Skip to main content

Download

Forensic Explorer 64 bit

Set GUI language on install (Chinese, English, French, German, Indonesian, Spanish, Turkish)

Request 30 Day Evaluation Version Key

Requests are verified manually and require valid end-user details.

 

The Forensic Explorer 30 day evaluation version does not support: Case Save; Export; or Live Boot.

To fully evaluate the software a 90 day dongle license is available for purchase. Request more detail in the comment field.

 

Product Details Purchase

FEX v5 Change Log

25 Nov 22 – v5.6.8.3300

  • Artifacts – Improved extraction of .evtx Event Data.
  • Artifacts – Added button to export artifact folder contents to CSV.
  • Email – Added project Vic export to Email module.
  • Live Boot – VM date options are now created from all drives (not just boot drives).

21 Nov 22 – v5.6.8.3282

  • Artifacts – Improved identification of Chrome/Chromium based Autofill artifacts.
  • Bookmarks – Tree filter no longer includes default bookmark folders.
  • Duplicate Items by MD5 (filter) – Active files now take filter precedence over carved files.
  • Email – Signature Analysis now performed by default when files are sent to the Email module.
  • Evidence Module – Can add or move between groups when a process is running.
  • Log Files – Removed redundant logs.
  • Log File Viewer – Added column sorting.
  • OCR – Fixed logical/physical size difference in OCR GUI.
  • RamDisk Tools – Improved feedback from Zimmerman AppCompatCacheParser.
  • Recovered Folders – Improved for FAT.

11 Nov 22 – v5.6.8.3252

  • Bookmarks – Improved auto adding of selected text to bookmark.
  • Bookmarks – Improved visual display of bookmarked item icon.
  • Email – Signature analysis is now performed by default when sending files to the Email module.
  • Filters – Added Registry – Amcache.hve filter.
  • File System folders tree – Right-click ‘Reset view’ (removes: branch plate, checks, folders filter, contracts all).
  • Hashing – Reduced memory and improved speed when using EnCase multi hash.
  • HashSets – Added NSRLv3 support.
  • Keyword Search – Added renaming of previous keyword search results.
  • RamDisk Tools – Added Zimmerman AppCompatCacheParser.

28 Oct 22 – v5.6.8.3214

  • Artifacts: Added Office 2016 Backstage.
  • Email: Improvements for encoded email headers.
  • Live Boot: Fixed Live Boot Deploy error introduced in previous version.

25 Oct 22 – v5.6.8.3200

  • Email: Added filter option to ‘Extract Addresses’.
  • Evidence: Improved progress for Ex01 verification.
  • Gallery View: Dual middle information bar.
  • Index Search: Updated unallocated clusters to stop file sig. in first sector changing indexing behavior.
  • Live Boot: Updates for compatibility with VirtualBox 7.
    • Note: Live Boot with VirtualBox 7 is currently under testing.
  • Signature: Updated $MFT file signature.

14 Oct 22 – v5.6.8.3168

  • EX01 – Fixed issue with Ex01 acquisition hash not displaying in Evidence module.
  • Gallery View – Fixed crash with image inside expanded file.
  • Live Boot – Additional updates to improve Live Boot of Win 11.
  • Reports – Improved drag and drop of tables to report editor.

28 Sep 22 – v5.6.8.3122

  • Live Boot – Updates for Windows 11.
    • Windows 11 now autodetects in Live Boot form.
    • Increased default memory size to 4G.
  • Scripts – Updates to Script Editor.
    • Added begin > end vertical lines and other minor features.

24 Sep 22 – v5.6.8.3106

  • CPU – Fixed increase in CPU resources from previous release.
  • Physical Device – Fixed issue previewing physical devices.

17 Sep 22 – v5.6.8.3096

  • Checkbox – Improved checkbox speed for large cases.
  • Email – Updated decoding of subject for Google Takeout .mbox.
  • Email – Added ‘Labels’ folder for Google Takeout mbox.
  • Expand Files – Updated with additional options for graphics and video.
  • Folder Tree – Right-click copy cell added.
  • GPS Scripts – Co-ordinates added to bookmark comments.
  • Information Bar – Middle information bar split to 2 lines. LS (Logical Size) and PS (Physical Size) now specified.
  • Signature Analysis – Is now included in the default processing profile.
  • Triage Report – Added a report section for Windows Password Hints.
  • Wibu Codemeter update, 7.51.
  • Other minor updates.

15 Aug 22 – v5.4.8.2946

  • Email – Fixes issue saving email to PST.
  • Filter – Added File System > Printers filter.

12 Aug 22 – v5.4.8.2938

  • Artifacts Chat – Added Android: TikTok, Vemo, Viber, WeMe, Wire.
  • Artifacts – Added button to create GPX map file for common GPS artifacts.
  • Branch Plate – Updates to branch plate speed.
  • Date/Time: Active case/evidence timezone now highlighted in tree.
  • Send To Registry: Improved sending of registry files to Registry module.
  • Other minor updates and improvements.

25 Jul 22 – v5.4.8.2896

  • Artifacts – Added Skype Chatsync.
  • Categories Chart – Improved display for individual folders.
  • DPI configuration registry key added to enable manual adjustment of FEX display.
  • Index Search – Added logging of options selected.
  • FileSystem > Analysis Programs > Regex Search – Improved progress bar for checked items only.

15 Jul 22 – v5.4.8.2868

  • Gallery View – Fixed issue with Gallery View display after refresh (introduced in previous release).
  • Other minor updates.

08 Jul 22 – v5.4.8.2856

  • Evidence Processor – Fixed issue in Evidence Processor expanding files for additional devices.
  • Improved GPX file creation in: File System > Analysis Programs > GPS – Google My Maps Create.

30 Jun 22 – v5.4.8.2842

  • MD5 Hash – Improved hash speed.
  • File System > Filename Search – Renamed Bitcoin to Crypto Currency.
  • File System > Analysis Programs > GPS – Google My Maps Create.
  • Recover Folders – Fixed GUI AV after Recovered Folders had been manually removed.
  • Right-Click Expand Compound Files – Fixed error introduced in previous version causing right-click expand compound files to fail.

17 Jun 22 – v5.4.8.2814

  • File System > Analysis Programs – Added Shadow Copy OnDiskSnapshotProp.
  • HEX View – Fixed Info. bar refresh for GOTO File Offset.
  • Sector Start – Column now blank when sector start is unknown.
  • Triage – Added Shadow Copy OnDiskSnapshotProp to Triage and Triage report.

8 Jun 22 – v5.4.8.2794

  • APFS – Improved reading of APFS filesystem.

3 Jun 22 – v5.4.8.2786

  • APFS – Improved memory management.
  • Other minor updates.

22 May 22 – v5.4.8.2754

  • Artifacts – Added Opera browser carve.
  • Artifacts – Added Discord.
  • Bookmarks – Fixed display of Bookmark Folder column.

12 May 22 – v5.4.8.2740

  • FEX Viewer – Fixed email filters.
  • CRC32 Hash – Fixed issue with display text direction.
  • Search Artifact Results – Updated to save custom search as .txt.
  • Volume Label – Added root folder volume ID to extraction script and Triage report.

2 May 22 – v5.4.8.2714

  • Email Export – Added checkbox on export form to ignore all attachments.
  • Export – Fixed issue prefixing Bates ID when exporting from Email and Bookmarks modules.
  • Word Quick Report – Stability update for Word 365.

8 Apr 22 – v5.4.8.2698

  • Classification – Fixed issue updating a previously classified picture.
  • Event Logs – Added Windows .evtx Event Log processing to Artifacts module.
  • Extract Metadata – File System > Toolbar > Extract Metadata > Extract Permissions To Columns – Add options for HPFS and APFS.
  • File Info – File System > Toolbar > File Info: Updated for HFS and APFS.
  • TAR – Updated drivers for faster .TAR extraction of large images (e.g. cell phone extractions).
  • Other – Minor GUI updates.

21 Mar 22 – v5.4.8.2672

  • Artifacts – Updated:
    • iOS ApplicationState
    • iOS Instagram
    • iOS Line chat
    • iOS Photo Vault
    • iOS Telegram
    • iOS Wire
  • Other minor GUI updates.

21 Mar 22 – v5.4.8.2644

  • Artifacts – Updated:
    • iOS Cell Tower Locations
    • iOS Facebook Messenger
    • iOS Installed Applications
    • iOS Mail
    • iOS Notes
    • iOS Parked Car Locations
    • iOS Significant Locations
    • iOS TextNow
    • iOS TikTok
    • iOS Wifi
    • iOS Zoom
  • Progress Window – Now clears logs between cases.

11 Mar 22 – v5.4.8.2616

  • Translation – Fixed translation error on startup for non-English versions.
  • Reference Library – File System > Tools > Reference Library. Replaced existing library with Zotero.
  • Other minor updates.

01 Mar 22 – v5.4.8.2578

  • Artifacts – Update of browsers and chat.
  • Delete Bookmark Sub-Folder – Fixed access violation on delete.
  • Display View – Improved table display for SQLite.
  • Email – Update to Export to PST.
  • Reports – Improved tree sort when manually creating a report template.
  • Video Bookmarks – Adding blur for bookmarked video thumbnails now shows in report.

21 Feb 22 – v5.4.8.2554

  • Artifacts – Updated: Android MMSSMS, Burner, ProtonMail, Skype, SnapChat, TextNow.
  • Display View – Clear viewers when currently selected file is filtered out.
  • Export Email – Added export to PST.
  • Export L01 – Fixed display error in Export to L01 for Folder Data checkbox.
  • Hash – Added SHA512.
  • Hash – Added ability to process EnCase multi-type.hash sets.
  • Hash – Create flat hash set fix to excluded expanded compound files.
  • Installation – Fixed Microsoft SmartScreen message on FEX install.
  • Relativity – Fixed issue importing segmented L01 into relativity.

21 Jan 22 – v5.4.8.2474

  • FFMpeg and VLC Play – File System > Tools > RamDisk. Added warning message if checked videos > 5.
  • Hash Match – File System > Hash Match > Bookmark Files by Hash Set Match remembers last Hash Set location.
  • Index Search – Added additional logging for excluded encrypted files.
  • Physical Device Serial Number – Added to: ‘File System module > Analysis Programs > Volume ID and Partition Information’.
  • Other minor updates.

7 Jan 22 – v5.4.8.2456

  • 3rd Party Tools – Added Nirsoft NetworkUsageView.
  • ESE – Fixed error parsing corrupt Exchange Database file.
  • Highlight File in Module – Now shows a message if file is excluded by filter.
  • Investigator – Updated new investigator form.
  • Reports – Fixed missing Documents and Pictures samples.

23 Dec 21 – v5.4.8.2392

  • File Carve – Added columns (Base: Bates; Filename; Path) to identify source.
  • Gzip – Improved identification of corrupt files to limit false export size.
  • Keyword Search – Improved search for HFS file systems.
  • Hash Set Create – Added options to exclude items from hash set (folders, free space, NTFS, system).
  • Index Search – Added Metadata tab to module.
  • License Manger – Fixed issue renaming dongle.
  • Metadata – Added ODT creator metadata tag.
  • Reports – Fixed column width for include checkbox.
  • Reports – Improved landscape options in Reports module.

26 Nov 21 – v5.4.8.2320

  • CLI – New release and updates to FEX GUI CLI launcher.
  • Export – Added export to XLSX.
  • File List – Updated colors for File List views.
  • HashSet Create – Added exclude options.
  • OCR – Improved text parsing.
  • Project Vic – Updated Project Vic classification colors.
  • Recycle Bin – Added script to parse WinXP Info2 records.
  • Scripts – Backend updates to scripting engine.

10 Nov 21 – v5.4.8.2250

  • Email – Updated Search Email Columns script.
  • Other minor updates.

01 Nov 21 – v5.4.8.2232

  • Classification – Updated classifications options window. Added button to File List module.
  • File System – Added double-click in File List to drill into folders.
  • Load Case – Fixed issue loading case with expanded compound PDFs.

26 Oct 21 – v5.4.8.2198

  • Hash Set – Fixed freeze creating very large .db3 hash set.
  • Metadata – Export Metadata tab contents to .txt.

20 Oct 21 – v5.4.8.2182

  • Email – Added UTC to email message header in Display view.
  • Email – Added Clam AntiVirus to Email module.
  • Metadata – Improved extraction of .torrent files.
  • Metadata – Updated extract metadata script.
  • File List – Fixed issue where highlight of large list could freeze.
  • Reports – Fixed issue where bookmark comment did not display.
  • Other minor updates.

11 Oct 21 – v5.4.8.2150

  • L01 – Fixed issue with L01 being read by NUIX.
  • Scripts – RamDisk script updates.
  • Other minor updates.

07 Oct 21 – v5.4.8.2134

  • Byte Plot – Fixed display error viewing large files.
  • Encryption – Improved detection of 7z and PDF encryption.
  • Export – Improved export of files when saving to root folder of a drive.
  • Hash – Added xxHash64.
  • Video – Improved keyframe extraction.
  • Zip – Increased speed on zip detection.
  • Other minor GUI updates.

24 Sep 21 – v5.4.8.2084

  • Export – Solved issue creating root export folder on external USB.
  • Logs – View log text during process.
  • Registry – Updated Registry module icons.
  • Registry- Improved user account idenifification for UsrClass.dat and ntuser.dat.

21 Sep 21 – v5.4.8.2058

  • Checkbox – Improved checkbox responsiveness on large cases.
  • Column Text Filter – Added a separate Simple search with boolean AND, OR , NOT functionality.
  • Disk view – Improved disk view responsiveness on large cases.
  • Preview – Locked preview case remove by another instance of FEX.

12 Sep 21 – v5.4.8.2018

  • Analysis Programs > Encrypted Files – Identify encrypted files within archives.
  • Email – Improved column filter for To/From/Subject/Attachments.
  • Splash – Fixed startup error with 90 day dongle license.
  • Other minor updates.

01 Sep 21 – v5.4.8.1968

  • Encrypted Files – Improved detection of encrypted DOC, PPT, XLS.
  • Scripts – Added Analysis Programs > Journal Parser ($UsnJrnl~$J).
  • Zip Export – Improved handling of special char in file names.
  • Zip Export – Added warning message for decompression programs that do not handle > 250 char. path lengths.
  • Other minor updates.

22 Aug 21 – v5.4.8.1926

  • Activation – Wibu Codemeter update.
  • Case Number – Added this field to case information.
  • ClamAV – Update for new ClamAV config.
  • Column Filter – Added AND/OR logic to simple column filter.
  • Columns Default – Removed Flags, Classification.
  • Display – Update to display view for additional file previews.
  • DTSearch – Update to DTSearch DLL.
  • Email – Updates to EDB, EML, EMLX, MBOX, MSG, OST, PST.
  • Email – Added Read column.
  • File Carve – Fixed error carving TGA files.
  • Filters – Added additional email filters.
  • OCR – Added graphics Optical Character Recognition (OCR).
  • RamDisk Tools – Added VLC to RamDisk tools.
  • Script – Added xxHash capability.

17 Jun 2021 – v5.4.2.1678

  • Email – Updates to OST processing.
  • Email – Update to Outlook Caesar decoder for resident small attachments.
  • Registry – Updated to display REG_UNKNOWN key data.

7 Jun 2021 – v5.4.2.1650

  • Email – Fixed save and load error with very large PST files in Email module.

1 Jun 2021 – v5.4.2.1634

  • 3rd Party Tools – Added IrfanView screen capture and thumbnails.
  • Export Files – Added option to export with file slack.
  • Export JSON – Added graphics and video tags to Project VIC JSON export.
  • Live Boot Deploy – Fixed issue ordering multiple devices in deploy script.
  • Metadata – Added Extract Metadata for Track Changes.
  • Reports – Fixed issue with landscape.
  • Reports – Improved email message display.
  • Other minor updates (icons etc.)

30 Apr 2021 – v5.4.2.1578

  • C4All – Fixed import error.
  • FileVault – Fixed unlock of APFS system container after Catalina update.
  • Progress Bar – Improved progress bar formatting.
  • Quick Word Reports – MS Word stability updates.
  • Signature/Display – Added Webp signature, preview, and gallery view.

19 Apr 2021 – v5.4.2.1536

  • Activation – Improved action when local dongle connectivity lost.
  • Activation – Network dongles switch when connectivity is lost.
  • Artifacts – Added GroupMe JSON.
  • Download – New certificate. (Note: Download may trigger Defender SmartScreen).
  • Keyword – Fixed issue with default keyword txt not populating on install.
  • Project Vic – Added graphics/video tag to export.
  • RamDisk Tools – Added Zimmerman Shell Bag Explorer.
  • Signature – Added Zip (Encrypted).
  • Translations Updates – Chinese, French, German, Indonesian, Spanish, Turkish.
  • Word Quick Report – Improved stability.
  • Other minor updates and improvements.

20 March 2021 – v5.4.2.1404

  • Clam Antivirus – New database update links.
  • Email Module – Added duplicate email script, filter and toolbar button.
  • Display – Improved DOCX display.
  • Other minor updates.

15 March 2021 – v5.4.2.1380

  • Email Module – Added right-click > Export > PDF File.
  • Evidence Module – Updated Check For Updates config. to check on launch.
  • File System Module – Updated Analysis Programs > Recycle Bin Match $I with $R
  • Non-English OS – Fixed launch issue from previous update.
  • Reports Module – Improved High-Res PDF export.
  • Other minor updates.

6 March 2021 – v5.4.2.1352

  • Codemeter – Update to 7.20a.
  • Extract Metadata – Added user permissions.
  • File Signature – Added ODT (Encrypted).
  • GetDataNetworkServer – Fixed issue when run as Windows Service.
  • Interpol Classification – CAM script update.
  • File Carve – Fixed issue with Minolta RAW returning large file size.
  • Quick Report – Added export email to PDF.
  • Quick Registry – Added Windows UserSID.
  • Recover Folders – Fix issue returning invalid files on HPFS.
  • Triage Report – Added UserSID section.

25 February 2021 – v5.4.2.1316

  • Display View – Updated Adobe.psd display for multiple images.
  • Display View – Updated OpenOffice.odt display.
  • Email Module – Added a display tab for the message header.
  • GUI Updates – Column separators, highlight and select colors, icons.
  • Script – Added File System > Analysis Programs > Folder Sizes.
  • Word Report – Added File System > Tools > Quick Word Report.

03 February 2021 – v5.4.2.1238

  • Classification – Added Interpol Baseline 4 category.
  • Email – Updated PST/OST Send-To-Module.
  • Reports – Improved high-res PDF export.
  • Reports – Improved sort by field.

14 January 2021 – v5.4.2.1180

  • Fixed German translation error causing freeze.
  • Update RamDisk scripts for new NirSoft versions.
  • Other minor script updates.

23 December 2020 – v5.4.2.1140

  • Email – PST processor update.
  • Filter – Fixed hash set match filter.
  • GUI – Improved forms ‘stay in front’.
  • Other minor updates.

16 December 2020 – v5.4.2.1122

  • Bitlocker/File Vault – Password is added to the column and Triage report.
  • Branch Plate – Added an icon to indicate sub-folders are plated.
  • Categories – Added date categories and improved speed.
  • Display – Fixed column offset for some SQL files.
  • Display – Improved Display view for MSOffice docs (added PPTX).
  • Email – Added tab views for Contacts and Calendar.
  • Email – Added NodeXL chart.
  • Email – Improved support for EDB, ESE, MBOX, PST, OST.
  • Email – Added script to collect email address.
  • French – Fixed translation error for hash sets.
  • JSON Export – Path extended to include device.
  • Logging – Fixed MBR count in log file.
  • MOV – Improved processing speed.
  • Reports – Added export options for blurred graphics.
  • Reports – Fixed intermittent error changing between report folders.
  • Updated FEX memory management.
  • Video – Improved video speed, sound and display.

21 October 2020 – v5.2.2.9978

  • Artifacts – Added Instagram direct chat.
  • Bookmark – Fixed error causing occasional crash adding bookmark.
  • Scripts – File System > Analysis Programs > Recycle Bin Match $I with $R.
  • Reports – Samples: Added Recycle Bin report to link $R file with $I metadata.

9 October 2020 – v5.2.2.9944

  • Reports – Fixed error creating ‘Report Templates’ folder.

5 October 2020 – v5.2.2.9936

  • Artifacts – Added Windows 10 Time Line.
  • exFat – Fixed issue reporting incorrect cluster allocation.
  • Display View – Improved display of SQLite tables.
  • Display View – Improved ODT display.
  • Gallery view – Improved blur.
  • Install – Fixed issue in last release with language versions installing in English.
  • Reports – Fixed freeze clicking between report folders.
  • Un-dock – Fixed issue where slow render of SQLite tables un-docked data view.
  • Other minor updates and improvements.

3 September 2020 – v5.2.2.9866

  • Artifacts – Added unallocated carve for search URLs.
  • FEX Imager Servlet – Now caters for remote imaging with Dynamic IP Changes.
  • Filename Search – Search Zip and RAR to 20 levels.
  • File System module – Updated File Info button.
  • FEX Viewer (free stand-alone product) now available for case review.
  • FEX Viewer Case Export – Added to config button shortcut in header toolbar.
  • Metadata:
  • Updated Extract Metadata button.
  • Added extraction of Video metadata.
  • Added extraction of Adobe XMP metadata.
  • MKV – Detect multiplexing and expand video thumbnails to track folders.
  • Text view – Added right-click, show printable characters only.

28 July 2020 – v5.2.2.9748

  • Launch Speed
  • Improved first install launch speed.
  • Improved launch speed.
  • Triage Report – Sorted registry so that current appears first.
  • Triage MAC – Updated Triage report with additional artifacts.
  • Other minor updates and improvements.

21 July 2020 – v5.2.2.9736

  • APFS – Improvements based on new Apple documentation.
  • Case – Fixed error opening FEX-Triage case.
  • Classification – Drop down menu added for Gallery View CEM Classification:
  • Project Vic
  • Copine
  • SAP
  • SOD
  • Display View – Updated preview of DOCX files in display view tab.
  • Expand Compound – Fixed error expanding 7z.
  • Project Vic – Changed export date times from local to UTC.
  • Scripts – Improved forcing display windows to front of screen.

14 July 2020 – 5.2.2.9714

  • Artifacts – Added Browsers:
  • Safari Bookmarks
  • Safari Downloads
  • Safari Top Sites
  • Artifacts – Added MAC Operating System:
  • Mail BackupTOC
  • Recent iWork Numbers
  • Recent iWork Pages
  • Recent QuickTime
  • Recent TextEdit
  • Recent VLC
  • Custom Byte Carve – Quick Add Google Maps.
  • Display View – Updated DOCX display.
  • FEX-Imager changed to 64-bit to allow for Ex0, Lx01 conversion to E01 or L01.
  • Live Boot – Added button to Evidence module.
  • Reports – Fixed issue with blur on exported PDF.
  • Website Update – Check for Updates button now links with new download page.

29 June 2020 – 5.2.2.9680

  • Email – Improved MBOX support.

22 June 2020 – 5.2.2.9662

  • Bookmarks – Artifact bookmarking auto-creates bookmark folder.
  • Email – Improved MBOX support.
  • License Manager – Identifies locked dongle.
  • Live Boot – Select storage controller (Auto, IDE, SATA, BusLogic, LsiLogic, LsiLogicSAS).
  • Load Case – Improved load case time.
  • Preview – Button in Evidence module now default.
  • Registry – Improved Office MRU script.
  • Reports – Fixed AV in copy and paste of table row.
  • Reports – PDF resolution improved.
  • Reports – Updated report column sorting.
  • Reports – Updated sample templates.

11 June 2020 – 5.2.2.9632:

  • Email – Fixed error loading an old case with PST email.

06 June 2020 – 5.2.2.9622

  • Email – Improved export from property view.
  • PDF – Fixed issue with expanded PDF causing freeze.
  • Reports – Export PDF in high resolution.
  • Video – Added .ts video file type.

03 June 2020 – 5.2.2.9618

  • Artifacts – Improved search speed for Artifact files.
  • Artifacts – Added Chromium bookmarks and improved categorization.
  • Artifacts – Clear of 1601 blank Delphi date fields.
  • Evidence Processor – Changed button to Skip processing.
  • Gallery Cache – Improved gallery cache speed.
  • Metadata – Added metadata for HEIC files.
  • FEX-Imager – Speed improvements.
  • Recover File – Added drag and drop for case recovery files.
  • Remote – Improved network connection speed for remote devices.
  • Other minor updates and improvements.

7 May 2020 – 5.2.2.9526

  • Artifacts – Minor fixes and improvements.
  • ClamAV – Updates to improve speed. Removed default check for PUA.
  • FEX-Imager – Released FEX-Imager v2 (located in install folder).
  • Gallery View – Fixed cache thumbnail error on small cache graphics causing a freeze.
  • Email – Added Email module support for mbox mail.
  • Email – Added Email module support for EDB mail.
  • Email – Fixed issue with blank OST email subject displaying message page offset.

21 Apr 2020 – 5.2.2.9472

  • Bookmarks – Fixed issue re-bookmarking a bookmarked file.
  • Remote – Updated protocols (increase remote serve-let connection speed).
  • Other minor updates.

15 Apr 2020 – 5.2.2.9452

  • Btilocker Partitions – Now return isEncrypted status.
  • Progress – Fixed issue with progress bar staying on-top of other applications.
  • Project VIC2 – Import and Export support added.
  • VDI – Updated support for Virtual Desktop image format.

9 Apr 2020 – 5.2.2.9444

  • APFS – Updated drive decryption routine.
  • Artifacts – Script updates.
  • C4All – Add Cellebrite C4All export to FEX.
  • RAID6 – Added RAID 6 support.
  • Remote – Updated Add Remote network config.

31 Mar 2020 – 5.2.2.9420

  • Merge Files – Right click menu option added.
  • Setup – Improved setup for non-admin installs. Removed auto-launch.
  • Permissions – Added NTFS Permissions viewer.
  • Other minor script updates and improvements.

17 Mar 2020 – 5.1.2.9378

  • Live Boot – Fixed issue causing Live Boot to not launch.

13 Mar 2020 – 5.1.2.9372

  • Artifacts – Added Viber for PC v11.
  • File Vault – Fixed pwd check for AES-128 encrypted volumes converted to APFS.
  • Hex Data Inspector – New layout.
  • Merge Files – File System right-click menu option to merge data.
  • RamDisk Tools – Added FFmpeg.

05 Mar 2020 – 5.1.2.9342

  • Load Case – Fixed error loading case created from folder containing Zone files.
  • APFS – Improved support for MacQuisition decrypted APFS volumes.
  • Other minor script updates and improvements.

24 February 2020 – 5.1.2.9324

  • Filters – Improved Read From File filter.
  • L01 – Improved detection of corrupt L01 or missing segments on add of evidence.
  • Scripts – Updates to File Name Search to handle large imported keyword lists.
  • Triage – Fixed error introduced in previous build causing Default + Triage to fail.

13 February 2020 – 5.1.2.9314

  • Bookmarks – Fixed sub-folder sort error.
  • Bookmarks – Added Artifacts as a default folder.
  • Display View – Updated multi-video view buttons.
  • File Name Search – Updated array size for large keyword lists.
  • HEX View – Fixed flicker on double click.
  • Index Search – Added additional data view tabs (Hex, Display, Filesystem Record).

5 February 2020 – 5.1.2.9306

  • Bookmarks – Non default folders get different icon.
  • Display – FFMPEG DLL update (fix OGG and WK3 freeze).
  • File Carve – Added USN Journal file type.
  • File Signature – Update to ESE file type to improve speed.
  • HEX – Update to HEX selection.
  • Keyword Search – Enabled multi select of keyword.txt import files.
  • Recover Folders – If Bad Cluster file recover set at 0 size.
  • Registry – Improved speed of ‘Send to Registry’.
  • Toolbar – Fixed minimize maximize error on toolbar.

29 January 2020 – 5.1.2.9288

  • CLI Hash min/max size fix.
  • Metadata To Columns – Added ‘Extract Recycle Bin’ for $I values.
  • Recycle Bin – Decode INFO2 in File Metadata tab (after signature).
  • Recycle Bin – Added Zimmerman RBCmd to 3rd Party Tools.
  • Other minor script updates.

24 January 2020 – 5.1.2.9270

  • Fixed exit error caused by Evidence Groups.
  • Metadata To Columns – Added LNK MAC Address.
  • Other minor script updates.

06 January 2020 – 5.1.2.9254

  • Cases – Options > Cases path now preserved as base cases folder.
  • Checked Items – Fixed issue with checks no clearing green squares.
  • Script – Additional export options added to Export Files by Type.
  • Script – Added CLI launcher to Scripts\Evidence\CLI_Launcher.pas.

20 December 2019 – 5.1.2.9226

  • Spanish – FEX GUI translation update.
  • Other – Minor updates.

17 December 2019 – 5.1.2.9222

  • APFS – Updated detection of encrypted partitions.
  • Project Vic – Fixed issue with some Project Vic files not being recognized.
  • Scripts – Fixed issue resizing script forms.

11 December 2019 – 5.1.2.9200

  • APFS – Fixed issue with encrypted partitions reporting unallocated space size.
  • Help – Updated Turkish v5 User Guide.
  • Reports – Fixed issue with Reports not reading some cached pictures.
  • Splash – Fixed issue with splash reporting an expiring license date.

5 December 2019 – 5.1.2.9180

  • Backup Case – Writes to both screen and log when logging is selected.
  • Cache Images – Update for Gallery and Video views.
  • Thumbs-cache – Update to decode of thumbs indexes.
  • Fixed remove folder error introduced in previous release.
  • Fixed error in date filter tool introduced in previous release.

20 November 2019 – 5.1.2.9148

  • Live Boot – Updates for APFS Live Boot support (file vault drives are not currently supported).
  • GUI Update – Windows themes added. Snap to monitor now supported.
  • Video Gallery – Significant speed increase in Video Gallery.
  • Video Gallery – Fixed corrupt video crashing gallery.

08 November 2019 – 5.1.2.9128

  • APFS – Added support for 128bit encryption keys.
  • Live Boot – Added support for APFS.
  • Registry – Improved speed of script buttons.
  • Tumbs.db – Fixed display of thumb image.
  • Video View – Fix crash caused by corrupt video.

29 October 2019 – 5.1.2.9090

  • APFS – Fix issue prompting for encryption password.
  • Filters – Added registry signature filter.
  • Filters – Updated Registry drop down filter.
  • L01 write – Increased L01 write segment size.
  • Triage – Improved triage speed.

22 October 2019 – 5.1.2.9072

  • APFS Encryption – Now handles multiple volume keys in the KeyBag.
  • Expand Compound – Fixed issue with signature analysis of children.
  • Scripts – Added script to count zero sectors.
  • 7Zip – Improved expansion function.

17 October 2019 – 5.1.2.9054

  • Categories View – Fixed error displaying categories.
  • Evidence – Recent Cases double click during case.
  • Evidence – Added case modified date to displayed information.
  • Evidence – Case names in bold font for recent cases.
  • L01 – Improved read speed.
  • Skin Tone drop down filter added (must run skin tone first).
  • ZMODO video file type added for signature and carving.

14 October 2019 – 5.1.2.9046

  • Evidence – Fixed issue with drag and drop of multiple evidence files.
  • German/Spanish – Fixed MBR translation error.
  • Spanish – Fixed triage report.
  • Other minor updates.

10 October 2019 – 5.1.2.9028 – Major Version Release
Version 5 Release Notes

Other Download Links

Learn more about the debug version