Download
Forensic Explorer 64 bit
Set GUI language on install (Chinese, English, French, German, Indonesian, Spanish, Turkish)
The Forensic Explorer 30 day evaluation version does not support: Case Save; Export; or Live Boot. To fully evaluate the software a 90 day dongle license is available for purchase. Request more detail in the comment field.Request 30 Day Evaluation Version Key
FEX v5 Change Log
26 Nov 21 – v5.4.8.2320
CLI – New release and updates to FEX GUI CLI launcher.
Export – Added export to XLSX.
File List – Updated colors for File List views.
HashSet Create – Added exclude options.
OCR – Improved text parsing.
Project Vic – Updated Project Vic classification colors.
Recycle Bin – Added script to parse WinXP Info2 records.
Scripts – Backend updates to scripting engine.
10 Nov 21 – v5.4.8.2250
Email – Updated Search Email Columns script.
Other minor updates.
01 Nov 21 – v5.4.8.2232
Classification – Updated classifications options window. Added button to File List module.
File System – Added double-click in File List to drill into folders.
Load Case – Fixed issue loading case with expanded compound PDFs.
26 Oct 21 – v5.4.8.2198
Hash Set – Fixed freeze creating very large .db3 hash set.
Metadata – Export Metadata tab contents to .txt.
20 Oct 21 – v5.4.8.2182
Email – Added UTC to email message header in Display view.
Email – Added Clam AntiVirus to Email module.
Metadata – Improved extraction of .torrent files.
Metadata – Updated extract metadata script.
File List – Fixed issue where highlight of large list could freeze.
Reports – Fixed issue where bookmark comment did not display.
Other minor updates.
11 Oct 21 – v5.4.8.2150
L01 – Fixed issue with L01 being read by NUIX.
Scripts – RamDisk script updates.
Other minor updates.
07 Oct 21 – v5.4.8.2134
Byte Plot – Fixed display error viewing large files.
Encryption – Improved detection of 7z and PDF encryption.
Export – Improved export of files when saving to root folder of a drive.
Hash – Added xxHash64.
Video – Improved keyframe extraction.
Zip – Increased speed on zip detection.
Other minor GUI updates.
24 Sep 21 – v5.4.8.2084
Export – Solved issue creating root export folder on external USB.
Logs – View log text during process.
Registry – Updated Registry module icons.
Registry- Improved user account idenifification for UsrClass.dat and ntuser.dat.
21 Sep 21 – v5.4.8.2058
Checkbox – Improved checkbox responsiveness on large cases.
Column Text Filter – Added a separate Simple search with boolean AND, OR , NOT functionality.
Disk view – Improved disk view responsiveness on large cases.
Preview – Locked preview case remove by another instance of FEX.
12 Sep 21 – v5.4.8.2018
Analysis Programs > Encrypted Files – Identify encrypted files within archives.
Email – Improved column filter for To/From/Subject/Attachments.
Splash – Fixed startup error with 90 day dongle license.
Other minor updates.
01 Sep 21 – v5.4.8.1968
Encrypted Files – Improved detection of encrypted DOC, PPT, XLS.
Scripts – Added Analysis Programs > Journal Parser ($UsnJrnl~$J).
Zip Export – Improved handling of special char in file names.
Zip Export – Added warning message for decompression programs that do not handle > 250 char. path lengths.
Other minor updates.
22 Aug 21 – v5.4.8.1926
Activation – Wibu Codemeter update.
Case Number – Added this field to case information.
ClamAV – Update for new ClamAV config.
Column Filter – Added AND/OR logic to simple column filter.
Columns Default – Removed Flags, Classification.
Display – Update to display view for additional file previews.
DTSearch – Update to DTSearch DLL.
Email – Updates to EDB, EML, EMLX, MBOX, MSG, OST, PST.
Email – Added Read column.
File Carve – Fixed error carving TGA files.
Filters – Added additional email filters.
OCR – Added graphics Optical Character Recognition (OCR).
RamDisk Tools – Added VLC to RamDisk tools.
Script – Added xxHash capability.
17 Jun 2021 – v5.4.2.1678
Email – Updates to OST processing.
Email – Update to Outlook Caesar decoder for resident small attachments.
Registry – Updated to display REG_UNKNOWN key data.
7 Jun 2021 – v5.4.2.1650
Email – Fixed save and load error with very large PST files in Email module.
1 Jun 2021 – v5.4.2.1634
3rd Party Tools – Added IrfanView screen capture and thumbnails.
Export Files – Added option to export with file slack.
Export JSON – Added graphics and video tags to Project VIC JSON export.
Live Boot Deploy – Fixed issue ordering multiple devices in deploy script.
Metadata – Added Extract Metadata for Track Changes.
Reports – Fixed issue with landscape.
Reports – Improved email message display.
Other minor updates (icons etc.)
30 Apr 2021 – v5.4.2.1578
C4All – Fixed import error.
FileVault – Fixed unlock of APFS system container after Catalina update.
Progress Bar – Improved progress bar formatting.
Quick Word Reports – MS Word stability updates.
Signature/Display – Added Webp signature, preview, and gallery view.
19 Apr 2021 – v5.4.2.1536
Activation – Improved action when local dongle connectivity lost.
Activation – Network dongles switch when connectivity is lost.
Artifacts – Added GroupMe JSON.
Download – New certificate. (Note: Download may trigger Defender SmartScreen).
Keyword – Fixed issue with default keyword txt not populating on install.
Project Vic – Added graphics/video tag to export.
RamDisk Tools – Added Zimmerman Shell Bag Explorer.
Signature – Added Zip (Encrypted).
Translations Updates – Chinese, French, German, Indonesian, Spanish, Turkish.
Word Quick Report – Improved stability.
Other minor updates and improvements.
20 March 2021 – v5.4.2.1404
Clam Antivirus – New database update links.
Email Module – Added duplicate email script, filter and toolbar button.
Display – Improved DOCX display.
Other minor updates.
15 March 2021 – v5.4.2.1380
Email Module – Added right-click > Export > PDF File.
Evidence Module – Updated Check For Updates config. to check on launch.
File System Module – Updated Analysis Programs > Recycle Bin Match $I with $R
Non-English OS – Fixed launch issue from previous update.
Reports Module – Improved High-Res PDF export.
Other minor updates.
6 March 2021 – v5.4.2.1352
Codemeter – Update to 7.20a.
Extract Metadata – Added user permissions.
File Signature – Added ODT (Encrypted).
GetDataNetworkServer – Fixed issue when run as Windows Service.
Interpol Classification – CAM script update.
File Carve – Fixed issue with Minolta RAW returning large file size.
Quick Report – Added export email to PDF.
Quick Registry – Added Windows UserSID.
Recover Folders – Fix issue returning invalid files on HPFS.
Triage Report – Added UserSID section.
25 February 2021 – v5.4.2.1316
Display View – Updated Adobe.psd display for multiple images.
Display View – Updated OpenOffice.odt display.
Email Module – Added a display tab for the message header.
GUI Updates – Column separators, highlight and select colors, icons.
Script – Added File System > Analysis Programs > Folder Sizes.
Word Report – Added File System > Tools > Quick Word Report.
03 February 2021 – v5.4.2.1238
Classification – Added Interpol Baseline 4 category.
Email – Updated PST/OST Send-To-Module.
Reports – Improved high-res PDF export.
Reports – Improved sort by field.
14 January 2021 – v5.4.2.1180
Fixed German translation error causing freeze.
Update RamDisk scripts for new NirSoft versions.
Other minor script updates.
23 December 2020 – v5.4.2.1140
Email – PST processor update.
Filter – Fixed hash set match filter.
GUI – Improved forms ‘stay in front’.
Other minor updates.
16 December 2020 – v5.4.2.1122
Bitlocker/File Vault – Password is added to the column and Triage report.
Branch Plate – Added an icon to indicate sub-folders are plated.
Categories – Added date categories and improved speed.
Display – Fixed column offset for some SQL files.
Display – Improved Display view for MSOffice docs (added PPTX).
Email – Added tab views for Contacts and Calendar.
Email – Added NodeXL chart.
Email – Improved support for EDB, ESE, MBOX, PST, OST.
Email – Added script to collect email address.
French – Fixed translation error for hash sets.
JSON Export – Path extended to include device.
Logging – Fixed MBR count in log file.
MOV – Improved processing speed.
Reports – Added export options for blurred graphics.
Reports – Fixed intermittent error changing between report folders.
Updated FEX memory management.
Video – Improved video speed, sound and display.
21 October 2020 – v5.2.2.9978
Artifacts – Added Instagram direct chat.
Bookmark – Fixed error causing occasional crash adding bookmark.
Scripts – File System > Analysis Programs > Recycle Bin Match $I with $R.
Reports – Samples: Added Recycle Bin report to link $R file with $I metadata.
9 October 2020 – v5.2.2.9944
Reports – Fixed error creating ‘Report Templates’ folder.
5 October 2020 – v5.2.2.9936
Artifacts – Added Windows 10 Time Line.
exFat – Fixed issue reporting incorrect cluster allocation.
Display View – Improved display of SQLite tables.
Display View – Improved ODT display.
Gallery view – Improved blur.
Install – Fixed issue in last release with language versions installing in English.
Reports – Fixed freeze clicking between report folders.
Un-dock – Fixed issue where slow render of SQLite tables un-docked data view.
Other minor updates and improvements.
3 September 2020 – v5.2.2.9866
Artifacts – Added unallocated carve for search URLs.
FEX Imager Servlet – Now caters for remote imaging with Dynamic IP Changes.
Filename Search – Search Zip and RAR to 20 levels.
File System module – Updated File Info button.
FEX Viewer (free stand-alone product) now available for case review.
FEX Viewer Case Export – Added to config button shortcut in header toolbar.
Metadata:
Updated Extract Metadata button.
Added extraction of Video metadata.
Added extraction of Adobe XMP metadata.
MKV – Detect multiplexing and expand video thumbnails to track folders.
Text view – Added right-click, show printable characters only.
28 July 2020 – v5.2.2.9748
Launch Speed
Improved first install launch speed.
Improved launch speed.
Triage Report – Sorted registry so that current appears first.
Triage MAC – Updated Triage report with additional artifacts.
Other minor updates and improvements.
21 July 2020 – v5.2.2.9736
APFS – Improvements based on new Apple documentation.
Case – Fixed error opening FEX-Triage case.
Classification – Drop down menu added for Gallery View CEM Classification:
Project Vic
Copine
SAP
SOD
Display View – Updated preview of DOCX files in display view tab.
Expand Compound – Fixed error expanding 7z.
Project Vic – Changed export date times from local to UTC.
Scripts – Improved forcing display windows to front of screen.
14 July 2020 – 5.2.2.9714
Artifacts – Added Browsers:
Safari Bookmarks
Safari Downloads
Safari Top Sites
Artifacts – Added MAC Operating System:
Mail BackupTOC
Recent iWork Numbers
Recent iWork Pages
Recent QuickTime
Recent TextEdit
Recent VLC
Custom Byte Carve – Quick Add Google Maps.
Display View – Updated DOCX display.
FEX-Imager changed to 64-bit to allow for Ex0, Lx01 conversion to E01 or L01.
Live Boot – Added button to Evidence module.
Reports – Fixed issue with blur on exported PDF.
Website Update – Check for Updates button now links with new download page.
29 June 2020 – 5.2.2.9680
Email – Improved MBOX support.
22 June 2020 – 5.2.2.9662
Bookmarks – Artifact bookmarking auto-creates bookmark folder.
Email – Improved MBOX support.
License Manager – Identifies locked dongle.
Live Boot – Select storage controller (Auto, IDE, SATA, BusLogic, LsiLogic, LsiLogicSAS).
Load Case – Improved load case time.
Preview – Button in Evidence module now default.
Registry – Improved Office MRU script.
Reports – Fixed AV in copy and paste of table row.
Reports – PDF resolution improved.
Reports – Updated report column sorting.
Reports – Updated sample templates.
11 June 2020 – 5.2.2.9632:
Email – Fixed error loading an old case with PST email.
06 June 2020 – 5.2.2.9622
Email – Improved export from property view.
PDF – Fixed issue with expanded PDF causing freeze.
Reports – Export PDF in high resolution.
Video – Added .ts video file type.
03 June 2020 – 5.2.2.9618
Artifacts – Improved search speed for Artifact files.
Artifacts – Added Chromium bookmarks and improved categorization.
Artifacts – Clear of 1601 blank Delphi date fields.
Evidence Processor – Changed button to Skip processing.
Gallery Cache – Improved gallery cache speed.
Metadata – Added metadata for HEIC files.
FEX-Imager – Speed improvements.
Recover File – Added drag and drop for case recovery files.
Remote – Improved network connection speed for remote devices.
Other minor updates and improvements.
7 May 2020 – 5.2.2.9526
Artifacts – Minor fixes and improvements.
ClamAV – Updates to improve speed. Removed default check for PUA.
FEX-Imager – Released FEX-Imager v2 (located in install folder).
Gallery View – Fixed cache thumbnail error on small cache graphics causing a freeze.
Email – Added Email module support for mbox mail.
Email – Added Email module support for EDB mail.
Email – Fixed issue with blank OST email subject displaying message page offset.
21 Apr 2020 – 5.2.2.9472
Bookmarks – Fixed issue re-bookmarking a bookmarked file.
Remote – Updated protocols (increase remote serve-let connection speed).
Other minor updates.
15 Apr 2020 – 5.2.2.9452
Btilocker Partitions – Now return isEncrypted status.
Progress – Fixed issue with progress bar staying on-top of other applications.
Project VIC2 – Import and Export support added.
VDI – Updated support for Virtual Desktop image format.
9 Apr 2020 – 5.2.2.9444
APFS – Updated drive decryption routine.
Artifacts – Script updates.
C4All – Add Cellebrite C4All export to FEX.
RAID6 – Added RAID 6 support.
Remote – Updated Add Remote network config.
31 Mar 2020 – 5.2.2.9420
Merge Files – Right click menu option added.
Setup – Improved setup for non-admin installs. Removed auto-launch.
Permissions – Added NTFS Permissions viewer.
Other minor script updates and improvements.
17 Mar 2020 – 5.1.2.9378
Live Boot – Fixed issue causing Live Boot to not launch.
13 Mar 2020 – 5.1.2.9372
Artifacts – Added Viber for PC v11.
File Vault – Fixed pwd check for AES-128 encrypted volumes converted to APFS.
Hex Data Inspector – New layout.
Merge Files – File System right-click menu option to merge data.
RamDisk Tools – Added FFmpeg.
05 Mar 2020 – 5.1.2.9342
Load Case – Fixed error loading case created from folder containing Zone files.
APFS – Improved support for MacQuisition decrypted APFS volumes.
Other minor script updates and improvements.
24 February 2020 – 5.1.2.9324
Filters – Improved Read From File filter.
L01 – Improved detection of corrupt L01 or missing segments on add of evidence.
Scripts – Updates to File Name Search to handle large imported keyword lists.
Triage – Fixed error introduced in previous build causing Default + Triage to fail.
13 February 2020 – 5.1.2.9314
Bookmarks – Fixed sub-folder sort error.
Bookmarks – Added Artifacts as a default folder.
Display View – Updated multi-video view buttons.
File Name Search – Updated array size for large keyword lists.
HEX View – Fixed flicker on double click.
Index Search – Added additional data view tabs (Hex, Display, Filesystem Record).
5 February 2020 – 5.1.2.9306
Bookmarks – Non default folders get different icon.
Display – FFMPEG DLL update (fix OGG and WK3 freeze).
File Carve – Added USN Journal file type.
File Signature – Update to ESE file type to improve speed.
HEX – Update to HEX selection.
Keyword Search – Enabled multi select of keyword.txt import files.
Recover Folders – If Bad Cluster file recover set at 0 size.
Registry – Improved speed of ‘Send to Registry’.
Toolbar – Fixed minimize maximize error on toolbar.
29 January 2020 – 5.1.2.9288
CLI Hash min/max size fix.
Metadata To Columns – Added ‘Extract Recycle Bin’ for $I values.
Recycle Bin – Decode INFO2 in File Metadata tab (after signature).
Recycle Bin – Added Zimmerman RBCmd to 3rd Party Tools.
Other minor script updates.
24 January 2020 – 5.1.2.9270
Fixed exit error caused by Evidence Groups.
Metadata To Columns – Added LNK MAC Address.
Other minor script updates.
06 January 2020 – 5.1.2.9254
Cases – Options > Cases path now preserved as base cases folder.
Checked Items – Fixed issue with checks no clearing green squares.
Script – Additional export options added to Export Files by Type.
Script – Added CLI launcher to Scripts\Evidence\CLI_Launcher.pas.
20 December 2019 – 5.1.2.9226
Spanish – FEX GUI translation update.
Other – Minor updates.
17 December 2019 – 5.1.2.9222
APFS – Updated detection of encrypted partitions.
Project Vic – Fixed issue with some Project Vic files not being recognized.
Scripts – Fixed issue resizing script forms.
11 December 2019 – 5.1.2.9200
APFS – Fixed issue with encrypted partitions reporting unallocated space size.
Help – Updated Turkish v5 User Guide.
Reports – Fixed issue with Reports not reading some cached pictures.
Splash – Fixed issue with splash reporting an expiring license date.
5 December 2019 – 5.1.2.9180
Backup Case – Writes to both screen and log when logging is selected.
Cache Images – Update for Gallery and Video views.
Thumbs-cache – Update to decode of thumbs indexes.
Fixed remove folder error introduced in previous release.
Fixed error in date filter tool introduced in previous release.
20 November 2019 – 5.1.2.9148
Live Boot – Updates for APFS Live Boot support (file vault drives are not currently supported).
GUI Update – Windows themes added. Snap to monitor now supported.
Video Gallery – Significant speed increase in Video Gallery.
Video Gallery – Fixed corrupt video crashing gallery.
08 November 2019 – 5.1.2.9128
APFS – Added support for 128bit encryption keys.
Live Boot – Added support for APFS.
Registry – Improved speed of script buttons.
Tumbs.db – Fixed display of thumb image.
Video View – Fix crash caused by corrupt video.
29 October 2019 – 5.1.2.9090
APFS – Fix issue prompting for encryption password.
Filters – Added registry signature filter.
Filters – Updated Registry drop down filter.
L01 write – Increased L01 write segment size.
Triage – Improved triage speed.
22 October 2019 – 5.1.2.9072
APFS Encryption – Now handles multiple volume keys in the KeyBag.
Expand Compound – Fixed issue with signature analysis of children.
Scripts – Added script to count zero sectors.
7Zip – Improved expansion function.
17 October 2019 – 5.1.2.9054
Categories View – Fixed error displaying categories.
Evidence – Recent Cases double click during case.
Evidence – Added case modified date to displayed information.
Evidence – Case names in bold font for recent cases.
L01 – Improved read speed.
Skin Tone drop down filter added (must run skin tone first).
ZMODO video file type added for signature and carving.
14 October 2019 – 5.1.2.9046
Evidence – Fixed issue with drag and drop of multiple evidence files.
German/Spanish – Fixed MBR translation error.
Spanish – Fixed triage report.
Other minor updates.
10 October 2019 – 5.1.2.9028 – Major Version Release
Version 5 Release Notes
Other Download Links
Learn more about the debug version