Download
Forensic Explorer 64 bit
Set GUI language on install (Chinese, English, French, German, Indonesian, Spanish, Turkish)
The Forensic Explorer 30 day evaluation version does not support: Case Save; Export; or Live Boot. To fully evaluate the software a 90 day dongle license is available for purchase. Request more detail in the comment field. Request 30 Day Evaluation Version Key
FEX v5 Change Log
14 January 2021 – v5.4.2.1180
- Fixed German translation error causing freeze.
- Update RamDisk scripts for new NirSoft versions.
- Other minor script updates.
23 December 2021 – v5.4.2.1140
- Email – PST processor update.
- Filter – Fixed hash set match filter.
- GUI – Improved forms ‘stay in front’.
- Other minor updates.
21 October 2020 – v5.2.2.9978
16 December 2021 – v5.4.2.1122
- Bitlocker/File Vault – Password is added to the column and Triage report.
- Branch Plate – Added an icon to indicate sub-folders are plated.
- Categories – Added date categories and improved speed.
- Display – Fixed column offset for some SQL files.
- Display – Improved Display view for MSOffice docs (added PPTX).
- Email – Added tab views for Contacts and Calendar.
- Email – Added NodeXL chart.
- Email – Improved support for EDB, ESE, MBOX, PST, OST.
- Email – Added script to collect email address.
- French – Fixed translation error for hash sets.
- JSON Export – Path extended to include device.
- Logging – Fixed MBR count in log file.
- MOV – Improved processing speed.
- Reports – Added export options for blurred graphics.
- Reports – Fixed intermittent error changing between report folders.
- Updated FEX memory management.
- Video – Improved video speed, sound and display.
21 October 2020 – v5.2.2.9978
- Artifacts – Added Instagram direct chat.
- Bookmark – Fixed error causing occasional crash adding bookmark.
- Scripts – File System > Analysis Programs > Recycle Bin Match $I with $R.
- Reports – Samples: Added Recycle Bin report to link $R file with $I metadata.
9 October 2020 – v5.2.2.9944
- Reports – Fixed error creating ‘Report Templates’ folder.
5 October 2020 – v5.2.2.9936
- Artifacts – Added Windows 10 Time Line.
- exFat – Fixed issue reporting incorrect cluster allocation.
- Display View – Improved display of SQLite tables.
- Display View – Improved ODT display.
- Gallery view – Improved blur.
- Install – Fixed issue in last release with language versions installing in English.
- Reports – Fixed freeze clicking between report folders.
- Un-dock – Fixed issue where slow render of SQLite tables un-docked data view.
- Other minor updates and improvements.
3 September 2020 – v5.2.2.9866
- Artifacts – Added unallocated carve for search URLs.
- FEX Imager Servlet – Now caters for remote imaging with Dynamic IP Changes.
- Filename Search – Search Zip and RAR to 20 levels.
- File System module – Updated File Info button.
- FEX Viewer (free stand-alone product) now available for case review.
- FEX Viewer Case Export – Added to config button shortcut in header toolbar.
- Metadata:
- Updated Extract Metadata button.
- Added extraction of Video metadata.
- Added extraction of Adobe XMP metadata.
- MKV – Detect multiplexing and expand video thumbnails to track folders.
- Text view – Added right-click, show printable characters only.
28 July 2020 – v5.2.2.9748
- Launch Speed
- Improved first install launch speed.
- Improved launch speed.
- Triage Report – Sorted registry so that current appears first.
- Triage MAC – Updated Triage report with additional artifacts.
- Other minor updates and improvements.
21 July 2020 – v5.2.2.9736
- APFS – Improvements based on new Apple documentation.
- Case – Fixed error opening FEX-Triage case.
- Classification – Drop down menu added for Gallery View CEM Classification:
- Project Vic
- Copine
- SAP
- SOD
- Display View – Updated preview of DOCX files in display view tab.
- Expand Compound – Fixed error expanding 7z.
- Project Vic – Changed export date times from local to UTC.
- Scripts – Improved forcing display windows to front of screen.
14 July 2020 – 5.2.2.9714
- Artifacts – Added Browsers:
- Safari Bookmarks
- Safari Downloads
- Safari Top Sites
- Artifacts – Added MAC Operating System:
- Mail BackupTOC
- Recent iWork Numbers
- Recent iWork Pages
- Recent QuickTime
- Recent TextEdit
- Recent VLC
- Custom Byte Carve – Quick Add Google Maps.
- Display View – Updated DOCX display.
- FEX-Imager changed to 64-bit to allow for Ex0, Lx01 conversion to E01 or L01.
- Live Boot – Added button to Evidence module.
- Reports – Fixed issue with blur on exported PDF.
- Website Update – Check for Updates button now links with new download page.
29 June 2020 – 5.2.2.9680
- Email – Improved MBOX support.
22 June 2020 – 5.2.2.9662
- Bookmarks – Artifact bookmarking auto-creates bookmark folder.
- Email – Improved MBOX support.
- License Manager – Identifies locked dongle.
- Live Boot – Select storage controller (Auto, IDE, SATA, BusLogic, LsiLogic, LsiLogicSAS).
- Load Case – Improved load case time.
- Preview – Button in Evidence module now default.
- Registry – Improved Office MRU script.
- Reports – Fixed AV in copy and paste of table row.
- Reports – PDF resolution improved.
- Reports – Updated report column sorting.
- Reports – Updated sample templates.
11 June 2020 – 5.2.2.9632:
- Email – Fixed error loading an old case with PST email.
06 June 2020 – 5.2.2.9622
- Email – Improved export from property view.
- PDF – Fixed issue with expanded PDF causing freeze.
- Reports – Export PDF in high resolution.
- Video – Added .ts video file type.
03 June 2020 – 5.2.2.9618
- Artifacts – Improved search speed for Artifact files.
- Artifacts – Added Chromium bookmarks and improved categorization.
- Artifacts – Clear of 1601 blank Delphi date fields.
- Evidence Processor – Changed button to Skip processing.
- Gallery Cache – Improved gallery cache speed.
- Metadata – Added metadata for HEIC files.
- FEX-Imager – Speed improvements.
- Recover File – Added drag and drop for case recovery files.
- Remote – Improved network connection speed for remote devices.
- Other minor updates and improvements.
7 May 2020 – 5.2.2.9526
- Artifacts – Minor fixes and improvements.
- ClamAV – Updates to improve speed. Removed default check for PUA.
- FEX-Imager – Released FEX-Imager v2 (located in install folder).
- Gallery View – Fixed cache thumbnail error on small cache graphics causing a freeze.
- Email – Added Email module support for mbox mail.
- Email – Added Email module support for EDB mail.
- Email – Fixed issue with blank OST email subject displaying message page offset.
21 Apr 2020 – 5.2.2.9472
- Bookmarks – Fixed issue re-bookmarking a bookmarked file.
- Remote – Updated protocols (increase remote serve-let connection speed).
- Other minor updates.
15 Apr 2020 – 5.2.2.9452
- Btilocker Partitions – Now return isEncrypted status.
- Progress – Fixed issue with progress bar staying on-top of other applications.
- Project VIC2 – Import and Export support added.
- VDI – Updated support for Virtual Desktop image format.
9 Apr 2020 – 5.2.2.9444
- APFS – Updated drive decryption routine.
- Artifacts – Script updates.
- C4All – Add Cellebrite C4All export to FEX.
- RAID6 – Added RAID 6 support.
- Remote – Updated Add Remote network config.
31 Mar 2020 – 5.2.2.9420
- Merge Files – Right click menu option added.
- Setup – Improved setup for non-admin installs. Removed auto-launch.
- Permissions – Added NTFS Permissions viewer.
- Other minor script updates and improvements.
17 Mar 2020 – 5.1.2.9378
- Live Boot – Fixed issue causing Live Boot to not launch.
13 Mar 2020 – 5.1.2.9372
- Artifacts – Added Viber for PC v11.
- File Vault – Fixed pwd check for AES-128 encrypted volumes converted to APFS.
- Hex Data Inspector – New layout.
- Merge Files – File System right-click menu option to merge data.
- RamDisk Tools – Added FFmpeg.
05 Mar 2020 – 5.1.2.9342
- Load Case – Fixed error loading case created from folder containing Zone files.
- APFS – Improved support for MacQuisition decrypted APFS volumes.
- Other minor script updates and improvements.
24 February 2020 – 5.1.2.9324
- Filters – Improved Read From File filter.
- L01 – Improved detection of corrupt L01 or missing segments on add of evidence.
- Scripts – Updates to File Name Search to handle large imported keyword lists.
- Triage – Fixed error introduced in previous build causing Default + Triage to fail.
13 February 2020 – 5.1.2.9314
- Bookmarks – Fixed sub-folder sort error.
- Bookmarks – Added Artifacts as a default folder.
- Display View – Updated multi-video view buttons.
- File Name Search – Updated array size for large keyword lists.
- HEX View – Fixed flicker on double click.
- Index Search – Added additional data view tabs (Hex, Display, Filesystem Record).
5 February 2020 – 5.1.2.9306
- Bookmarks – Non default folders get different icon.
- Display – FFMPEG DLL update (fix OGG and WK3 freeze).
- File Carve – Added USN Journal file type.
- File Signature – Update to ESE file type to improve speed.
- HEX – Update to HEX selection.
- Keyword Search – Enabled multi select of keyword.txt import files.
- Recover Folders – If Bad Cluster file recover set at 0 size.
- Registry – Improved speed of ‘Send to Registry’.
- Toolbar – Fixed minimize maximize error on toolbar.
29 January 2020 – 5.1.2.9288
- CLI Hash min/max size fix.
- Metadata To Columns – Added ‘Extract Recycle Bin’ for $I values.
- Recycle Bin – Decode INFO2 in File Metadata tab (after signature).
- Recycle Bin – Added Zimmerman RBCmd to 3rd Party Tools.
- Other minor script updates.
24 January 2020 – 5.1.2.9270
- Fixed exit error caused by Evidence Groups.
- Metadata To Columns – Added LNK MAC Address.
- Other minor script updates.
06 January 2020 – 5.1.2.9254
- Cases – Options > Cases path now preserved as base cases folder.
- Checked Items – Fixed issue with checks no clearing green squares.
- Script – Additional export options added to Export Files by Type.
- Script – Added CLI launcher to Scripts\Evidence\CLI_Launcher.pas.
20 December 2019 – 5.1.2.9226
- Spanish – FEX GUI translation update.
- Other – Minor updates.
17 December 2019 – 5.1.2.9222
- APFS – Updated detection of encrypted partitions.
- Project Vic – Fixed issue with some Project Vic files not being recognized.
- Scripts – Fixed issue resizing script forms.
11 December 2019 – 5.1.2.9200
- APFS – Fixed issue with encrypted partitions reporting unallocated space size.
- Help – Updated Turkish v5 User Guide.
- Reports – Fixed issue with Reports not reading some cached pictures.
- Splash – Fixed issue with splash reporting an expiring license date.
5 December 2019 – 5.1.2.9180
- Backup Case – Writes to both screen and log when logging is selected.
- Cache Images – Update for Gallery and Video views.
- Thumbs-cache – Update to decode of thumbs indexes.
- Fixed remove folder error introduced in previous release.
- Fixed error in date filter tool introduced in previous release.
20 November 2019 – 5.1.2.9148
- Live Boot – Updates for APFS Live Boot support (file vault drives are not currently supported).
- GUI Update – Windows themes added. Snap to monitor now supported.
- Video Gallery – Significant speed increase in Video Gallery.
- Video Gallery – Fixed corrupt video crashing gallery.
08 November 2019 – 5.1.2.9128
- APFS – Added support for 128bit encryption keys.
- Live Boot – Added support for APFS.
- Registry – Improved speed of script buttons.
- Tumbs.db – Fixed display of thumb image.
- Video View – Fix crash caused by corrupt video.
29 October 2019 – 5.1.2.9090
- APFS – Fix issue prompting for encryption password.
- Filters – Added registry signature filter.
- Filters – Updated Registry drop down filter.
- L01 write – Increased L01 write segment size.
- Triage – Improved triage speed.
22 October 2019 – 5.1.2.9072
- APFS Encryption – Now handles multiple volume keys in the KeyBag.
- Expand Compound – Fixed issue with signature analysis of children.
- Scripts – Added script to count zero sectors.
- 7Zip – Improved expansion function.
17 October 2019 – 5.1.2.9054
- Categories View – Fixed error displaying categories.
- Evidence – Recent Cases double click during case.
- Evidence – Added case modified date to displayed information.
- Evidence – Case names in bold font for recent cases.
- L01 – Improved read speed.
- Skin Tone drop down filter added (must run skin tone first).
- ZMODO video file type added for signature and carving.
14 October 2019 – 5.1.2.9046
- Evidence – Fixed issue with drag and drop of multiple evidence files.
- German/Spanish – Fixed MBR translation error.
- Spanish – Fixed triage report.
- Other minor updates.
10 October 2019 – 5.1.2.9028 – Major Version Release
Version 5 Release Notes
Other Download Links
Learn more about the debug version