Skip to main content

Download

Forensic Explorer 64 bit

Set GUI language on install (Chinese, English, French, German, Indonesian, Spanish, Turkish)

Request 30 Day Evaluation Version Key

The Forensic Explorer 30 day evaluation version does not support: Case Save; Export; or Live Boot.

To fully evaluate the software a 90 day dongle license is available for purchase. Request more detail in the comment field.

Product Details Purchase

FEX v5 Change Log

24 Sep 21 – v5.4.8.2084

  • Export – Solved issue creating root export folder on external USB.
  • Logs – View log text during process.
  • Registry – Updated Registry module icons.
  • Registry- Improved user account idenifification for UsrClass.dat and ntuser.dat.

21 Sep 21 – v5.4.8.2058

  • Checkbox – Improved checkbox responsiveness on large cases.
  • Column Text Filter – Added a separate Simple search with boolean AND, OR , NOT functionality.
  • Disk view – Improved disk view responsiveness on large cases.
  • Preview – Locked preview case remove by another instance of FEX.

12 Sep 21 – v5.4.8.2018

  • Analysis Programs > Encrypted Files – Identify encrypted files within archives.
  • Email – Improved column filter for To/From/Subject/Attachments.
  • Splash – Fixed startup error with 90 day dongle license.
  • Other minor updates.

01 Sep 21 – v5.4.8.1968

  • Encrypted Files – Improved detection of encrypted DOC, PPT, XLS.
  • Scripts – Added Analysis Programs > Journal Parser ($UsnJrnl~$J).
  • Zip Export – Improved handling of special char in file names.
  • Zip Export – Added warning message for decompression programs that do not handle > 250 char. path lengths.
  • Other minor updates.

22 Aug 21 – v5.4.8.1926

  • Activation – Wibu Codemeter update.
  • Case Number – Added this field to case information.
  • ClamAV – Update for new ClamAV config.
  • Column Filter – Added AND/OR logic to simple column filter.
  • Columns Default – Removed Flags, Classification.
  • Display – Update to display view for additional file previews.
  • DTSearch – Update to DTSearch DLL.
  • Email – Updates to EDB, EML, EMLX, MBOX, MSG, OST, PST.
  • Email – Added Read column.
  • File Carve – Fixed error carving TGA files.
  • Filters – Added additional email filters.
  • OCR – Added graphics Optical Character Recognition (OCR).
  • RamDisk Tools – Added VLC to RamDisk tools.
  • Script – Added xxHash capability.

17 Jun 2021 – v5.4.2.1678

  • Email – Updates to OST processing.
  • Email – Update to Outlook Caesar decoder for resident small attachments.
  • Registry – Updated to display REG_UNKNOWN key data.

7 Jun 2021 – v5.4.2.1650

  • Email – Fixed save and load error with very large PST files in Email module.

1 Jun 2021 – v5.4.2.1634

  • 3rd Party Tools – Added IrfanView screen capture and thumbnails.
  • Export Files – Added option to export with file slack.
  • Export JSON – Added graphics and video tags to Project VIC JSON export.
  • Live Boot Deploy – Fixed issue ordering multiple devices in deploy script.
  • Metadata – Added Extract Metadata for Track Changes.
  • Reports – Fixed issue with landscape.
  • Reports – Improved email message display.
  • Other minor updates (icons etc.)

30 Apr 2021 – v5.4.2.1578

  • C4All – Fixed import error.
  • FileVault – Fixed unlock of APFS system container after Catalina update.
  • Progress Bar – Improved progress bar formatting.
  • Quick Word Reports – MS Word stability updates.
  • Signature/Display – Added Webp signature, preview, and gallery view.

19 Apr 2021 – v5.4.2.1536

  • Activation – Improved action when local dongle connectivity lost.
  • Activation – Network dongles switch when connectivity is lost.
  • Artifacts – Added GroupMe JSON.
  • Download – New certificate. (Note: Download may trigger Defender SmartScreen).
  • Keyword – Fixed issue with default keyword txt not populating on install.
  • Project Vic – Added graphics/video tag to export.
  • RamDisk Tools – Added Zimmerman Shell Bag Explorer.
  • Signature – Added Zip (Encrypted).
  • Translations Updates – Chinese, French, German, Indonesian, Spanish, Turkish.
  • Word Quick Report – Improved stability.
  • Other minor updates and improvements.

20 March 2021 – v5.4.2.1404

  • Clam Antivirus – New database update links.
  • Email Module – Added duplicate email script, filter and toolbar button.
  • Display – Improved DOCX display.
  • Other minor updates.

15 March 2021 – v5.4.2.1380

  • Email Module – Added right-click > Export > PDF File.
  • Evidence Module – Updated Check For Updates config. to check on launch.
  • File System Module – Updated Analysis Programs > Recycle Bin Match $I with $R
  • Non-English OS – Fixed launch issue from previous update.
  • Reports Module – Improved High-Res PDF export.
  • Other minor updates.

6 March 2021 – v5.4.2.1352

  • Codemeter – Update to 7.20a.
  • Extract Metadata – Added user permissions.
  • File Signature – Added ODT (Encrypted).
  • GetDataNetworkServer – Fixed issue when run as Windows Service.
  • Interpol Classification – CAM script update.
  • File Carve – Fixed issue with Minolta RAW returning large file size.
  • Quick Report – Added export email to PDF.
  • Quick Registry – Added Windows UserSID.
  • Recover Folders – Fix issue returning invalid files on HPFS.
  • Triage Report – Added UserSID section.

25 February 2021 – v5.4.2.1316

  • Display View – Updated Adobe.psd display for multiple images.
  • Display View – Updated OpenOffice.odt display.
  • Email Module – Added a display tab for the message header.
  • GUI Updates – Column separators, highlight and select colors, icons.
  • Script – Added File System > Analysis Programs > Folder Sizes.
  • Word Report – Added File System > Tools > Quick Word Report.

03 February 2021 – v5.4.2.1238

  • Classification – Added Interpol Baseline 4 category.
  • Email – Updated PST/OST Send-To-Module.
  • Reports – Improved high-res PDF export.
  • Reports – Improved sort by field.

14 January 2021 – v5.4.2.1180

  • Fixed German translation error causing freeze.
  • Update RamDisk scripts for new NirSoft versions.
  • Other minor script updates.

23 December 2020 – v5.4.2.1140

  • Email – PST processor update.
  • Filter – Fixed hash set match filter.
  • GUI – Improved forms ‘stay in front’.
  • Other minor updates.

16 December 2020 – v5.4.2.1122

  • Bitlocker/File Vault – Password is added to the column and Triage report.
  • Branch Plate – Added an icon to indicate sub-folders are plated.
  • Categories – Added date categories and improved speed.
  • Display – Fixed column offset for some SQL files.
  • Display – Improved Display view for MSOffice docs (added PPTX).
  • Email – Added tab views for Contacts and Calendar.
  • Email – Added NodeXL chart.
  • Email – Improved support for EDB, ESE, MBOX, PST, OST.
  • Email – Added script to collect email address.
  • French – Fixed translation error for hash sets.
  • JSON Export – Path extended to include device.
  • Logging – Fixed MBR count in log file.
  • MOV – Improved processing speed.
  • Reports – Added export options for blurred graphics.
  • Reports – Fixed intermittent error changing between report folders.
  • Updated FEX memory management.
  • Video – Improved video speed, sound and display.

21 October 2020 – v5.2.2.9978

  • Artifacts – Added Instagram direct chat.
  • Bookmark – Fixed error causing occasional crash adding bookmark.
  • Scripts – File System > Analysis Programs > Recycle Bin Match $I with $R.
  • Reports – Samples: Added Recycle Bin report to link $R file with $I metadata.

9 October 2020 – v5.2.2.9944

  • Reports – Fixed error creating ‘Report Templates’ folder.

5 October 2020 – v5.2.2.9936

  • Artifacts – Added Windows 10 Time Line.
  • exFat – Fixed issue reporting incorrect cluster allocation.
  • Display View – Improved display of SQLite tables.
  • Display View – Improved ODT display.
  • Gallery view – Improved blur.
  • Install – Fixed issue in last release with language versions installing in English.
  • Reports – Fixed freeze clicking between report folders.
  • Un-dock – Fixed issue where slow render of SQLite tables un-docked data view.
  • Other minor updates and improvements.

3 September 2020 – v5.2.2.9866

  • Artifacts – Added unallocated carve for search URLs.
  • FEX Imager Servlet – Now caters for remote imaging with Dynamic IP Changes.
  • Filename Search – Search Zip and RAR to 20 levels.
  • File System module – Updated File Info button.
  • FEX Viewer (free stand-alone product) now available for case review.
  • FEX Viewer Case Export – Added to config button shortcut in header toolbar.
  •  Metadata:
    • Updated Extract Metadata button.
    • Added extraction of Video metadata.
    • Added extraction of Adobe XMP metadata.
  • MKV – Detect multiplexing and expand video thumbnails to track folders.
  • Text view – Added right-click, show printable characters only.

28 July 2020 – v5.2.2.9748

  • Launch Speed
    • Improved first install launch speed.
    • Improved launch speed.
  • Triage Report – Sorted registry so that current appears first.
  • Triage MAC – Updated Triage report with additional artifacts.
  • Other minor updates and improvements.

21 July 2020 – v5.2.2.9736

  • APFS – Improvements based on new Apple documentation.
  • Case – Fixed error opening FEX-Triage case.
  • Classification – Drop down menu added for Gallery View CEM Classification:
    • Project Vic
    • Copine
    • SAP
    • SOD
  • Display View – Updated preview of DOCX files in display view tab.
  • Expand Compound – Fixed error expanding 7z.
  • Project Vic – Changed export date times from local to UTC.
  • Scripts – Improved forcing display windows to front of screen.

14 July 2020 – 5.2.2.9714

  • Artifacts – Added Browsers:
    • Safari Bookmarks
    • Safari Downloads
    • Safari Top Sites
  • Artifacts – Added MAC Operating System:
    • Mail BackupTOC
    • Recent iWork Numbers
    • Recent iWork Pages
    • Recent QuickTime
    • Recent TextEdit
    • Recent VLC
  • Custom Byte Carve – Quick Add Google Maps.
  • Display View – Updated DOCX display.
  • FEX-Imager changed to 64-bit to allow for Ex0, Lx01 conversion to E01 or L01.
  • Live Boot – Added button to Evidence module.
  • Reports – Fixed issue with blur on exported PDF.
  • Website Update – Check for Updates button now links with new download page.

29 June 2020 – 5.2.2.9680

  • Email – Improved MBOX support.

22 June 2020 – 5.2.2.9662

  • Bookmarks – Artifact bookmarking auto-creates bookmark folder.
  • Email – Improved MBOX support.
  • License Manager – Identifies locked dongle.
  • Live Boot – Select storage controller (Auto, IDE, SATA, BusLogic, LsiLogic, LsiLogicSAS).
  • Load Case – Improved load case time.
  • Preview – Button in Evidence module now default.
  • Registry – Improved Office MRU script.
  • Reports – Fixed AV in copy and paste of table row.
  • Reports – PDF resolution improved.
  • Reports – Updated report column sorting.
  • Reports – Updated sample templates.

11 June 2020 – 5.2.2.9632:

  • Email – Fixed error loading an old case with PST email.

06 June 2020 – 5.2.2.9622

  • Email – Improved export from property view.
  • PDF – Fixed issue with expanded PDF causing freeze.
  • Reports – Export PDF in high resolution.
  • Video – Added .ts video file type.

03 June 2020 – 5.2.2.9618

  • Artifacts – Improved search speed for Artifact files.
  • Artifacts – Added Chromium bookmarks and improved categorization.
  • Artifacts – Clear of 1601 blank Delphi date fields.
  • Evidence Processor – Changed button to Skip processing.
  • Gallery Cache – Improved gallery cache speed.
  • Metadata – Added metadata for HEIC files.
  • FEX-Imager – Speed improvements.
  • Recover File – Added drag and drop for case recovery files.
  • Remote – Improved network connection speed for remote devices.
  • Other minor updates and improvements.

7 May 2020 – 5.2.2.9526

  • Artifacts – Minor fixes and improvements.
  • ClamAV – Updates to improve speed. Removed default check for PUA.
  • FEX-Imager – Released FEX-Imager v2 (located in install folder).
  • Gallery View – Fixed cache thumbnail error on small cache graphics causing a freeze.
  • Email – Added Email module support for mbox mail.
  • Email – Added Email module support for EDB mail.
  • Email – Fixed issue with blank OST email subject displaying message page offset.

21 Apr 2020 – 5.2.2.9472

  • Bookmarks – Fixed issue re-bookmarking a bookmarked file.
  • Remote – Updated protocols (increase remote serve-let connection speed).
  • Other minor updates.

15 Apr 2020 – 5.2.2.9452

  • Btilocker Partitions – Now return isEncrypted status.
  • Progress – Fixed issue with progress bar staying on-top of other applications.
  • Project VIC2 – Import and Export support added.
  • VDI – Updated support for Virtual Desktop image format.

9 Apr 2020 – 5.2.2.9444

  • APFS – Updated drive decryption routine.
  • Artifacts – Script updates.
  • C4All – Add Cellebrite C4All export to FEX.
  • RAID6 – Added RAID 6 support.
  • Remote – Updated Add Remote network config.

31 Mar 2020 – 5.2.2.9420

  • Merge Files – Right click menu option added.
  • Setup – Improved setup for non-admin installs. Removed auto-launch.
  • Permissions – Added NTFS Permissions viewer.
  • Other minor script updates and improvements.

17 Mar 2020 – 5.1.2.9378

  • Live Boot – Fixed issue causing Live Boot to not launch.

13 Mar 2020 – 5.1.2.9372

  • Artifacts – Added Viber for PC v11.
  • File Vault – Fixed pwd check for AES-128 encrypted volumes converted to APFS.
  • Hex Data Inspector – New layout.
  • Merge Files – File System right-click menu option to merge data.
  • RamDisk Tools – Added FFmpeg.

05 Mar 2020 – 5.1.2.9342

  • Load Case – Fixed error loading case created from folder containing Zone files.
  • APFS – Improved support for MacQuisition decrypted APFS volumes.
  • Other minor script updates and improvements.

24 February 2020 – 5.1.2.9324

  • Filters – Improved Read From File filter.
  • L01 – Improved detection of corrupt L01 or missing segments on add of evidence.
  • Scripts – Updates to File Name Search to handle large imported keyword lists.
  • Triage – Fixed error introduced in previous build causing Default + Triage to fail.

13 February 2020 – 5.1.2.9314

  • Bookmarks – Fixed sub-folder sort error.
  • Bookmarks – Added Artifacts as a default folder.
  • Display View – Updated multi-video view buttons.
  • File Name Search – Updated array size for large keyword lists.
  • HEX View – Fixed flicker on double click.
  • Index Search – Added additional data view tabs (Hex, Display, Filesystem Record).

5 February 2020 – 5.1.2.9306

  • Bookmarks – Non default folders get different icon.
  • Display – FFMPEG DLL update (fix OGG and WK3 freeze).
  • File Carve – Added USN Journal file type.
  • File Signature – Update to ESE file type to improve speed.
  • HEX – Update to HEX selection.
  • Keyword Search – Enabled multi select of keyword.txt import files.
  • Recover Folders – If Bad Cluster file recover set at 0 size.
  • Registry – Improved speed of ‘Send to Registry’.
  • Toolbar – Fixed minimize maximize error on toolbar.

29 January 2020 – 5.1.2.9288

  • CLI Hash min/max size fix.
  • Metadata To Columns – Added ‘Extract Recycle Bin’ for $I values.
  • Recycle Bin – Decode INFO2 in File Metadata tab (after signature).
  • Recycle Bin – Added Zimmerman RBCmd to 3rd Party Tools.
  • Other minor script updates.

24 January 2020 – 5.1.2.9270

  • Fixed exit error caused by Evidence Groups.
  • Metadata To Columns – Added LNK MAC Address.
  • Other minor script updates.

06 January 2020 – 5.1.2.9254

  • Cases – Options > Cases path now preserved as base cases folder.
  • Checked Items – Fixed issue with checks no clearing green squares.
  • Script – Additional export options added to Export Files by Type.
  • Script – Added CLI launcher to Scripts\Evidence\CLI_Launcher.pas.

20 December 2019 – 5.1.2.9226

  • Spanish – FEX GUI translation update.
  • Other – Minor updates.

17 December 2019 – 5.1.2.9222

  • APFS – Updated detection of encrypted partitions.
  • Project Vic – Fixed issue with some Project Vic files not being recognized.
  • Scripts – Fixed issue resizing script forms.

11 December 2019 – 5.1.2.9200

  • APFS – Fixed issue with encrypted partitions reporting unallocated space size.
  • Help – Updated Turkish v5 User Guide.
  • Reports – Fixed issue with Reports not reading some cached pictures.
  • Splash – Fixed issue with splash reporting an expiring license date.

5 December 2019 – 5.1.2.9180

  • Backup Case – Writes to both screen and log when logging is selected.
  • Cache Images – Update for Gallery and Video views.
  • Thumbs-cache – Update to decode of thumbs indexes.
  • Fixed remove folder error introduced in previous release.
  • Fixed error in date filter tool introduced in previous release.

20 November 2019 – 5.1.2.9148

  • Live Boot – Updates for APFS Live Boot support (file vault drives are not currently supported).
  • GUI Update – Windows themes added. Snap to monitor now supported.
  • Video Gallery – Significant speed increase in Video Gallery.
  • Video Gallery – Fixed corrupt video crashing gallery.

08 November 2019 – 5.1.2.9128

  • APFS – Added support for 128bit encryption keys.
  • Live Boot – Added support for APFS.
  • Registry – Improved speed of script buttons.
  • Tumbs.db – Fixed display of thumb image.
  • Video View – Fix crash caused by corrupt video.

29 October 2019 – 5.1.2.9090

  • APFS – Fix issue prompting for encryption password.
  • Filters – Added registry signature filter.
  • Filters – Updated Registry drop down filter.
  • L01 write – Increased L01 write segment size.
  • Triage – Improved triage speed.

22 October 2019 – 5.1.2.9072

  • APFS Encryption – Now handles multiple volume keys in the KeyBag.
  • Expand Compound – Fixed issue with signature analysis of children.
  • Scripts – Added script to count zero sectors.
  • 7Zip – Improved expansion function.

17 October 2019 – 5.1.2.9054

  • Categories View – Fixed error displaying categories.
  • Evidence – Recent Cases double click during case.
  • Evidence – Added case modified date to displayed information.
  • Evidence – Case names in bold font for recent cases.
  • L01 – Improved read speed.
  • Skin Tone drop down filter added (must run skin tone first).
  • ZMODO video file type added for signature and carving.

14 October 2019 – 5.1.2.9046

  • Evidence – Fixed issue with drag and drop of multiple evidence files.
  • German/Spanish – Fixed MBR translation error.
  • Spanish – Fixed triage report.
  • Other minor updates.

10 October 2019 – 5.1.2.9028 – Major Version Release
Version 5 Release Notes

Other Download Links

Learn more about the debug version