Download
Forensic Explorer 64 bit
*Requires physical dongle | |
*Requires software key | |
|
Set GUI language on install (Chinese, English, French, German, Indonesian, Spanish, Turkish)
Requests are verified manually and require valid end-user details. The Forensic Explorer 30 day evaluation version does not support: Case Save; Export; or Live Boot. To fully evaluate the software a 90 day dongle license is available for purchase. Request more detail in the comment field.
Request 30 Day Evaluation Version Key
FEX v5 Change Log
18 Sep 2023 – v5.6.8.4340
- Case/Evidence Time Zone:
- New Case, Add Evidence – Defaults to UTC (previously Local Time).
- Changed wording of ‘None’ to ‘Not Set’, When ‘Not Set’ is used, (e.g., for the Case folder), child items (e.g., forensic images) can be set individually.
- Save Case – Fixed extract metadata issue that could have led to a save case error.
13 Sep 2023 – v5.6.8.4324
- AI – Improved FEX-AI speed.
- Artifacts – Updated Brave Browser, Android Gmail.
- Custom Filter – Fixed issue editing a custom filter.
- Display View – Updated display view windows. Additional file type display.
- Display View – Improved mouse wheel zoom.
- Hash Differential – Added hash error messages to column.
- Hash Fuzzy – Added hash error messages to column.
- Hash Match – Improved Differential and Fuzzy by including percentage hashed.
- Hash Speed – Fixed introduced hash speed issue.
- TAR – Improved expansion of large .TAR produced in in phone acquisitions.
- VMDK – Added support for older VMDK files.
18 Aug 2023 – v5.6.8.4240
- Activation – CodeMeter updates.
- Artifacts – Updates for iOS and Android.
- Column Filter – Fixed issue switching between column filters.
8 Aug 2023 – v5.6.8.4210
- Artifacts – Updates for iOS and Android.
- Email – Fixed msg export size error.
- License Manager – Updated the GetData License Manager.
- L01 – Added a single acquisition hash that can be verified in FEX or EnCase.
- L01 – Added hash information to log file.
- Scripts – Added conditional define to share scripts between GUI and CLI.
28 Jul 2023 – v5.6.8.4170
- Artifacts – Updates for iOS and Android.
- Cellebrite.UFDR – Format added to Open Image option.
22 Jul 2023 – v5.6.8.4138
- Artifacts – Updates for iOS and Android.
- Other minor updates.
14 Jul 2023 – v5.6.8.4086
- Artifacts – Added W11 Program Compatibility Assistant.
- CR3 – Improved identification and display of CR3 graphics.
- Other minor updates.
5 Jul 2023 – v5.6.8.4070
- Artifacts – Updated chat artifacts.
30 June 2023 – v5.6.8.4046
- Artifacts – Added MAC CUPS printing metadata.
- Category Graph – Added column sort.
- DVR – Improved Hikvision. Added folders for individual cameras.
- Memory – Improved memory management.
- Permissions – Improved extraction of permissions metadata.
- Script – Added ability to export JSON from Info, Filesystem Record and Metadata views.
- Signature MPEG – Improved Mpeg file signature identification.
- Signature Yahoo – Improved Yahoo chat file signature identification.
23 June 2023 – v5.6.8.4000
- Artifacts – Removed artifact folders with zero counts.
- Artifacts – Fixed issue with artifacts module resetting required columns.
- Artifacts Browsers – Now includes URL summary (e.g., Bing, Google, YouTube queries).
- Registry – Added LastKnownGoodTime to Quick Registry and Registry module.
8 Jun 2023 – v5.6.8.3972
- Index Search – Update process distribution for machines with a high core count.
- Quick Word Report – Added to File System and Bookmark toolbars on startup.
- Quick Word Report – Added default column selections.
- Registry – Added time sync and auto-update keys.
8 Jun 2023 – v5.6.8.3972
- Script maintenance.
1 Jun 2023 – v5.6.8.3964
- Artifacts – Added MAC deleted users, MAC preferences.
- Column Filter – Blank and Not Blank column filters are now read only fields.
- Custom Columns – Added ability to save and load custom column layouts.
- Display View – Improved for complex SQLite files.
- Quick MS Word Report – Updated Files System > Tools > Quick MSWord Report.
- Verification – Added AFF4 verification hash information to Evidence module.
20 May 23 – v5.6.8.3902
- Hash Match – Added support for NSRL v3 Minimal hash sets..
- Artifacts – Improved WhatsApp for Android.
15 May 23 – v5.6.8.3886
- Improved validation of Hikvision (DVR) file systems.
- File and Folder Name Search – Search inside Zip/Rar checked on fresh install.
- Other minor script updates.
8 May 23 – v5.6.8.3868
- Artifacts – Added Google Play Installed Applications (Android).
- Artifacts – Added Photos.sqlite (iOS).
- Artifacts – Added Photos Internal (Android).
- Artifacts – Added Photos External (Android).
- Artifacts – Added Wifi Configurations (Android).
- 3rd Party Tools – Added TrID File Identifier.
- 3rd Party Tools – Added Zimmerman Jump List Examiner.
- Other minor updates.
1 May 23 – v5.6.8.3834
- Google Earth KML – Added HEIC to Google Earth KML creation.
- Prefetch – Updated code for Prefetch Execution Count.
- Other minor script updates.
24 Apr 23 – v5.6.8.3816
- DVR – Added Hikvision DVR file system support.
- DVR – Added LVF (Logitech Video Effects File) file system support.
15 Apr 23 – v5.6.8.3796
- Artifacts – Added Fitbit and Slack.
- Scripts – Other minor script updates.
12 Apr 23 – v5.6.8.3778
- Artifacts – Added Apple Health.
- Email – Improved non-English character support.
- Export – Improved BMP video keyframe export.
- Script – Updated Journal parser script.
4 Apr 23 – v5.6.8.3746
- Display Docx – Fixed introduced error where docx were being displayed as compound files.
31 Mar 23 – v5.6.8.3740
- Quick Word Report – Updated underlying MSOffice integration code.
- Scripts – New script defaults to UTF8-BOM for language support.
- Zip – Improved Zip64 support.
18 Mar 23 – v5.6.8.3710
- Email – Index search result no longer displays container (e.g. PST), just message.
- Export Rows – Upgraded export CSV, HTML.
- RAR – Improved set-password in File System.
- Setup Files – Updated setup file builder.
- Other minor script updates.
08 Mar 23 – v5.6.8.3676
- Bookmark Folders by Hash Set Match – Export report added.
- Copy cell – Now works with multiple file selection.
- Recover Folders – Select all button added.
- Other minor script updates.
27 Feb 23 – v5.6.8.3626
- Evidence module – Credentials repository for Bitlocker and File Vault passwords.
- NodeXL: Updated Visualize Email script. Added LNK visualize.
- Video View > Export > Export Video Quick Views (‘story-boards’ as jpg).
15 Feb 23 – v5.6.8.3584
- File and Folder Name Search – Updated for unicode support,
- Verify Device = Added hash of logical image segments.
15 Feb 23 – v5.6.8.3572
- AFF4 – Fixed introduced error where AFF4 File System did not process.
12 Feb 23 – v5.6.8.3564
- Bitlocker – Auto-process after right-click add encryption password.
- Codemeter – Updated digital certificate for Win11.
- Entropy – Added full file entropy calculation: Analysis Programs > Entropy (Shannon).
- Other minor GUI updates.
3 Feb 23 – v5.6.8.3536
- Metadata – Additional Extract Metadata and Bookmark options for MS Office.
- Hash Match – Display column checkbox is now on by default.
- Hash Create – Fixed vertical scroll issue on form.
- Other minor GUI updates.
27 Jan 23 – v5.6.8.3512
- Export – Enabled typed paths for file export.
- Investigator – Improved addition and management of investigator details.
9 Jan 23 – v5.6.8.3468
- FEX-Artificial Intelligence (FEX-AI):
– Face Detection
– Face Recognition
– Object Detection
– Weapon Detection - JSON Hash Match – Fixed issue populating HashSet Category column.
- Reports – Fixed issue with specific email body text not displaying.
- Tools > 3rd Party Tools – Added Elcomsoft Encrypted Disk Hunter.
- VMDK – Fixed issue reading VMDK image.
12 Dec 22 – v5.6.8.3392
- Gallery/Video Views – Red border indicates a filtered view.
- Gzip – Fixed issue expanding Gzip.
- Other minor updates.
25 Nov 22 – v5.6.8.3300
- Artifacts – Improved extraction of .evtx Event Data.
- Artifacts – Added button to export artifact folder contents to CSV.
- Email – Added project Vic export to Email module.
- Live Boot – VM date options are now created from all drives (not just boot drives).
21 Nov 22 – v5.6.8.3282
- Artifacts – Improved identification of Chrome/Chromium based Autofill artifacts.
- Bookmarks – Tree filter no longer includes default bookmark folders.
- Duplicate Items by MD5 (filter) – Active files now take filter precedence over carved files.
- Email – Signature Analysis now performed by default when files are sent to the Email module.
- Evidence Module – Can add or move between groups when a process is running.
- Log Files – Removed redundant logs.
- Log File Viewer – Added column sorting.
- OCR – Fixed logical/physical size difference in OCR GUI.
- RamDisk Tools – Improved feedback from Zimmerman AppCompatCacheParser.
- Recovered Folders – Improved for FAT.
11 Nov 22 – v5.6.8.3252
- Bookmarks – Improved auto adding of selected text to bookmark.
- Bookmarks – Improved visual display of bookmarked item icon.
- Email – Signature analysis is now performed by default when sending files to the Email module.
- Filters – Added Registry – Amcache.hve filter.
- File System folders tree – Right-click ‘Reset view’ (removes: branch plate, checks, folders filter, contracts all).
- Hashing – Reduced memory and improved speed when using EnCase multi hash.
- HashSets – Added NSRLv3 support.
- Keyword Search – Added renaming of previous keyword search results.
- RamDisk Tools – Added Zimmerman AppCompatCacheParser.
28 Oct 22 – v5.6.8.3214
- Artifacts: Added Office 2016 Backstage.
- Email: Improvements for encoded email headers.
- Live Boot: Fixed Live Boot Deploy error introduced in previous version.
25 Oct 22 – v5.6.8.3200
- Email: Added filter option to ‘Extract Addresses’.
- Evidence: Improved progress for Ex01 verification.
- Gallery View: Dual middle information bar.
- Index Search: Updated unallocated clusters to stop file sig. in first sector changing indexing behavior.
- Live Boot: Updates for compatibility with VirtualBox 7.
- Note: Live Boot with VirtualBox 7 is currently under testing.
- Signature: Updated $MFT file signature.
14 Oct 22 – v5.6.8.3168
- EX01 – Fixed issue with Ex01 acquisition hash not displaying in Evidence module.
- Gallery View – Fixed crash with image inside expanded file.
- Live Boot – Additional updates to improve Live Boot of Win 11.
- Reports – Improved drag and drop of tables to report editor.
28 Sep 22 – v5.6.8.3122
- Live Boot – Updates for Windows 11.
- Windows 11 now autodetects in Live Boot form.
- Increased default memory size to 4G.
- Scripts – Updates to Script Editor.
- Added begin > end vertical lines and other minor features.
24 Sep 22 – v5.6.8.3106
- CPU – Fixed increase in CPU resources from previous release.
- Physical Device – Fixed issue previewing physical devices.
17 Sep 22 – v5.6.8.3096
- Checkbox – Improved checkbox speed for large cases.
- Email – Updated decoding of subject for Google Takeout .mbox.
- Email – Added ‘Labels’ folder for Google Takeout mbox.
- Expand Files – Updated with additional options for graphics and video.
- Folder Tree – Right-click copy cell added.
- GPS Scripts – Co-ordinates added to bookmark comments.
- Information Bar – Middle information bar split to 2 lines. LS (Logical Size) and PS (Physical Size) now specified.
- Signature Analysis – Is now included in the default processing profile.
- Triage Report – Added a report section for Windows Password Hints.
- Wibu Codemeter update, 7.51.
- Other minor updates.
15 Aug 22 – v5.4.8.2946
- Email – Fixes issue saving email to PST.
- Filter – Added File System > Printers filter.
12 Aug 22 – v5.4.8.2938
- Artifacts Chat – Added Android: TikTok, Vemo, Viber, WeMe, Wire.
- Artifacts – Added button to create GPX map file for common GPS artifacts.
- Branch Plate – Updates to branch plate speed.
- Date/Time: Active case/evidence timezone now highlighted in tree.
- Send To Registry: Improved sending of registry files to Registry module.
- Other minor updates and improvements.
25 Jul 22 – v5.4.8.2896
- Artifacts – Added Skype Chatsync.
- Categories Chart – Improved display for individual folders.
- DPI configuration registry key added to enable manual adjustment of FEX display.
- Index Search – Added logging of options selected.
- FileSystem > Analysis Programs > Regex Search – Improved progress bar for checked items only.
15 Jul 22 – v5.4.8.2868
- Gallery View – Fixed issue with Gallery View display after refresh (introduced in previous release).
- Other minor updates.
08 Jul 22 – v5.4.8.2856
- Evidence Processor – Fixed issue in Evidence Processor expanding files for additional devices.
- Improved GPX file creation in: File System > Analysis Programs > GPS – Google My Maps Create.
30 Jun 22 – v5.4.8.2842
- MD5 Hash – Improved hash speed.
- File System > Filename Search – Renamed Bitcoin to Crypto Currency.
- File System > Analysis Programs > GPS – Google My Maps Create.
- Recover Folders – Fixed GUI AV after Recovered Folders had been manually removed.
- Right-Click Expand Compound Files – Fixed error introduced in previous version causing right-click expand compound files to fail.
17 Jun 22 – v5.4.8.2814
- File System > Analysis Programs – Added Shadow Copy OnDiskSnapshotProp.
- HEX View – Fixed Info. bar refresh for GOTO File Offset.
- Sector Start – Column now blank when sector start is unknown.
- Triage – Added Shadow Copy OnDiskSnapshotProp to Triage and Triage report.
8 Jun 22 – v5.4.8.2794
- APFS – Improved reading of APFS filesystem.
3 Jun 22 – v5.4.8.2786
- APFS – Improved memory management.
- Other minor updates.
22 May 22 – v5.4.8.2754
- Artifacts – Added Opera browser carve.
- Artifacts – Added Discord.
- Bookmarks – Fixed display of Bookmark Folder column.
12 May 22 – v5.4.8.2740
- FEX Viewer – Fixed email filters.
- CRC32 Hash – Fixed issue with display text direction.
- Search Artifact Results – Updated to save custom search as .txt.
- Volume Label – Added root folder volume ID to extraction script and Triage report.
2 May 22 – v5.4.8.2714
- Email Export – Added checkbox on export form to ignore all attachments.
- Export – Fixed issue prefixing Bates ID when exporting from Email and Bookmarks modules.
- Word Quick Report – Stability update for Word 365.
8 Apr 22 – v5.4.8.2698
- Classification – Fixed issue updating a previously classified picture.
- Event Logs – Added Windows .evtx Event Log processing to Artifacts module.
- Extract Metadata – File System > Toolbar > Extract Metadata > Extract Permissions To Columns – Add options for HPFS and APFS.
- File Info – File System > Toolbar > File Info: Updated for HFS and APFS.
- TAR – Updated drivers for faster .TAR extraction of large images (e.g. cell phone extractions).
- Other – Minor GUI updates.
21 Mar 22 – v5.4.8.2672
- Artifacts – Updated:
- iOS ApplicationState
- iOS Instagram
- iOS Line chat
- iOS Photo Vault
- iOS Telegram
- iOS Wire
- Other minor GUI updates.
21 Mar 22 – v5.4.8.2644
- Artifacts – Updated:
- iOS Cell Tower Locations
- iOS Facebook Messenger
- iOS Installed Applications
- iOS Mail
- iOS Notes
- iOS Parked Car Locations
- iOS Significant Locations
- iOS TextNow
- iOS TikTok
- iOS Wifi
- iOS Zoom
- Progress Window – Now clears logs between cases.
11 Mar 22 – v5.4.8.2616
- Translation – Fixed translation error on startup for non-English versions.
- Reference Library – File System > Tools > Reference Library. Replaced existing library with Zotero.
- Other minor updates.
01 Mar 22 – v5.4.8.2578
- Artifacts – Update of browsers and chat.
- Delete Bookmark Sub-Folder – Fixed access violation on delete.
- Display View – Improved table display for SQLite.
- Email – Update to Export to PST.
- Reports – Improved tree sort when manually creating a report template.
- Video Bookmarks – Adding blur for bookmarked video thumbnails now shows in report.
21 Feb 22 – v5.4.8.2554
- Artifacts – Updated: Android MMSSMS, Burner, ProtonMail, Skype, SnapChat, TextNow.
- Display View – Clear viewers when currently selected file is filtered out.
- Export Email – Added export to PST.
- Export L01 – Fixed display error in Export to L01 for Folder Data checkbox.
- Hash – Added SHA512.
- Hash – Added ability to process EnCase multi-type.hash sets.
- Hash – Create flat hash set fix to excluded expanded compound files.
- Installation – Fixed Microsoft SmartScreen message on FEX install.
- Relativity – Fixed issue importing segmented L01 into relativity.
21 Jan 22 – v5.4.8.2474
- FFMpeg and VLC Play – File System > Tools > RamDisk. Added warning message if checked videos > 5.
- Hash Match – File System > Hash Match > Bookmark Files by Hash Set Match remembers last Hash Set location.
- Index Search – Added additional logging for excluded encrypted files.
- Physical Device Serial Number – Added to: ‘File System module > Analysis Programs > Volume ID and Partition Information’.
- Other minor updates.
7 Jan 22 – v5.4.8.2456
- 3rd Party Tools – Added Nirsoft NetworkUsageView.
- ESE – Fixed error parsing corrupt Exchange Database file.
- Highlight File in Module – Now shows a message if file is excluded by filter.
- Investigator – Updated new investigator form.
- Reports – Fixed missing Documents and Pictures samples.
23 Dec 21 – v5.4.8.2392
- File Carve – Added columns (Base: Bates; Filename; Path) to identify source.
- Gzip – Improved identification of corrupt files to limit false export size.
- Keyword Search – Improved search for HFS file systems.
- Hash Set Create – Added options to exclude items from hash set (folders, free space, NTFS, system).
- Index Search – Added Metadata tab to module.
- License Manger – Fixed issue renaming dongle.
- Metadata – Added ODT creator metadata tag.
- Reports – Fixed column width for include checkbox.
- Reports – Improved landscape options in Reports module.
26 Nov 21 – v5.4.8.2320
- CLI – New release and updates to FEX GUI CLI launcher.
- Export – Added export to XLSX.
- File List – Updated colors for File List views.
- HashSet Create – Added exclude options.
- OCR – Improved text parsing.
- Project Vic – Updated Project Vic classification colors.
- Recycle Bin – Added script to parse WinXP Info2 records.
- Scripts – Backend updates to scripting engine.
10 Nov 21 – v5.4.8.2250
- Email – Updated Search Email Columns script.
- Other minor updates.
01 Nov 21 – v5.4.8.2232
- Classification – Updated classifications options window. Added button to File List module.
- File System – Added double-click in File List to drill into folders.
- Load Case – Fixed issue loading case with expanded compound PDFs.
26 Oct 21 – v5.4.8.2198
- Hash Set – Fixed freeze creating very large .db3 hash set.
- Metadata – Export Metadata tab contents to .txt.
20 Oct 21 – v5.4.8.2182
- Email – Added UTC to email message header in Display view.
- Email – Added Clam AntiVirus to Email module.
- Metadata – Improved extraction of .torrent files.
- Metadata – Updated extract metadata script.
- File List – Fixed issue where highlight of large list could freeze.
- Reports – Fixed issue where bookmark comment did not display.
- Other minor updates.
11 Oct 21 – v5.4.8.2150
- L01 – Fixed issue with L01 being read by NUIX.
- Scripts – RamDisk script updates.
- Other minor updates.
07 Oct 21 – v5.4.8.2134
- Byte Plot – Fixed display error viewing large files.
- Encryption – Improved detection of 7z and PDF encryption.
- Export – Improved export of files when saving to root folder of a drive.
- Hash – Added xxHash64.
- Video – Improved keyframe extraction.
- Zip – Increased speed on zip detection.
- Other minor GUI updates.
24 Sep 21 – v5.4.8.2084
- Export – Solved issue creating root export folder on external USB.
- Logs – View log text during process.
- Registry – Updated Registry module icons.
- Registry- Improved user account idenifification for UsrClass.dat and ntuser.dat.
21 Sep 21 – v5.4.8.2058
- Checkbox – Improved checkbox responsiveness on large cases.
- Column Text Filter – Added a separate Simple search with boolean AND, OR , NOT functionality.
- Disk view – Improved disk view responsiveness on large cases.
- Preview – Locked preview case remove by another instance of FEX.
12 Sep 21 – v5.4.8.2018
- Analysis Programs > Encrypted Files – Identify encrypted files within archives.
- Email – Improved column filter for To/From/Subject/Attachments.
- Splash – Fixed startup error with 90 day dongle license.
- Other minor updates.
01 Sep 21 – v5.4.8.1968
- Encrypted Files – Improved detection of encrypted DOC, PPT, XLS.
- Scripts – Added Analysis Programs > Journal Parser ($UsnJrnl~$J).
- Zip Export – Improved handling of special char in file names.
- Zip Export – Added warning message for decompression programs that do not handle > 250 char. path lengths.
- Other minor updates.
22 Aug 21 – v5.4.8.1926
- Activation – Wibu Codemeter update.
- Case Number – Added this field to case information.
- ClamAV – Update for new ClamAV config.
- Column Filter – Added AND/OR logic to simple column filter.
- Columns Default – Removed Flags, Classification.
- Display – Update to display view for additional file previews.
- DTSearch – Update to DTSearch DLL.
- Email – Updates to EDB, EML, EMLX, MBOX, MSG, OST, PST.
- Email – Added Read column.
- File Carve – Fixed error carving TGA files.
- Filters – Added additional email filters.
- OCR – Added graphics Optical Character Recognition (OCR).
- RamDisk Tools – Added VLC to RamDisk tools.
- Script – Added xxHash capability.
17 Jun 2021 – v5.4.2.1678
- Email – Updates to OST processing.
- Email – Update to Outlook Caesar decoder for resident small attachments.
- Registry – Updated to display REG_UNKNOWN key data.
7 Jun 2021 – v5.4.2.1650
- Email – Fixed save and load error with very large PST files in Email module.
1 Jun 2021 – v5.4.2.1634
- 3rd Party Tools – Added IrfanView screen capture and thumbnails.
- Export Files – Added option to export with file slack.
- Export JSON – Added graphics and video tags to Project VIC JSON export.
- Live Boot Deploy – Fixed issue ordering multiple devices in deploy script.
- Metadata – Added Extract Metadata for Track Changes.
- Reports – Fixed issue with landscape.
- Reports – Improved email message display.
- Other minor updates (icons etc.)
30 Apr 2021 – v5.4.2.1578
- C4All – Fixed import error.
- FileVault – Fixed unlock of APFS system container after Catalina update.
- Progress Bar – Improved progress bar formatting.
- Quick Word Reports – MS Word stability updates.
- Signature/Display – Added Webp signature, preview, and gallery view.
19 Apr 2021 – v5.4.2.1536
- Activation – Improved action when local dongle connectivity lost.
- Activation – Network dongles switch when connectivity is lost.
- Artifacts – Added GroupMe JSON.
- Download – New certificate. (Note: Download may trigger Defender SmartScreen).
- Keyword – Fixed issue with default keyword txt not populating on install.
- Project Vic – Added graphics/video tag to export.
- RamDisk Tools – Added Zimmerman Shell Bag Explorer.
- Signature – Added Zip (Encrypted).
- Translations Updates – Chinese, French, German, Indonesian, Spanish, Turkish.
- Word Quick Report – Improved stability.
- Other minor updates and improvements.
20 March 2021 – v5.4.2.1404
- Clam Antivirus – New database update links.
- Email Module – Added duplicate email script, filter and toolbar button.
- Display – Improved DOCX display.
- Other minor updates.
15 March 2021 – v5.4.2.1380
- Email Module – Added right-click > Export > PDF File.
- Evidence Module – Updated Check For Updates config. to check on launch.
- File System Module – Updated Analysis Programs > Recycle Bin Match $I with $R
- Non-English OS – Fixed launch issue from previous update.
- Reports Module – Improved High-Res PDF export.
- Other minor updates.
6 March 2021 – v5.4.2.1352
- Codemeter – Update to 7.20a.
- Extract Metadata – Added user permissions.
- File Signature – Added ODT (Encrypted).
- GetDataNetworkServer – Fixed issue when run as Windows Service.
- Interpol Classification – CAM script update.
- File Carve – Fixed issue with Minolta RAW returning large file size.
- Quick Report – Added export email to PDF.
- Quick Registry – Added Windows UserSID.
- Recover Folders – Fix issue returning invalid files on HPFS.
- Triage Report – Added UserSID section.
25 February 2021 – v5.4.2.1316
- Display View – Updated Adobe.psd display for multiple images.
- Display View – Updated OpenOffice.odt display.
- Email Module – Added a display tab for the message header.
- GUI Updates – Column separators, highlight and select colors, icons.
- Script – Added File System > Analysis Programs > Folder Sizes.
- Word Report – Added File System > Tools > Quick Word Report.
03 February 2021 – v5.4.2.1238
- Classification – Added Interpol Baseline 4 category.
- Email – Updated PST/OST Send-To-Module.
- Reports – Improved high-res PDF export.
- Reports – Improved sort by field.
14 January 2021 – v5.4.2.1180
- Fixed German translation error causing freeze.
- Update RamDisk scripts for new NirSoft versions.
- Other minor script updates.
23 December 2020 – v5.4.2.1140
- Email – PST processor update.
- Filter – Fixed hash set match filter.
- GUI – Improved forms ‘stay in front’.
- Other minor updates.
16 December 2020 – v5.4.2.1122
- Bitlocker/File Vault – Password is added to the column and Triage report.
- Branch Plate – Added an icon to indicate sub-folders are plated.
- Categories – Added date categories and improved speed.
- Display – Fixed column offset for some SQL files.
- Display – Improved Display view for MSOffice docs (added PPTX).
- Email – Added tab views for Contacts and Calendar.
- Email – Added NodeXL chart.
- Email – Improved support for EDB, ESE, MBOX, PST, OST.
- Email – Added script to collect email address.
- French – Fixed translation error for hash sets.
- JSON Export – Path extended to include device.
- Logging – Fixed MBR count in log file.
- MOV – Improved processing speed.
- Reports – Added export options for blurred graphics.
- Reports – Fixed intermittent error changing between report folders.
- Updated FEX memory management.
- Video – Improved video speed, sound and display.
21 October 2020 – v5.2.2.9978
- Artifacts – Added Instagram direct chat.
- Bookmark – Fixed error causing occasional crash adding bookmark.
- Scripts – File System > Analysis Programs > Recycle Bin Match $I with $R.
- Reports – Samples: Added Recycle Bin report to link $R file with $I metadata.
9 October 2020 – v5.2.2.9944
- Reports – Fixed error creating ‘Report Templates’ folder.
5 October 2020 – v5.2.2.9936
- Artifacts – Added Windows 10 Time Line.
- exFat – Fixed issue reporting incorrect cluster allocation.
- Display View – Improved display of SQLite tables.
- Display View – Improved ODT display.
- Gallery view – Improved blur.
- Install – Fixed issue in last release with language versions installing in English.
- Reports – Fixed freeze clicking between report folders.
- Un-dock – Fixed issue where slow render of SQLite tables un-docked data view.
- Other minor updates and improvements.
3 September 2020 – v5.2.2.9866
- Artifacts – Added unallocated carve for search URLs.
- FEX Imager Servlet – Now caters for remote imaging with Dynamic IP Changes.
- Filename Search – Search Zip and RAR to 20 levels.
- File System module – Updated File Info button.
- FEX Viewer (free stand-alone product) now available for case review.
- FEX Viewer Case Export – Added to config button shortcut in header toolbar.
- Metadata:
- Updated Extract Metadata button.
- Added extraction of Video metadata.
- Added extraction of Adobe XMP metadata.
- MKV – Detect multiplexing and expand video thumbnails to track folders.
- Text view – Added right-click, show printable characters only.
28 July 2020 – v5.2.2.9748
- Launch Speed
- Improved first install launch speed.
- Improved launch speed.
- Triage Report – Sorted registry so that current appears first.
- Triage MAC – Updated Triage report with additional artifacts.
- Other minor updates and improvements.
21 July 2020 – v5.2.2.9736
- APFS – Improvements based on new Apple documentation.
- Case – Fixed error opening FEX-Triage case.
- Classification – Drop down menu added for Gallery View CEM Classification:
- Project Vic
- Copine
- SAP
- SOD
- Display View – Updated preview of DOCX files in display view tab.
- Expand Compound – Fixed error expanding 7z.
- Project Vic – Changed export date times from local to UTC.
- Scripts – Improved forcing display windows to front of screen.
14 July 2020 – 5.2.2.9714
- Artifacts – Added Browsers:
- Safari Bookmarks
- Safari Downloads
- Safari Top Sites
- Artifacts – Added MAC Operating System:
- Mail BackupTOC
- Recent iWork Numbers
- Recent iWork Pages
- Recent QuickTime
- Recent TextEdit
- Recent VLC
- Custom Byte Carve – Quick Add Google Maps.
- Display View – Updated DOCX display.
- FEX-Imager changed to 64-bit to allow for Ex0, Lx01 conversion to E01 or L01.
- Live Boot – Added button to Evidence module.
- Reports – Fixed issue with blur on exported PDF.
- Website Update – Check for Updates button now links with new download page.
29 June 2020 – 5.2.2.9680
- Email – Improved MBOX support.
22 June 2020 – 5.2.2.9662
- Bookmarks – Artifact bookmarking auto-creates bookmark folder.
- Email – Improved MBOX support.
- License Manager – Identifies locked dongle.
- Live Boot – Select storage controller (Auto, IDE, SATA, BusLogic, LsiLogic, LsiLogicSAS).
- Load Case – Improved load case time.
- Preview – Button in Evidence module now default.
- Registry – Improved Office MRU script.
- Reports – Fixed AV in copy and paste of table row.
- Reports – PDF resolution improved.
- Reports – Updated report column sorting.
- Reports – Updated sample templates.
11 June 2020 – 5.2.2.9632:
- Email – Fixed error loading an old case with PST email.
06 June 2020 – 5.2.2.9622
- Email – Improved export from property view.
- PDF – Fixed issue with expanded PDF causing freeze.
- Reports – Export PDF in high resolution.
- Video – Added .ts video file type.
03 June 2020 – 5.2.2.9618
- Artifacts – Improved search speed for Artifact files.
- Artifacts – Added Chromium bookmarks and improved categorization.
- Artifacts – Clear of 1601 blank Delphi date fields.
- Evidence Processor – Changed button to Skip processing.
- Gallery Cache – Improved gallery cache speed.
- Metadata – Added metadata for HEIC files.
- FEX-Imager – Speed improvements.
- Recover File – Added drag and drop for case recovery files.
- Remote – Improved network connection speed for remote devices.
- Other minor updates and improvements.
7 May 2020 – 5.2.2.9526
- Artifacts – Minor fixes and improvements.
- ClamAV – Updates to improve speed. Removed default check for PUA.
- FEX-Imager – Released FEX-Imager v2 (located in install folder).
- Gallery View – Fixed cache thumbnail error on small cache graphics causing a freeze.
- Email – Added Email module support for mbox mail.
- Email – Added Email module support for EDB mail.
- Email – Fixed issue with blank OST email subject displaying message page offset.
21 Apr 2020 – 5.2.2.9472
- Bookmarks – Fixed issue re-bookmarking a bookmarked file.
- Remote – Updated protocols (increase remote serve-let connection speed).
- Other minor updates.
15 Apr 2020 – 5.2.2.9452
- Btilocker Partitions – Now return isEncrypted status.
- Progress – Fixed issue with progress bar staying on-top of other applications.
- Project VIC2 – Import and Export support added.
- VDI – Updated support for Virtual Desktop image format.
9 Apr 2020 – 5.2.2.9444
- APFS – Updated drive decryption routine.
- Artifacts – Script updates.
- C4All – Add Cellebrite C4All export to FEX.
- RAID6 – Added RAID 6 support.
- Remote – Updated Add Remote network config.
31 Mar 2020 – 5.2.2.9420
- Merge Files – Right click menu option added.
- Setup – Improved setup for non-admin installs. Removed auto-launch.
- Permissions – Added NTFS Permissions viewer.
- Other minor script updates and improvements.
17 Mar 2020 – 5.1.2.9378
- Live Boot – Fixed issue causing Live Boot to not launch.
13 Mar 2020 – 5.1.2.9372
- Artifacts – Added Viber for PC v11.
- File Vault – Fixed pwd check for AES-128 encrypted volumes converted to APFS.
- Hex Data Inspector – New layout.
- Merge Files – File System right-click menu option to merge data.
- RamDisk Tools – Added FFmpeg.
05 Mar 2020 – 5.1.2.9342
- Load Case – Fixed error loading case created from folder containing Zone files.
- APFS – Improved support for MacQuisition decrypted APFS volumes.
- Other minor script updates and improvements.
24 February 2020 – 5.1.2.9324
- Filters – Improved Read From File filter.
- L01 – Improved detection of corrupt L01 or missing segments on add of evidence.
- Scripts – Updates to File Name Search to handle large imported keyword lists.
- Triage – Fixed error introduced in previous build causing Default + Triage to fail.
13 February 2020 – 5.1.2.9314
- Bookmarks – Fixed sub-folder sort error.
- Bookmarks – Added Artifacts as a default folder.
- Display View – Updated multi-video view buttons.
- File Name Search – Updated array size for large keyword lists.
- HEX View – Fixed flicker on double click.
- Index Search – Added additional data view tabs (Hex, Display, Filesystem Record).
5 February 2020 – 5.1.2.9306
- Bookmarks – Non default folders get different icon.
- Display – FFMPEG DLL update (fix OGG and WK3 freeze).
- File Carve – Added USN Journal file type.
- File Signature – Update to ESE file type to improve speed.
- HEX – Update to HEX selection.
- Keyword Search – Enabled multi select of keyword.txt import files.
- Recover Folders – If Bad Cluster file recover set at 0 size.
- Registry – Improved speed of ‘Send to Registry’.
- Toolbar – Fixed minimize maximize error on toolbar.
29 January 2020 – 5.1.2.9288
- CLI Hash min/max size fix.
- Metadata To Columns – Added ‘Extract Recycle Bin’ for $I values.
- Recycle Bin – Decode INFO2 in File Metadata tab (after signature).
- Recycle Bin – Added Zimmerman RBCmd to 3rd Party Tools.
- Other minor script updates.
24 January 2020 – 5.1.2.9270
- Fixed exit error caused by Evidence Groups.
- Metadata To Columns – Added LNK MAC Address.
- Other minor script updates.
06 January 2020 – 5.1.2.9254
- Cases – Options > Cases path now preserved as base cases folder.
- Checked Items – Fixed issue with checks no clearing green squares.
- Script – Additional export options added to Export Files by Type.
- Script – Added CLI launcher to Scripts\Evidence\CLI_Launcher.pas.
20 December 2019 – 5.1.2.9226
- Spanish – FEX GUI translation update.
- Other – Minor updates.
17 December 2019 – 5.1.2.9222
- APFS – Updated detection of encrypted partitions.
- Project Vic – Fixed issue with some Project Vic files not being recognized.
- Scripts – Fixed issue resizing script forms.
11 December 2019 – 5.1.2.9200
- APFS – Fixed issue with encrypted partitions reporting unallocated space size.
- Help – Updated Turkish v5 User Guide.
- Reports – Fixed issue with Reports not reading some cached pictures.
- Splash – Fixed issue with splash reporting an expiring license date.
5 December 2019 – 5.1.2.9180
- Backup Case – Writes to both screen and log when logging is selected.
- Cache Images – Update for Gallery and Video views.
- Thumbs-cache – Update to decode of thumbs indexes.
- Fixed remove folder error introduced in previous release.
- Fixed error in date filter tool introduced in previous release.
20 November 2019 – 5.1.2.9148
- Live Boot – Updates for APFS Live Boot support (file vault drives are not currently supported).
- GUI Update – Windows themes added. Snap to monitor now supported.
- Video Gallery – Significant speed increase in Video Gallery.
- Video Gallery – Fixed corrupt video crashing gallery.
08 November 2019 – 5.1.2.9128
- APFS – Added support for 128bit encryption keys.
- Live Boot – Added support for APFS.
- Registry – Improved speed of script buttons.
- Tumbs.db – Fixed display of thumb image.
- Video View – Fix crash caused by corrupt video.
29 October 2019 – 5.1.2.9090
- APFS – Fix issue prompting for encryption password.
- Filters – Added registry signature filter.
- Filters – Updated Registry drop down filter.
- L01 write – Increased L01 write segment size.
- Triage – Improved triage speed.
22 October 2019 – 5.1.2.9072
- APFS Encryption – Now handles multiple volume keys in the KeyBag.
- Expand Compound – Fixed issue with signature analysis of children.
- Scripts – Added script to count zero sectors.
- 7Zip – Improved expansion function.
17 October 2019 – 5.1.2.9054
- Categories View – Fixed error displaying categories.
- Evidence – Recent Cases double click during case.
- Evidence – Added case modified date to displayed information.
- Evidence – Case names in bold font for recent cases.
- L01 – Improved read speed.
- Skin Tone drop down filter added (must run skin tone first).
- ZMODO video file type added for signature and carving.
14 October 2019 – 5.1.2.9046
- Evidence – Fixed issue with drag and drop of multiple evidence files.
- German/Spanish – Fixed MBR translation error.
- Spanish – Fixed triage report.
- Other minor updates.
10 October 2019 – 5.1.2.9028 – Major Version Release
Version 5 Release Notes
Other Download Links
Learn more about the debug version