – Import and Export support added.
VDI – Updated support for Virtual Desktop image format.

9 Apr 2020 – 5.2.2.9444

APFS – Updated drive decryption routine.
Artifacts – Script updates.
C4All – Add Cellebrite C4All export to FEX.
RAID6 – Added RAID 6 support.
Remote – Updated Add Remote network config.

31 Mar 2020 – 5.2.2.9420

Merge Files – Right click menu option added.
Setup – Improved setup for non-admin installs. Removed auto-launch.
Permissions – Added NTFS Permissions viewer.
Other minor script updates and improvements.

17 Mar 2020 – 5.1.2.9378

Live Boot – Fixed issue causing Live Boot to not launch.

13 Mar 2020 – 5.1.2.9372

Artifacts – Added Viber for PC v11.
File Vault – Fixed pwd check for AES-128 encrypted volumes converted to APFS.
Hex Data Inspector – New layout.
Merge Files – File System right-click menu option to merge data.
RamDisk Tools – Added FFmpeg.

05 Mar 2020 – 5.1.2.9342

Load Case – Fixed error loading case created from folder containing Zone files.
APFS – Improved support for MacQuisition decrypted APFS volumes.
Other minor script updates and improvements.

24 February 2020 – 5.1.2.9324

Filters – Improved Read From File filter.
L01 – Improved detection of corrupt L01 or missing segments on add of evidence.
Scripts – Updates to File Name Search to handle large imported keyword lists.
Triage – Fixed error introduced in previous build causing Default + Triage to fail.

13 February 2020 – 5.1.2.9314

Bookmarks – Fixed sub-folder sort error.
Bookmarks – Added Artifacts as a default folder.
Display View – Updated multi-video view buttons.
File Name Search – Updated array size for large keyword lists.
HEX View – Fixed flicker on double click.
Index Search – Added additional data view tabs (Hex, Display, Filesystem Record).

5 February 2020 – 5.1.2.9306

Bookmarks – Non default folders get different icon.
Display – FFMPEG DLL update (fix OGG and WK3 freeze).
File Carve – Added USN Journal file type.
File Signature – Update to ESE file type to improve speed.
HEX – Update to HEX selection.
Keyword Search – Enabled multi select of keyword.txt import files.
Recover Folders – If Bad Cluster file recover set at 0 size.
Registry – Improved speed of ‘Send to Registry’.
Toolbar – Fixed minimize maximize error on toolbar.

29 January 2020 – 5.1.2.9288

CLI Hash min/max size fix.
Metadata To Columns – Added ‘Extract Recycle Bin’ for $I values.
Recycle Bin – Decode INFO2 in File Metadata tab (after signature).
Recycle Bin – Added Zimmerman RBCmd to 3rd Party Tools.
Other minor script updates.

24 January 2020 – 5.1.2.9270

Fixed exit error caused by Evidence Groups.
Metadata To Columns – Added LNK MAC Address.
Other minor script updates.

06 January 2020 – 5.1.2.9254

Cases – Options > Cases path now preserved as base cases folder.
Checked Items – Fixed issue with checks no clearing green squares.
Script – Additional export options added to Export Files by Type.
Script – Added CLI launcher to Scripts\Evidence\CLI_Launcher.pas.

20 December 2019 – 5.1.2.9226

Spanish – FEX GUI translation update.
Other – Minor updates.

17 December 2019 – 5.1.2.9222

APFS – Updated detection of encrypted partitions.
Project Vic – Fixed issue with some Project Vic files not being recognized.
Scripts – Fixed issue resizing script forms.

11 December 2019 – 5.1.2.9200

APFS – Fixed issue with encrypted partitions reporting unallocated space size.
Help – Updated Turkish v5 User Guide.
Reports – Fixed issue with Reports not reading some cached pictures.
Splash – Fixed issue with splash reporting an expiring license date.

5 December 2019 – 5.1.2.9180

Backup Case – Writes to both screen and log when logging is selected.
Cache Images – Update for Gallery and Video views.
Thumbs-cache – Update to decode of thumbs indexes.
Fixed remove folder error introduced in previous release.
Fixed error in date filter tool introduced in previous release.

20 November 2019 – 5.1.2.9148

Live Boot – Updates for APFS Live Boot support (file vault drives are not currently supported).
GUI Update – Windows themes added. Snap to monitor now supported.
Video Gallery – Significant speed increase in Video Gallery.
Video Gallery – Fixed corrupt video crashing gallery.

08 November 2019 – 5.1.2.9128

APFS – Added support for 128bit encryption keys.
Live Boot – Added support for APFS.
Registry – Improved speed of script buttons.
Tumbs.db – Fixed display of thumb image.
Video View – Fix crash caused by corrupt video.

29 October 2019 – 5.1.2.9090

APFS – Fix issue prompting for encryption password.
Filters – Added registry signature filter.
Filters – Updated Registry drop down filter.
L01 write – Increased L01 write segment size.
Triage – Improved triage speed.

22 October 2019 – 5.1.2.9072

APFS Encryption – Now handles multiple volume keys in the KeyBag.
Expand Compound – Fixed issue with signature analysis of children.
Scripts – Added script to count zero sectors.
7Zip – Improved expansion function.

17 October 2019 – 5.1.2.9054

Categories View – Fixed error displaying categories.
Evidence – Recent Cases double click during case.
Evidence – Added case modified date to displayed information.
Evidence – Case names in bold font for recent cases.
L01 – Improved read speed.
Skin Tone drop down filter added (must run skin tone first).
ZMODO video file type added for signature and carving.

14 October 2019 – 5.1.2.9046

Evidence – Fixed issue with drag and drop of multiple evidence files.
German/Spanish – Fixed MBR translation error.
Spanish – Fixed triage report.
Other minor updates.

Download