Forensic Explorer 64 bit

Forensic Explorer - Full - v5.4.2.1650 - 7 Jun 2021

Forensic Explorer - Evaluation - v5.4.2.1650 - 7 Jun 2021

Set GUI language on install (Chinese, English, French, German, Indonesian, Spanish, Turkish)

Request 30 Day Evaluation Version Key

The Forensic Explorer 30 day evaluation version does not support: Case Save; Export; or Live Boot.

To fully evaluate the software a 90 day dongle license is available for purchase. Request more detail in the comment field.

Product Details Purchase

Change log...
Other download links

Change log...

FEX v5 Change Log

7 Jun 2021 – v5.4.2.1650

Email – Fixed save and load error with very large PST files in Email module.

1 Jun 2021 – v5.4.2.1634

3rd Party Tools – Added IrfanView screen capture and thumbnails.
Export Files – Added option to export with file slack.
Export JSON – Added graphics and video tags to Project VIC JSON export.
Live Boot Deploy – Fixed issue ordering multiple devices in deploy script.
Metadata – Added Extract Metadata for Track Changes.
Reports – Fixed issue with landscape.
Reports – Improved email message display.
Other minor updates (icons etc.)

30 Apr 2021 – v5.4.2.1578

C4All – Fixed import error.
FileVault – Fixed unlock of APFS system container after Catalina update.
Progress Bar – Improved progress bar formatting.
Quick Word Reports – MS Word stability updates.
Signature/Display – Added Webp signature, preview, and gallery view.

19 Apr 2021 – v5.4.2.1536

Activation – Improved action when local dongle connectivity lost.
Activation – Network dongles switch when connectivity is lost.
Artifacts – Added GroupMe JSON.
Download – New certificate. (Note: Download may trigger Defender SmartScreen).
Keyword – Fixed issue with default keyword txt not populating on install.
Project Vic – Added graphics/video tag to export.
RamDisk Tools – Added Zimmerman Shell Bag Explorer.
Signature – Added Zip (Encrypted).
Translations Updates – Chinese, French, German, Indonesian, Spanish, Turkish.
Word Quick Report – Improved stability.
Other minor updates and improvements.

20 March 2021 – v5.4.2.1404

Clam Antivirus – New database update links.
Email Module – Added duplicate email script, filter and toolbar button.
Display – Improved DOCX display.
Other minor updates.

15 March 2021 – v5.4.2.1380

Email Module – Added right-click > Export > PDF File.
Evidence Module – Updated Check For Updates config. to check on launch.
File System Module – Updated Analysis Programs > Recycle Bin Match $I with $R
Non-English OS – Fixed launch issue from previous update.
Reports Module – Improved High-Res PDF export.
Other minor updates.

6 March 2021 – v5.4.2.1352

Codemeter – Update to 7.20a.
Extract Metadata – Added user permissions.
File Signature – Added ODT (Encrypted).
GetDataNetworkServer – Fixed issue when run as Windows Service.
Interpol Classification – CAM script update.
File Carve – Fixed issue with Minolta RAW returning large file size.
Quick Report – Added export email to PDF.
Quick Registry – Added Windows UserSID.
Recover Folders – Fix issue returning invalid files on HPFS.
Triage Report – Added UserSID section.

25 February 2021 – v5.4.2.1316

Display View – Updated Adobe.psd display for multiple images.
Display View – Updated OpenOffice.odt display.
Email Module – Added a display tab for the message header.
GUI Updates – Column separators, highlight and select colors, icons.
Script – Added File System > Analysis Programs > Folder Sizes.
Word Report – Added File System > Tools > Quick Word Report.

03 February 2021 – v5.4.2.1238

Classification – Added Interpol Baseline 4 category.
Email – Updated PST/OST Send-To-Module.
Reports – Improved high-res PDF export.
Reports – Improved sort by field.

14 January 2021 – v5.4.2.1180

Fixed German translation error causing freeze.
Update RamDisk scripts for new NirSoft versions.
Other minor script updates.

23 December 2020 – v5.4.2.1140

Email – PST processor update.
Filter – Fixed hash set match filter.
GUI – Improved forms ‘stay in front’.
Other minor updates.

16 December 2020 – v5.4.2.1122

Bitlocker/File Vault – Password is added to the column and Triage report.
Branch Plate – Added an icon to indicate sub-folders are plated.
Categories – Added date categories and improved speed.
Display – Fixed column offset for some SQL files.
Display – Improved Display view for MSOffice docs (added PPTX).
Email – Added tab views for Contacts and Calendar.
Email – Added NodeXL chart.
Email – Improved support for EDB, ESE, MBOX, PST, OST.
Email – Added script to collect email address.
French – Fixed translation error for hash sets.
JSON Export – Path extended to include device.
Logging – Fixed MBR count in log file.
MOV – Improved processing speed.
Reports – Added export options for blurred graphics.
Reports – Fixed intermittent error changing between report folders.
Updated FEX memory management.
Video – Improved video speed, sound and display.

21 October 2020 – v5.2.2.9978

Artifacts – Added Instagram direct chat.
Bookmark – Fixed error causing occasional crash adding bookmark.
Scripts – File System > Analysis Programs > Recycle Bin Match $I with $R.
Reports – Samples: Added Recycle Bin report to link $R file with $I metadata.

9 October 2020 – v5.2.2.9944

Reports – Fixed error creating ‘Report Templates’ folder.

5 October 2020 – v5.2.2.9936

Artifacts – Added Windows 10 Time Line.
exFat – Fixed issue reporting incorrect cluster allocation.
Display View – Improved display of SQLite tables.
Display View – Improved ODT display.
Gallery view – Improved blur.
Install – Fixed issue in last release with language versions installing in English.
Reports – Fixed freeze clicking between report folders.
Un-dock – Fixed issue where slow render of SQLite tables un-docked data view.
Other minor updates and improvements.

3 September 2020 – v5.2.2.9866

Artifacts – Added unallocated carve for search URLs.
FEX Imager Servlet – Now caters for remote imaging with Dynamic IP Changes.
Filename Search – Search Zip and RAR to 20 levels.
File System module – Updated File Info button.
FEX Viewer (free stand-alone product) now available for case review.
FEX Viewer Case Export – Added to config button shortcut in header toolbar.
Metadata:
- Updated Extract Metadata button.
- Added extraction of Video metadata.
- Added extraction of Adobe XMP metadata.
MKV – Detect multiplexing and expand video thumbnails to track folders.
Text view – Added right-click, show printable characters only.

28 July 2020 – v5.2.2.9748

Launch Speed
- Improved first install launch speed.
- Improved launch speed.
Triage Report – Sorted registry so that current appears first.
Triage MAC – Updated Triage report with additional artifacts.
Other minor updates and improvements.

21 July 2020 – v5.2.2.9736

APFS – Improvements based on new Apple documentation.
Case – Fixed error opening FEX-Triage case.
Classification – Drop down menu added for Gallery View CEM Classification:
- Project Vic
- Copine
- SAP
- SOD
Display View – Updated preview of DOCX files in display view tab.
Expand Compound – Fixed error expanding 7z.
Project Vic – Changed export date times from local to UTC.
Scripts – Improved forcing display windows to front of screen.

14 July 2020 – 5.2.2.9714

Artifacts – Added Browsers:
- Safari Bookmarks
- Safari Downloads
- Safari Top Sites
Artifacts – Added MAC Operating System:
- Mail BackupTOC
- Recent iWork Numbers
- Recent iWork Pages
- Recent QuickTime
- Recent TextEdit
- Recent VLC
Custom Byte Carve – Quick Add Google Maps.
Display View – Updated DOCX display.
FEX-Imager changed to 64-bit to allow for Ex0, Lx01 conversion to E01 or L01.
Live Boot – Added button to Evidence module.
Reports – Fixed issue with blur on exported PDF.
Website Update – Check for Updates button now links with new download page.

29 June 2020 – 5.2.2.9680

Email – Improved MBOX support.

22 June 2020 – 5.2.2.9662

Bookmarks – Artifact bookmarking auto-creates bookmark folder.
Email – Improved MBOX support.
License Manager – Identifies locked dongle.
Live Boot – Select storage controller (Auto, IDE, SATA, BusLogic, LsiLogic, LsiLogicSAS).
Load Case – Improved load case time.
Preview – Button in Evidence module now default.
Registry – Improved Office MRU script.
Reports – Fixed AV in copy and paste of table row.
Reports – PDF resolution improved.
Reports – Updated report column sorting.
Reports – Updated sample templates.

11 June 2020 – 5.2.2.9632:

Email – Fixed error loading an old case with PST email.

06 June 2020 – 5.2.2.9622

Email – Improved export from property view.
PDF – Fixed issue with expanded PDF causing freeze.
Reports – Export PDF in high resolution.
Video – Added .ts video file type.

03 June 2020 – 5.2.2.9618

Artifacts – Improved search speed for Artifact files.
Artifacts – Added Chromium bookmarks and improved categorization.
Artifacts – Clear of 1601 blank Delphi date fields.
Evidence Processor – Changed button to Skip processing.
Gallery Cache – Improved gallery cache speed.
Metadata – Added metadata for HEIC files.
FEX-Imager – Speed improvements.
Recover File – Added drag and drop for case recovery files.
Remote – Improved network connection speed for remote devices.
Other minor updates and improvements.

7 May 2020 – 5.2.2.9526

Artifacts – Minor fixes and improvements.
ClamAV – Updates to improve speed. Removed default check for PUA.
FEX-Imager – Released FEX-Imager v2 (located in install folder).
Gallery View – Fixed cache thumbnail error on small cache graphics causing a freeze.
Email – Added Email module support for mbox mail.
Email – Added Email module support for EDB mail.
Email – Fixed issue with blank OST email subject displaying message page offset.

21 Apr 2020 – 5.2.2.9472

Bookmarks – Fixed issue re-bookmarking a bookmarked file.
Remote – Updated protocols (increase remote serve-let connection speed).
Other minor updates.

15 Apr 2020 – 5.2.2.9452

Btilocker Partitions – Now return isEncrypted status.
Progress – Fixed issue with progress bar staying on-top of other applications.
Project VIC2 – Import and Export support added.
VDI – Updated support for Virtual Desktop image format.

9 Apr 2020 – 5.2.2.9444

APFS – Updated drive decryption routine.
Artifacts – Script updates.
C4All – Add Cellebrite C4All export to FEX.
RAID6 – Added RAID 6 support.
Remote – Updated Add Remote network config.

31 Mar 2020 – 5.2.2.9420

Merge Files – Right click menu option added.
Setup – Improved setup for non-admin installs. Removed auto-launch.
Permissions – Added NTFS Permissions viewer.
Other minor script updates and improvements.

17 Mar 2020 – 5.1.2.9378

Live Boot – Fixed issue causing Live Boot to not launch.

13 Mar 2020 – 5.1.2.9372

Artifacts – Added Viber for PC v11.
File Vault – Fixed pwd check for AES-128 encrypted volumes converted to APFS.
Hex Data Inspector – New layout.
Merge Files – File System right-click menu option to merge data.
RamDisk Tools – Added FFmpeg.

05 Mar 2020 – 5.1.2.9342

Load Case – Fixed error loading case created from folder containing Zone files.
APFS – Improved support for MacQuisition decrypted APFS volumes.
Other minor script updates and improvements.

24 February 2020 – 5.1.2.9324

Filters – Improved Read From File filter.
L01 – Improved detection of corrupt L01 or missing segments on add of evidence.
Scripts – Updates to File Name Search to handle large imported keyword lists.
Triage – Fixed error introduced in previous build causing Default + Triage to fail.

13 February 2020 – 5.1.2.9314

Bookmarks – Fixed sub-folder sort error.
Bookmarks – Added Artifacts as a default folder.
Display View – Updated multi-video view buttons.
File Name Search – Updated array size for large keyword lists.
HEX View – Fixed flicker on double click.
Index Search – Added additional data view tabs (Hex, Display, Filesystem Record).

5 February 2020 – 5.1.2.9306

Bookmarks – Non default folders get different icon.
Display – FFMPEG DLL update (fix OGG and WK3 freeze).
File Carve – Added USN Journal file type.
File Signature – Update to ESE file type to improve speed.
HEX – Update to HEX selection.
Keyword Search – Enabled multi select of keyword.txt import files.
Recover Folders – If Bad Cluster file recover set at 0 size.
Registry – Improved speed of ‘Send to Registry’.
Toolbar – Fixed minimize maximize error on toolbar.

29 January 2020 – 5.1.2.9288

CLI Hash min/max size fix.
Metadata To Columns – Added ‘Extract Recycle Bin’ for $I values.
Recycle Bin – Decode INFO2 in File Metadata tab (after signature).
Recycle Bin – Added Zimmerman RBCmd to 3rd Party Tools.
Other minor script updates.

24 January 2020 – 5.1.2.9270

Fixed exit error caused by Evidence Groups.
Metadata To Columns – Added LNK MAC Address.
Other minor script updates.

06 January 2020 – 5.1.2.9254

Cases – Options > Cases path now preserved as base cases folder.
Checked Items – Fixed issue with checks no clearing green squares.
Script – Additional export options added to Export Files by Type.
Script – Added CLI launcher to Scripts\Evidence\CLI_Launcher.pas.

20 December 2019 – 5.1.2.9226

Spanish – FEX GUI translation update.
Other – Minor updates.

17 December 2019 – 5.1.2.9222

APFS – Updated detection of encrypted partitions.
Project Vic – Fixed issue with some Project Vic files not being recognized.
Scripts – Fixed issue resizing script forms.

11 December 2019 – 5.1.2.9200

APFS – Fixed issue with encrypted partitions reporting unallocated space size.
Help – Updated Turkish v5 User Guide.
Reports – Fixed issue with Reports not reading some cached pictures.
Splash – Fixed issue with splash reporting an expiring license date.

5 December 2019 – 5.1.2.9180

Backup Case – Writes to both screen and log when logging is selected.
Cache Images – Update for Gallery and Video views.
Thumbs-cache – Update to decode of thumbs indexes.
Fixed remove folder error introduced in previous release.
Fixed error in date filter tool introduced in previous release.

20 November 2019 – 5.1.2.9148

Live Boot – Updates for APFS Live Boot support (file vault drives are not currently supported).
GUI Update – Windows themes added. Snap to monitor now supported.
Video Gallery – Significant speed increase in Video Gallery.
Video Gallery – Fixed corrupt video crashing gallery.

08 November 2019 – 5.1.2.9128

APFS – Added support for 128bit encryption keys.
Live Boot – Added support for APFS.
Registry – Improved speed of script buttons.
Tumbs.db – Fixed display of thumb image.
Video View – Fix crash caused by corrupt video.

29 October 2019 – 5.1.2.9090

APFS – Fix issue prompting for encryption password.
Filters – Added registry signature filter.
Filters – Updated Registry drop down filter.
L01 write – Increased L01 write segment size.
Triage – Improved triage speed.

22 October 2019 – 5.1.2.9072

APFS Encryption – Now handles multiple volume keys in the KeyBag.
Expand Compound – Fixed issue with signature analysis of children.
Scripts – Added script to count zero sectors.
7Zip – Improved expansion function.

17 October 2019 – 5.1.2.9054

Categories View – Fixed error displaying categories.
Evidence – Recent Cases double click during case.
Evidence – Added case modified date to displayed information.
Evidence – Case names in bold font for recent cases.
L01 – Improved read speed.
Skin Tone drop down filter added (must run skin tone first).
ZMODO video file type added for signature and carving.

14 October 2019 – 5.1.2.9046

Evidence – Fixed issue with drag and drop of multiple evidence files.
German/Spanish – Fixed MBR translation error.
Spanish – Fixed triage report.
Other minor updates.

Download