Skip to main content

Download

Forensic Explorer 64 bit

*Requires physical dongle
*Requires software key

Set GUI language on install (Chinese, English, French, German, Indonesian, Spanish, Turkish)

Request 30 Day Evaluation Version Key

Requests are verified manually and require valid end-user details.

 

The Forensic Explorer 30 day evaluation version does not support: Case Save; Export; or Live Boot.

To fully evaluate the software a 90 day dongle license is available for purchase. Request more detail in the comment field.

 

Product Details Purchase

FEX v5 Change Log

18 Sep 2023 – v5.6.8.4340

  • Case/Evidence Time Zone:
    • New Case, Add Evidence – Defaults to UTC (previously Local Time).
    • Changed wording of ‘None’ to ‘Not Set’, When ‘Not Set’ is used, (e.g., for the Case folder), child items (e.g., forensic images) can be set individually.
  • Save Case – Fixed extract metadata issue that could have led to a save case error.

13 Sep 2023 – v5.6.8.4324

  • AI – Improved FEX-AI speed.
  • Artifacts – Updated Brave Browser, Android Gmail.
  • Custom Filter – Fixed issue editing a custom filter.
  • Display View – Updated display view windows. Additional file type display.
  • Display View – Improved mouse wheel zoom.
  • Hash Differential – Added hash error messages to column.
  • Hash Fuzzy – Added hash error messages to column.
  • Hash Match – Improved Differential and Fuzzy by including percentage hashed.
  • Hash Speed – Fixed introduced hash speed issue.
  • TAR – Improved expansion of large .TAR produced in in phone acquisitions.
  • VMDK – Added support for older VMDK files.

18 Aug 2023 – v5.6.8.4240

  • Activation – CodeMeter updates.
  • Artifacts – Updates for iOS and Android.
  • Column Filter – Fixed issue switching between column filters.

8 Aug 2023 – v5.6.8.4210

  • Artifacts – Updates for iOS and Android.
  • Email – Fixed msg export size error.
  • License Manager – Updated the GetData License Manager.
  • L01 – Added a single acquisition hash that can be verified in FEX or EnCase.
  • L01 – Added hash information to log file.
  • Scripts – Added conditional define to share scripts between GUI and CLI.

28 Jul 2023 – v5.6.8.4170

  • Artifacts – Updates for iOS and Android.
  • Cellebrite.UFDR – Format added to Open Image option.

22 Jul 2023 – v5.6.8.4138

  • Artifacts – Updates for iOS and Android.
  • Other minor updates.

14 Jul 2023 – v5.6.8.4086

  • Artifacts – Added W11 Program Compatibility Assistant.
  • CR3 – Improved identification and display of CR3 graphics.
  • Other minor updates.

5 Jul 2023 – v5.6.8.4070

  • Artifacts – Updated chat artifacts.

30 June 2023 – v5.6.8.4046

  • Artifacts – Added MAC CUPS printing metadata.
  • Category Graph – Added column sort.
  • DVR – Improved Hikvision. Added folders for individual cameras.
  • Memory – Improved memory management.
  • Permissions – Improved extraction of permissions metadata.
  • Script – Added ability to export JSON from Info, Filesystem Record and Metadata views.
  • Signature MPEG – Improved Mpeg file signature identification.
  • Signature Yahoo – Improved Yahoo chat file signature identification.

23 June 2023 – v5.6.8.4000

  • Artifacts – Removed artifact folders with zero counts.
  • Artifacts – Fixed issue with artifacts module resetting required columns.
  • Artifacts Browsers – Now includes URL summary (e.g., Bing, Google, YouTube queries).
  • Registry – Added LastKnownGoodTime to Quick Registry and Registry module.

8 Jun 2023 – v5.6.8.3972

  • Index Search – Update process distribution for machines with a high core count.
  • Quick Word Report – Added to File System and Bookmark toolbars on startup.
  • Quick Word Report – Added default column selections.
  • Registry – Added time sync and auto-update keys.

8 Jun 2023 – v5.6.8.3972

  • Script maintenance.

1 Jun 2023 – v5.6.8.3964

  • Artifacts – Added MAC deleted users, MAC preferences.
  • Column Filter – Blank and Not Blank column filters are now read only fields.
  • Custom Columns – Added ability to save and load custom column layouts.
  • Display View – Improved for complex SQLite files.
  • Quick MS Word Report – Updated Files System > Tools > Quick MSWord Report.
  • Verification – Added AFF4 verification hash information to Evidence module.

20  May 23 – v5.6.8.3902

  • Hash Match – Added support for NSRL v3 Minimal hash sets..
  • Artifacts – Improved WhatsApp for Android.

15  May 23 – v5.6.8.3886

  • Improved validation of Hikvision (DVR) file systems.
  • File and Folder Name Search – Search inside Zip/Rar checked on fresh install.
  • Other minor script updates.

8  May 23 – v5.6.8.3868

  • Artifacts – Added Google Play Installed Applications (Android).
  • Artifacts – Added Photos.sqlite (iOS).
  • Artifacts – Added Photos Internal (Android).
  • Artifacts – Added Photos External (Android).
  • Artifacts – Added Wifi Configurations (Android).
  • 3rd Party Tools – Added TrID File Identifier.
  • 3rd Party Tools – Added Zimmerman Jump List Examiner.
  • Other minor updates.

1  May 23 – v5.6.8.3834

  • Google Earth KML – Added HEIC to Google Earth KML creation.
  • Prefetch – Updated code for Prefetch Execution Count.
  • Other minor script updates.

24 Apr 23 – v5.6.8.3816

  • DVR – Added Hikvision DVR file system support.
  • DVR – Added LVF (Logitech Video Effects File) file system support.

15 Apr 23 – v5.6.8.3796

  • Artifacts – Added Fitbit and Slack.
  • Scripts – Other minor script updates.

12 Apr 23 – v5.6.8.3778

  • Artifacts – Added Apple Health.
  • Email – Improved non-English character support.
  • Export – Improved BMP video keyframe export.
  • Script – Updated Journal parser script.

4 Apr 23 – v5.6.8.3746

  • Display Docx – Fixed introduced error where docx were being displayed as compound files.

31 Mar 23 – v5.6.8.3740

  • Quick Word Report – Updated underlying MSOffice integration code.
  • Scripts – New script defaults to UTF8-BOM for language support.
  • Zip – Improved Zip64 support.

18 Mar 23 – v5.6.8.3710

  • Email – Index search result no longer displays container (e.g. PST), just message.
  • Export Rows – Upgraded export CSV, HTML.
  • RAR – Improved set-password in File System.
  • Setup Files – Updated setup file builder.
  • Other minor script updates.

08 Mar 23 – v5.6.8.3676

  • Bookmark Folders by Hash Set Match – Export report added.
  • Copy cell – Now works with multiple file selection.
  • Recover Folders – Select all button added.
  • Other minor script updates.

27 Feb 23 – v5.6.8.3626

  • Evidence module – Credentials repository for Bitlocker and File Vault passwords.
  • NodeXL: Updated Visualize Email script. Added LNK visualize.
  • Video View > Export > Export Video Quick Views (‘story-boards’ as jpg).

15 Feb 23 – v5.6.8.3584

  • File and Folder Name Search – Updated for unicode support,
  • Verify Device = Added hash of logical image segments.

15 Feb 23 – v5.6.8.3572

  • AFF4 – Fixed introduced error where AFF4 File System did not process.

12 Feb 23 – v5.6.8.3564

  • Bitlocker – Auto-process after right-click add encryption password.
  • Codemeter – Updated digital certificate for Win11.
  • Entropy – Added full file entropy calculation: Analysis Programs > Entropy (Shannon).
  • Other minor GUI updates.

3 Feb 23 – v5.6.8.3536

  • Metadata – Additional Extract Metadata and Bookmark options for MS Office.
  • Hash Match – Display column checkbox is now on by default.
  • Hash Create – Fixed vertical scroll issue on form.
  • Other minor GUI updates.

27 Jan 23 – v5.6.8.3512

  • Export – Enabled typed paths for file export.
  • Investigator – Improved addition and management of investigator details.

9 Jan 23 – v5.6.8.3468

  • FEX-Artificial Intelligence (FEX-AI):
    – Face Detection
    – Face Recognition
    – Object Detection
    – Weapon Detection
  • JSON Hash Match – Fixed issue populating HashSet Category column.
  • Reports – Fixed issue with specific email body text not displaying.
  • Tools > 3rd Party Tools – Added Elcomsoft Encrypted Disk Hunter.
  • VMDK – Fixed issue reading VMDK image.

12 Dec 22 – v5.6.8.3392

  • Gallery/Video Views – Red border indicates a filtered view.
  • Gzip – Fixed issue expanding Gzip.
  • Other minor updates.

25 Nov 22 – v5.6.8.3300

  • Artifacts – Improved extraction of .evtx Event Data.
  • Artifacts – Added button to export artifact folder contents to CSV.
  • Email – Added project Vic export to Email module.
  • Live Boot – VM date options are now created from all drives (not just boot drives).

21 Nov 22 – v5.6.8.3282

  • Artifacts – Improved identification of Chrome/Chromium based Autofill artifacts.
  • Bookmarks – Tree filter no longer includes default bookmark folders.
  • Duplicate Items by MD5 (filter) – Active files now take filter precedence over carved files.
  • Email – Signature Analysis now performed by default when files are sent to the Email module.
  • Evidence Module – Can add or move between groups when a process is running.
  • Log Files – Removed redundant logs.
  • Log File Viewer – Added column sorting.
  • OCR – Fixed logical/physical size difference in OCR GUI.
  • RamDisk Tools – Improved feedback from Zimmerman AppCompatCacheParser.
  • Recovered Folders – Improved for FAT.

11 Nov 22 – v5.6.8.3252

  • Bookmarks – Improved auto adding of selected text to bookmark.
  • Bookmarks – Improved visual display of bookmarked item icon.
  • Email – Signature analysis is now performed by default when sending files to the Email module.
  • Filters – Added Registry – Amcache.hve filter.
  • File System folders tree – Right-click ‘Reset view’ (removes: branch plate, checks, folders filter, contracts all).
  • Hashing – Reduced memory and improved speed when using EnCase multi hash.
  • HashSets – Added NSRLv3 support.
  • Keyword Search – Added renaming of previous keyword search results.
  • RamDisk Tools – Added Zimmerman AppCompatCacheParser.

28 Oct 22 – v5.6.8.3214

  • Artifacts: Added Office 2016 Backstage.
  • Email: Improvements for encoded email headers.
  • Live Boot: Fixed Live Boot Deploy error introduced in previous version.

25 Oct 22 – v5.6.8.3200

  • Email: Added filter option to ‘Extract Addresses’.
  • Evidence: Improved progress for Ex01 verification.
  • Gallery View: Dual middle information bar.
  • Index Search: Updated unallocated clusters to stop file sig. in first sector changing indexing behavior.
  • Live Boot: Updates for compatibility with VirtualBox 7.
    • Note: Live Boot with VirtualBox 7 is currently under testing.
  • Signature: Updated $MFT file signature.

14 Oct 22 – v5.6.8.3168

  • EX01 – Fixed issue with Ex01 acquisition hash not displaying in Evidence module.
  • Gallery View – Fixed crash with image inside expanded file.
  • Live Boot – Additional updates to improve Live Boot of Win 11.
  • Reports – Improved drag and drop of tables to report editor.

28 Sep 22 – v5.6.8.3122

  • Live Boot – Updates for Windows 11.
    • Windows 11 now autodetects in Live Boot form.
    • Increased default memory size to 4G.
  • Scripts – Updates to Script Editor.
    • Added begin > end vertical lines and other minor features.

24 Sep 22 – v5.6.8.3106

  • CPU – Fixed increase in CPU resources from previous release.
  • Physical Device – Fixed issue previewing physical devices.

17 Sep 22 – v5.6.8.3096

  • Checkbox – Improved checkbox speed for large cases.
  • Email – Updated decoding of subject for Google Takeout .mbox.
  • Email – Added ‘Labels’ folder for Google Takeout mbox.
  • Expand Files – Updated with additional options for graphics and video.
  • Folder Tree – Right-click copy cell added.
  • GPS Scripts – Co-ordinates added to bookmark comments.
  • Information Bar – Middle information bar split to 2 lines. LS (Logical Size) and PS (Physical Size) now specified.
  • Signature Analysis – Is now included in the default processing profile.
  • Triage Report – Added a report section for Windows Password Hints.
  • Wibu Codemeter update, 7.51.
  • Other minor updates.

15 Aug 22 – v5.4.8.2946

  • Email – Fixes issue saving email to PST.
  • Filter – Added File System > Printers filter.

12 Aug 22 – v5.4.8.2938

  • Artifacts Chat – Added Android: TikTok, Vemo, Viber, WeMe, Wire.
  • Artifacts – Added button to create GPX map file for common GPS artifacts.
  • Branch Plate – Updates to branch plate speed.
  • Date/Time: Active case/evidence timezone now highlighted in tree.
  • Send To Registry: Improved sending of registry files to Registry module.
  • Other minor updates and improvements.

25 Jul 22 – v5.4.8.2896

  • Artifacts – Added Skype Chatsync.
  • Categories Chart – Improved display for individual folders.
  • DPI configuration registry key added to enable manual adjustment of FEX display.
  • Index Search – Added logging of options selected.
  • FileSystem > Analysis Programs > Regex Search – Improved progress bar for checked items only.

15 Jul 22 – v5.4.8.2868

  • Gallery View – Fixed issue with Gallery View display after refresh (introduced in previous release).
  • Other minor updates.

08 Jul 22 – v5.4.8.2856

  • Evidence Processor – Fixed issue in Evidence Processor expanding files for additional devices.
  • Improved GPX file creation in: File System > Analysis Programs > GPS – Google My Maps Create.

30 Jun 22 – v5.4.8.2842

  • MD5 Hash – Improved hash speed.
  • File System > Filename Search – Renamed Bitcoin to Crypto Currency.
  • File System > Analysis Programs > GPS – Google My Maps Create.
  • Recover Folders – Fixed GUI AV after Recovered Folders had been manually removed.
  • Right-Click Expand Compound Files – Fixed error introduced in previous version causing right-click expand compound files to fail.

17 Jun 22 – v5.4.8.2814

  • File System > Analysis Programs – Added Shadow Copy OnDiskSnapshotProp.
  • HEX View – Fixed Info. bar refresh for GOTO File Offset.
  • Sector Start – Column now blank when sector start is unknown.
  • Triage – Added Shadow Copy OnDiskSnapshotProp to Triage and Triage report.

8 Jun 22 – v5.4.8.2794

  • APFS – Improved reading of APFS filesystem.

3 Jun 22 – v5.4.8.2786

  • APFS – Improved memory management.
  • Other minor updates.

22 May 22 – v5.4.8.2754

  • Artifacts – Added Opera browser carve.
  • Artifacts – Added Discord.
  • Bookmarks – Fixed display of Bookmark Folder column.

12 May 22 – v5.4.8.2740

  • FEX Viewer – Fixed email filters.
  • CRC32 Hash – Fixed issue with display text direction.
  • Search Artifact Results – Updated to save custom search as .txt.
  • Volume Label – Added root folder volume ID to extraction script and Triage report.

2 May 22 – v5.4.8.2714

  • Email Export – Added checkbox on export form to ignore all attachments.
  • Export – Fixed issue prefixing Bates ID when exporting from Email and Bookmarks modules.
  • Word Quick Report – Stability update for Word 365.

8 Apr 22 – v5.4.8.2698

  • Classification – Fixed issue updating a previously classified picture.
  • Event Logs – Added Windows .evtx Event Log processing to Artifacts module.
  • Extract Metadata – File System > Toolbar > Extract Metadata > Extract Permissions To Columns – Add options for HPFS and APFS.
  • File Info – File System > Toolbar > File Info: Updated for HFS and APFS.
  • TAR – Updated drivers for faster .TAR extraction of large images (e.g. cell phone extractions).
  • Other – Minor GUI updates.

21 Mar 22 – v5.4.8.2672

  • Artifacts – Updated:
    • iOS ApplicationState
    • iOS Instagram
    • iOS Line chat
    • iOS Photo Vault
    • iOS Telegram
    • iOS Wire
  • Other minor GUI updates.

21 Mar 22 – v5.4.8.2644

  • Artifacts – Updated:
    • iOS Cell Tower Locations
    • iOS Facebook Messenger
    • iOS Installed Applications
    • iOS Mail
    • iOS Notes
    • iOS Parked Car Locations
    • iOS Significant Locations
    • iOS TextNow
    • iOS TikTok
    • iOS Wifi
    • iOS Zoom
  • Progress Window – Now clears logs between cases.

11 Mar 22 – v5.4.8.2616

  • Translation – Fixed translation error on startup for non-English versions.
  • Reference Library – File System > Tools > Reference Library. Replaced existing library with Zotero.
  • Other minor updates.

01 Mar 22 – v5.4.8.2578

  • Artifacts – Update of browsers and chat.
  • Delete Bookmark Sub-Folder – Fixed access violation on delete.
  • Display View – Improved table display for SQLite.
  • Email – Update to Export to PST.
  • Reports – Improved tree sort when manually creating a report template.
  • Video Bookmarks – Adding blur for bookmarked video thumbnails now shows in report.

21 Feb 22 – v5.4.8.2554

  • Artifacts – Updated: Android MMSSMS, Burner, ProtonMail, Skype, SnapChat, TextNow.
  • Display View – Clear viewers when currently selected file is filtered out.
  • Export Email – Added export to PST.
  • Export L01 – Fixed display error in Export to L01 for Folder Data checkbox.
  • Hash – Added SHA512.
  • Hash – Added ability to process EnCase multi-type.hash sets.
  • Hash – Create flat hash set fix to excluded expanded compound files.
  • Installation – Fixed Microsoft SmartScreen message on FEX install.
  • Relativity – Fixed issue importing segmented L01 into relativity.

21 Jan 22 – v5.4.8.2474

  • FFMpeg and VLC Play – File System > Tools > RamDisk. Added warning message if checked videos > 5.
  • Hash Match – File System > Hash Match > Bookmark Files by Hash Set Match remembers last Hash Set location.
  • Index Search – Added additional logging for excluded encrypted files.
  • Physical Device Serial Number – Added to: ‘File System module > Analysis Programs > Volume ID and Partition Information’.
  • Other minor updates.

7 Jan 22 – v5.4.8.2456

  • 3rd Party Tools – Added Nirsoft NetworkUsageView.
  • ESE – Fixed error parsing corrupt Exchange Database file.
  • Highlight File in Module – Now shows a message if file is excluded by filter.
  • Investigator – Updated new investigator form.
  • Reports – Fixed missing Documents and Pictures samples.

23 Dec 21 – v5.4.8.2392

  • File Carve – Added columns (Base: Bates; Filename; Path) to identify source.
  • Gzip – Improved identification of corrupt files to limit false export size.
  • Keyword Search – Improved search for HFS file systems.
  • Hash Set Create – Added options to exclude items from hash set (folders, free space, NTFS, system).
  • Index Search – Added Metadata tab to module.
  • License Manger – Fixed issue renaming dongle.
  • Metadata – Added ODT creator metadata tag.
  • Reports – Fixed column width for include checkbox.
  • Reports – Improved landscape options in Reports module.

26 Nov 21 – v5.4.8.2320

  • CLI – New release and updates to FEX GUI CLI launcher.
  • Export – Added export to XLSX.
  • File List – Updated colors for File List views.
  • HashSet Create – Added exclude options.
  • OCR – Improved text parsing.
  • Project Vic – Updated Project Vic classification colors.
  • Recycle Bin – Added script to parse WinXP Info2 records.
  • Scripts – Backend updates to scripting engine.

10 Nov 21 – v5.4.8.2250

  • Email – Updated Search Email Columns script.
  • Other minor updates.

01 Nov 21 – v5.4.8.2232

  • Classification – Updated classifications options window. Added button to File List module.
  • File System – Added double-click in File List to drill into folders.
  • Load Case – Fixed issue loading case with expanded compound PDFs.

26 Oct 21 – v5.4.8.2198

  • Hash Set – Fixed freeze creating very large .db3 hash set.
  • Metadata – Export Metadata tab contents to .txt.

20 Oct 21 – v5.4.8.2182

  • Email – Added UTC to email message header in Display view.
  • Email – Added Clam AntiVirus to Email module.
  • Metadata – Improved extraction of .torrent files.
  • Metadata – Updated extract metadata script.
  • File List – Fixed issue where highlight of large list could freeze.
  • Reports – Fixed issue where bookmark comment did not display.
  • Other minor updates.

11 Oct 21 – v5.4.8.2150

  • L01 – Fixed issue with L01 being read by NUIX.
  • Scripts – RamDisk script updates.
  • Other minor updates.

07 Oct 21 – v5.4.8.2134

  • Byte Plot – Fixed display error viewing large files.
  • Encryption – Improved detection of 7z and PDF encryption.
  • Export – Improved export of files when saving to root folder of a drive.
  • Hash – Added xxHash64.
  • Video – Improved keyframe extraction.
  • Zip – Increased speed on zip detection.
  • Other minor GUI updates.

24 Sep 21 – v5.4.8.2084

  • Export – Solved issue creating root export folder on external USB.
  • Logs – View log text during process.
  • Registry – Updated Registry module icons.
  • Registry- Improved user account idenifification for UsrClass.dat and ntuser.dat.

21 Sep 21 – v5.4.8.2058

  • Checkbox – Improved checkbox responsiveness on large cases.
  • Column Text Filter – Added a separate Simple search with boolean AND, OR , NOT functionality.
  • Disk view – Improved disk view responsiveness on large cases.
  • Preview – Locked preview case remove by another instance of FEX.

12 Sep 21 – v5.4.8.2018

  • Analysis Programs > Encrypted Files – Identify encrypted files within archives.
  • Email – Improved column filter for To/From/Subject/Attachments.
  • Splash – Fixed startup error with 90 day dongle license.
  • Other minor updates.

01 Sep 21 – v5.4.8.1968

  • Encrypted Files – Improved detection of encrypted DOC, PPT, XLS.
  • Scripts – Added Analysis Programs > Journal Parser ($UsnJrnl~$J).
  • Zip Export – Improved handling of special char in file names.
  • Zip Export – Added warning message for decompression programs that do not handle > 250 char. path lengths.
  • Other minor updates.

22 Aug 21 – v5.4.8.1926

  • Activation – Wibu Codemeter update.
  • Case Number – Added this field to case information.
  • ClamAV – Update for new ClamAV config.
  • Column Filter – Added AND/OR logic to simple column filter.
  • Columns Default – Removed Flags, Classification.
  • Display – Update to display view for additional file previews.
  • DTSearch – Update to DTSearch DLL.
  • Email – Updates to EDB, EML, EMLX, MBOX, MSG, OST, PST.
  • Email – Added Read column.
  • File Carve – Fixed error carving TGA files.
  • Filters – Added additional email filters.
  • OCR – Added graphics Optical Character Recognition (OCR).
  • RamDisk Tools – Added VLC to RamDisk tools.
  • Script – Added xxHash capability.

17 Jun 2021 – v5.4.2.1678

  • Email – Updates to OST processing.
  • Email – Update to Outlook Caesar decoder for resident small attachments.
  • Registry – Updated to display REG_UNKNOWN key data.

7 Jun 2021 – v5.4.2.1650

  • Email – Fixed save and load error with very large PST files in Email module.

1 Jun 2021 – v5.4.2.1634

  • 3rd Party Tools – Added IrfanView screen capture and thumbnails.
  • Export Files – Added option to export with file slack.
  • Export JSON – Added graphics and video tags to Project VIC JSON export.
  • Live Boot Deploy – Fixed issue ordering multiple devices in deploy script.
  • Metadata – Added Extract Metadata for Track Changes.
  • Reports – Fixed issue with landscape.
  • Reports – Improved email message display.
  • Other minor updates (icons etc.)

30 Apr 2021 – v5.4.2.1578

  • C4All – Fixed import error.
  • FileVault – Fixed unlock of APFS system container after Catalina update.
  • Progress Bar – Improved progress bar formatting.
  • Quick Word Reports – MS Word stability updates.
  • Signature/Display – Added Webp signature, preview, and gallery view.

19 Apr 2021 – v5.4.2.1536

  • Activation – Improved action when local dongle connectivity lost.
  • Activation – Network dongles switch when connectivity is lost.
  • Artifacts – Added GroupMe JSON.
  • Download – New certificate. (Note: Download may trigger Defender SmartScreen).
  • Keyword – Fixed issue with default keyword txt not populating on install.
  • Project Vic – Added graphics/video tag to export.
  • RamDisk Tools – Added Zimmerman Shell Bag Explorer.
  • Signature – Added Zip (Encrypted).
  • Translations Updates – Chinese, French, German, Indonesian, Spanish, Turkish.
  • Word Quick Report – Improved stability.
  • Other minor updates and improvements.

20 March 2021 – v5.4.2.1404

  • Clam Antivirus – New database update links.
  • Email Module – Added duplicate email script, filter and toolbar button.
  • Display – Improved DOCX display.
  • Other minor updates.

15 March 2021 – v5.4.2.1380

  • Email Module – Added right-click > Export > PDF File.
  • Evidence Module – Updated Check For Updates config. to check on launch.
  • File System Module – Updated Analysis Programs > Recycle Bin Match $I with $R
  • Non-English OS – Fixed launch issue from previous update.
  • Reports Module – Improved High-Res PDF export.
  • Other minor updates.

6 March 2021 – v5.4.2.1352

  • Codemeter – Update to 7.20a.
  • Extract Metadata – Added user permissions.
  • File Signature – Added ODT (Encrypted).
  • GetDataNetworkServer – Fixed issue when run as Windows Service.
  • Interpol Classification – CAM script update.
  • File Carve – Fixed issue with Minolta RAW returning large file size.
  • Quick Report – Added export email to PDF.
  • Quick Registry – Added Windows UserSID.
  • Recover Folders – Fix issue returning invalid files on HPFS.
  • Triage Report – Added UserSID section.

25 February 2021 – v5.4.2.1316

  • Display View – Updated Adobe.psd display for multiple images.
  • Display View – Updated OpenOffice.odt display.
  • Email Module – Added a display tab for the message header.
  • GUI Updates – Column separators, highlight and select colors, icons.
  • Script – Added File System > Analysis Programs > Folder Sizes.
  • Word Report – Added File System > Tools > Quick Word Report.

03 February 2021 – v5.4.2.1238

  • Classification – Added Interpol Baseline 4 category.
  • Email – Updated PST/OST Send-To-Module.
  • Reports – Improved high-res PDF export.
  • Reports – Improved sort by field.

14 January 2021 – v5.4.2.1180

  • Fixed German translation error causing freeze.
  • Update RamDisk scripts for new NirSoft versions.
  • Other minor script updates.

23 December 2020 – v5.4.2.1140

  • Email – PST processor update.
  • Filter – Fixed hash set match filter.
  • GUI – Improved forms ‘stay in front’.
  • Other minor updates.

16 December 2020 – v5.4.2.1122

  • Bitlocker/File Vault – Password is added to the column and Triage report.
  • Branch Plate – Added an icon to indicate sub-folders are plated.
  • Categories – Added date categories and improved speed.
  • Display – Fixed column offset for some SQL files.
  • Display – Improved Display view for MSOffice docs (added PPTX).
  • Email – Added tab views for Contacts and Calendar.
  • Email – Added NodeXL chart.
  • Email – Improved support for EDB, ESE, MBOX, PST, OST.
  • Email – Added script to collect email address.
  • French – Fixed translation error for hash sets.
  • JSON Export – Path extended to include device.
  • Logging – Fixed MBR count in log file.
  • MOV – Improved processing speed.
  • Reports – Added export options for blurred graphics.
  • Reports – Fixed intermittent error changing between report folders.
  • Updated FEX memory management.
  • Video – Improved video speed, sound and display.

21 October 2020 – v5.2.2.9978

  • Artifacts – Added Instagram direct chat.
  • Bookmark – Fixed error causing occasional crash adding bookmark.
  • Scripts – File System > Analysis Programs > Recycle Bin Match $I with $R.
  • Reports – Samples: Added Recycle Bin report to link $R file with $I metadata.

9 October 2020 – v5.2.2.9944

  • Reports – Fixed error creating ‘Report Templates’ folder.

5 October 2020 – v5.2.2.9936

  • Artifacts – Added Windows 10 Time Line.
  • exFat – Fixed issue reporting incorrect cluster allocation.
  • Display View – Improved display of SQLite tables.
  • Display View – Improved ODT display.
  • Gallery view – Improved blur.
  • Install – Fixed issue in last release with language versions installing in English.
  • Reports – Fixed freeze clicking between report folders.
  • Un-dock – Fixed issue where slow render of SQLite tables un-docked data view.
  • Other minor updates and improvements.

3 September 2020 – v5.2.2.9866

  • Artifacts – Added unallocated carve for search URLs.
  • FEX Imager Servlet – Now caters for remote imaging with Dynamic IP Changes.
  • Filename Search – Search Zip and RAR to 20 levels.
  • File System module – Updated File Info button.
  • FEX Viewer (free stand-alone product) now available for case review.
  • FEX Viewer Case Export – Added to config button shortcut in header toolbar.
  • Metadata:
  • Updated Extract Metadata button.
  • Added extraction of Video metadata.
  • Added extraction of Adobe XMP metadata.
  • MKV – Detect multiplexing and expand video thumbnails to track folders.
  • Text view – Added right-click, show printable characters only.

28 July 2020 – v5.2.2.9748

  • Launch Speed
  • Improved first install launch speed.
  • Improved launch speed.
  • Triage Report – Sorted registry so that current appears first.
  • Triage MAC – Updated Triage report with additional artifacts.
  • Other minor updates and improvements.

21 July 2020 – v5.2.2.9736

  • APFS – Improvements based on new Apple documentation.
  • Case – Fixed error opening FEX-Triage case.
  • Classification – Drop down menu added for Gallery View CEM Classification:
  • Project Vic
  • Copine
  • SAP
  • SOD
  • Display View – Updated preview of DOCX files in display view tab.
  • Expand Compound – Fixed error expanding 7z.
  • Project Vic – Changed export date times from local to UTC.
  • Scripts – Improved forcing display windows to front of screen.

14 July 2020 – 5.2.2.9714

  • Artifacts – Added Browsers:
  • Safari Bookmarks
  • Safari Downloads
  • Safari Top Sites
  • Artifacts – Added MAC Operating System:
  • Mail BackupTOC
  • Recent iWork Numbers
  • Recent iWork Pages
  • Recent QuickTime
  • Recent TextEdit
  • Recent VLC
  • Custom Byte Carve – Quick Add Google Maps.
  • Display View – Updated DOCX display.
  • FEX-Imager changed to 64-bit to allow for Ex0, Lx01 conversion to E01 or L01.
  • Live Boot – Added button to Evidence module.
  • Reports – Fixed issue with blur on exported PDF.
  • Website Update – Check for Updates button now links with new download page.

29 June 2020 – 5.2.2.9680

  • Email – Improved MBOX support.

22 June 2020 – 5.2.2.9662

  • Bookmarks – Artifact bookmarking auto-creates bookmark folder.
  • Email – Improved MBOX support.
  • License Manager – Identifies locked dongle.
  • Live Boot – Select storage controller (Auto, IDE, SATA, BusLogic, LsiLogic, LsiLogicSAS).
  • Load Case – Improved load case time.
  • Preview – Button in Evidence module now default.
  • Registry – Improved Office MRU script.
  • Reports – Fixed AV in copy and paste of table row.
  • Reports – PDF resolution improved.
  • Reports – Updated report column sorting.
  • Reports – Updated sample templates.

11 June 2020 – 5.2.2.9632:

  • Email – Fixed error loading an old case with PST email.

06 June 2020 – 5.2.2.9622

  • Email – Improved export from property view.
  • PDF – Fixed issue with expanded PDF causing freeze.
  • Reports – Export PDF in high resolution.
  • Video – Added .ts video file type.

03 June 2020 – 5.2.2.9618

  • Artifacts – Improved search speed for Artifact files.
  • Artifacts – Added Chromium bookmarks and improved categorization.
  • Artifacts – Clear of 1601 blank Delphi date fields.
  • Evidence Processor – Changed button to Skip processing.
  • Gallery Cache – Improved gallery cache speed.
  • Metadata – Added metadata for HEIC files.
  • FEX-Imager – Speed improvements.
  • Recover File – Added drag and drop for case recovery files.
  • Remote – Improved network connection speed for remote devices.
  • Other minor updates and improvements.

7 May 2020 – 5.2.2.9526

  • Artifacts – Minor fixes and improvements.
  • ClamAV – Updates to improve speed. Removed default check for PUA.
  • FEX-Imager – Released FEX-Imager v2 (located in install folder).
  • Gallery View – Fixed cache thumbnail error on small cache graphics causing a freeze.
  • Email – Added Email module support for mbox mail.
  • Email – Added Email module support for EDB mail.
  • Email – Fixed issue with blank OST email subject displaying message page offset.

21 Apr 2020 – 5.2.2.9472

  • Bookmarks – Fixed issue re-bookmarking a bookmarked file.
  • Remote – Updated protocols (increase remote serve-let connection speed).
  • Other minor updates.

15 Apr 2020 – 5.2.2.9452

  • Btilocker Partitions – Now return isEncrypted status.
  • Progress – Fixed issue with progress bar staying on-top of other applications.
  • Project VIC2 – Import and Export support added.
  • VDI – Updated support for Virtual Desktop image format.

9 Apr 2020 – 5.2.2.9444

  • APFS – Updated drive decryption routine.
  • Artifacts – Script updates.
  • C4All – Add Cellebrite C4All export to FEX.
  • RAID6 – Added RAID 6 support.
  • Remote – Updated Add Remote network config.

31 Mar 2020 – 5.2.2.9420

  • Merge Files – Right click menu option added.
  • Setup – Improved setup for non-admin installs. Removed auto-launch.
  • Permissions – Added NTFS Permissions viewer.
  • Other minor script updates and improvements.

17 Mar 2020 – 5.1.2.9378

  • Live Boot – Fixed issue causing Live Boot to not launch.

13 Mar 2020 – 5.1.2.9372

  • Artifacts – Added Viber for PC v11.
  • File Vault – Fixed pwd check for AES-128 encrypted volumes converted to APFS.
  • Hex Data Inspector – New layout.
  • Merge Files – File System right-click menu option to merge data.
  • RamDisk Tools – Added FFmpeg.

05 Mar 2020 – 5.1.2.9342

  • Load Case – Fixed error loading case created from folder containing Zone files.
  • APFS – Improved support for MacQuisition decrypted APFS volumes.
  • Other minor script updates and improvements.

24 February 2020 – 5.1.2.9324

  • Filters – Improved Read From File filter.
  • L01 – Improved detection of corrupt L01 or missing segments on add of evidence.
  • Scripts – Updates to File Name Search to handle large imported keyword lists.
  • Triage – Fixed error introduced in previous build causing Default + Triage to fail.

13 February 2020 – 5.1.2.9314

  • Bookmarks – Fixed sub-folder sort error.
  • Bookmarks – Added Artifacts as a default folder.
  • Display View – Updated multi-video view buttons.
  • File Name Search – Updated array size for large keyword lists.
  • HEX View – Fixed flicker on double click.
  • Index Search – Added additional data view tabs (Hex, Display, Filesystem Record).

5 February 2020 – 5.1.2.9306

  • Bookmarks – Non default folders get different icon.
  • Display – FFMPEG DLL update (fix OGG and WK3 freeze).
  • File Carve – Added USN Journal file type.
  • File Signature – Update to ESE file type to improve speed.
  • HEX – Update to HEX selection.
  • Keyword Search – Enabled multi select of keyword.txt import files.
  • Recover Folders – If Bad Cluster file recover set at 0 size.
  • Registry – Improved speed of ‘Send to Registry’.
  • Toolbar – Fixed minimize maximize error on toolbar.

29 January 2020 – 5.1.2.9288

  • CLI Hash min/max size fix.
  • Metadata To Columns – Added ‘Extract Recycle Bin’ for $I values.
  • Recycle Bin – Decode INFO2 in File Metadata tab (after signature).
  • Recycle Bin – Added Zimmerman RBCmd to 3rd Party Tools.
  • Other minor script updates.

24 January 2020 – 5.1.2.9270

  • Fixed exit error caused by Evidence Groups.
  • Metadata To Columns – Added LNK MAC Address.
  • Other minor script updates.

06 January 2020 – 5.1.2.9254

  • Cases – Options > Cases path now preserved as base cases folder.
  • Checked Items – Fixed issue with checks no clearing green squares.
  • Script – Additional export options added to Export Files by Type.
  • Script – Added CLI launcher to Scripts\Evidence\CLI_Launcher.pas.

20 December 2019 – 5.1.2.9226

  • Spanish – FEX GUI translation update.
  • Other – Minor updates.

17 December 2019 – 5.1.2.9222

  • APFS – Updated detection of encrypted partitions.
  • Project Vic – Fixed issue with some Project Vic files not being recognized.
  • Scripts – Fixed issue resizing script forms.

11 December 2019 – 5.1.2.9200

  • APFS – Fixed issue with encrypted partitions reporting unallocated space size.
  • Help – Updated Turkish v5 User Guide.
  • Reports – Fixed issue with Reports not reading some cached pictures.
  • Splash – Fixed issue with splash reporting an expiring license date.

5 December 2019 – 5.1.2.9180

  • Backup Case – Writes to both screen and log when logging is selected.
  • Cache Images – Update for Gallery and Video views.
  • Thumbs-cache – Update to decode of thumbs indexes.
  • Fixed remove folder error introduced in previous release.
  • Fixed error in date filter tool introduced in previous release.

20 November 2019 – 5.1.2.9148

  • Live Boot – Updates for APFS Live Boot support (file vault drives are not currently supported).
  • GUI Update – Windows themes added. Snap to monitor now supported.
  • Video Gallery – Significant speed increase in Video Gallery.
  • Video Gallery – Fixed corrupt video crashing gallery.

08 November 2019 – 5.1.2.9128

  • APFS – Added support for 128bit encryption keys.
  • Live Boot – Added support for APFS.
  • Registry – Improved speed of script buttons.
  • Tumbs.db – Fixed display of thumb image.
  • Video View – Fix crash caused by corrupt video.

29 October 2019 – 5.1.2.9090

  • APFS – Fix issue prompting for encryption password.
  • Filters – Added registry signature filter.
  • Filters – Updated Registry drop down filter.
  • L01 write – Increased L01 write segment size.
  • Triage – Improved triage speed.

22 October 2019 – 5.1.2.9072

  • APFS Encryption – Now handles multiple volume keys in the KeyBag.
  • Expand Compound – Fixed issue with signature analysis of children.
  • Scripts – Added script to count zero sectors.
  • 7Zip – Improved expansion function.

17 October 2019 – 5.1.2.9054

  • Categories View – Fixed error displaying categories.
  • Evidence – Recent Cases double click during case.
  • Evidence – Added case modified date to displayed information.
  • Evidence – Case names in bold font for recent cases.
  • L01 – Improved read speed.
  • Skin Tone drop down filter added (must run skin tone first).
  • ZMODO video file type added for signature and carving.

14 October 2019 – 5.1.2.9046

  • Evidence – Fixed issue with drag and drop of multiple evidence files.
  • German/Spanish – Fixed MBR translation error.
  • Spanish – Fixed triage report.
  • Other minor updates.

10 October 2019 – 5.1.2.9028 – Major Version Release
Version 5 Release Notes

Other Download Links

Learn more about the debug version