Skip to main content

Download

Forensic Explorer 64 bit

*Requires physical dongle
*Requires software key

Set GUI language on install (Chinese, English, French, German, Indonesian, Spanish, Turkish)

Request 30 Day Evaluation Version Key

Requests are verified manually and require valid end-user details.

 

The Forensic Explorer 30 day evaluation version does not support: Case Save; Export; or Live Boot.

To fully evaluate the software a 90 day dongle license is available for purchase. Request more detail in the comment field.

 

Product Details Purchase

FEX v5 Change Log

10 Jun 2024 – v5.6.8.5218

  • CLI – Launcher now defaults case time zone to UTC.
  • CLI – Added Recover Folders.
  • Email – Improvements to hashing messages.
  • Face Recognition for checked items – Script update.
  • Verify Device – Added comparison details and column for L01 File Acquistion Hash.

29 May 2024 – v5.6.8.5182

  • CLI Launcher update.
  • Updated Excel Chart Timeline – Set Excel Date/Time column.
  • Other script maintenance.

18 May 2024 – v5.6.8.5154

  • Update to APFS to handle drives where partial/incomplete File Vault encryption has been applied.
  • Other minor updates.

10 May 2024 – v5.6.8.5140

  • Fixed issue displaying add file Display view.
  • Fixed issue decrypting BitLocker.
  • Other minor GUI fixes.

26 Apr 2024 – v5.6.8.5092

  • Artifacts – Added iOS Google Map tiles.
  • Graphics Analysis – Filters added for Credit Card, CSAM, Face, ID, Map, Vehicle, Weapon.
  • Quick Reports – Added Graphics Analysis to Gallery.
  • Reports – Added sample reports for Graphics Analysis bookmarks.

18 Apr 2024 – v5.6.8.5060

  • Graphics Analysis – Update to CSAM classification.
  • Artifacts – Added iOS artifacts.
  • Email – Fixed issue sending mbox to Email module.
  • Signature – Added file signature for LevelDB databases.
  • Other minor updates.

12 Apr 2024 – v5.6.8.5042

  • Artifacts – Decode Android ABX files into File Metadata view.
  • File Metadata – Added HEX/text copy from File Metadata data inspector.
  • Script Editor – Minor GUI updates including highlighting of brackets.

6 Apr 2024 – v5.6.8.5006

  • Artifacts – iOS artifact updates.
  • Artifacts – Added a date range filter to Artifacts Mapping.
  • Column Number Filter – Now defaults to equals (e.g. =5) and adds the = sign automatically. Other options <=5, >=5 remain the same.
  • Other minor updates.

24 Mar 2024 – v5.6.8.4970

  • Artifacts – Additional Android script updates.
  • FEX Viewer – Released updated version of FEX Viewer for case review.
  • Yara – Improved logging and bookmarking of Yara scan results.

16 Mar 2024 – v5.6.8.4930

  • Artifacts – Added Android artifacts including Twitter Direct Messages, Airtags.
  • Graphics Analysis – GetData Forensics has partnered with Image Analyzer UK, a leading developer of technology for graphics identification, including sexually explicit image content can CSAM. Scan, categorize and bookmark thousands of images in minutes (L.E. agencies contact GetData for CSAM activation). Launch Graphics Analysis from the File System and Email module toolbars.
  • Yara Rules – Yara rules enable investigators to quickly and efficiently identify malware and other forms of malicious software within digital evidence. By leveraging Yara Rules, examiners can apply a set of customizable, text-based rules that are designed to match specific data characteristics. Launch Yara Rules from the File System and Email toolbars.

25 Feb 2024 – v5.6.8.4840

  • Display View – Improved DOCX display.
  • Load Case – Fixed issue that could case previous hash calculations to not load.
  • Metadata – Added LNK Target Relative Path.

16 Feb 2024 – v5.6.8.4804

  • Artifacts – Update toolbar.

8 Feb 2024 – v5.6.8.4782

  • Email – Fixed introduced error displaying html email.
  • OCR – Improved OCR and removed duplication.
  • Signature – Improved STL Binary (.stl).

3 Feb 2024 – v5.6.8.4763

  • Artifacts – Cloud (Box Sync, Google Drive, One Drive).
  • OCR – Updated OCR engine.
  • Signature – Added STL Binary (.stl).
  • Signature – Added G-Code (.gc).

26 Jan 2024 – v5.6.8.4734

  • Artifacts – Added a tree filter.
  • Clam Antivirus – Quick Search is now default.
  • Clear Columns – Added right-click Clear Columns for metadata.
  • Quick Registry – Updated with Run and RunOnce keys.
  • Recover Folders Log – Added source device and partition information to log.
  • Thumbs Filter – Updated Thumbs folder filters.
  • ThumbsViewer – Added 3rd Party Tool, Thumbsviewer.
  • Triage – Added Registry Run and RunOnce keys to Triage Report.

12 Jan 2024 – v5.6.8.4692

  • Artifacts – Added Accounts CE/DE Android.
  • Artifacts – Added Battery Event Android.
  • Artifacts – Added Calendar Android.
  • Artifacts – Added Device Info Android.
  • Artifacts – Added Shutdown Checkpoints Android.
  • Artifacts – Added Version Information Android.
  • Updated GetData License Manager for dongle firmware update.

2 Jan 2024 – v5.6.8.4662

22 December 2023 – v5.6.8.4638

  • Analysis Programs – Added Bitcoin Wallet Detect script.
  • Artifacts – Added filter for 1024 Remote Desktop Event Logs.
  • Artifacts – Added iOS Biome.
  • Artifacts – Added SnapChat User (user.plist).
  • Keyword Search – Removed redundant tree filters.
  • Module Tabs – Set to a more distinct background color.
  • Registry – Added NT User Hive > Windows Remote Desktop (RDP).
  • Registry – Added NT User Hive > Installed Programs.
  • Registry – Added System Hive > Disk Storage Devices (Friendly Name).
  • Signature Analysis – Updated MPEG driver.
  • Other minor GUI updates.

15 December 2023 – v5.6.8.4616

  • Evidence Module – Added horizontal splitter.
  • File Signature – Added: Crypto Wallet, Electrum Wallet.
  • Scripts – Updated Regex Search script.
  • Other minor GUI updates.

27 Nov 2023 – v5.6.8.4572

  • APFS – Improvements to reading APFS file system.
  • Added Artifacts:
    • Facebook Messenger for PC.
    • iOS Application Permissions.
    • iOS Bluetooth Paired Devices.
    • iOS Bluetooth Permissions.
    • Tracking – Open GPX Tracker.
  • File Signature – Added Signature KTX (iOS screenshots).

22 Nov 2023 – v5.6.8.4548

  • Add Folder – Fixed issue where Add Folder was not seeing sub-folders.
  • APFS – Improvements to reading APFS file system.
  • Artifacts – Added deep-fake web browsing summary.
  • Artifacts – Improvements to reading ProtoBuffers.
  • Cellebrite .UFD – Added Cellebrite date/time adjustment.
  • Other minor script updates.

10 Nov 2023 – v5.6.8.4502

  • 3rd Party Tools – Fixed Beyond Compare link with updated version.
  • Artifacts – Added additional Event Log .evtx filters.
  • Scripts – Analysis Programs > Added ‘DateTime – Custom CMA Offset columns’.
  • Other minor script updates.

5 Nov 2023 – v5.6.8.4484

  • 3rd Party Tools – Added iLEAPP.
  • Apple iOS Biome – Added SEGB V1 file signature.
  • Display View – Updated MS Word viewer.
  • Email – Send to module log details filenames.
  • Evidence Processor – Speed improvement in Default + Triage profile.
  • LNK Metadata – Updated trackerdata metadata fields.
  • ProjectVic – Improved Model 2 HashSet creation.
  • Quick Reports – Improved Artifact reporting.

20 Oct 2023 – v5.6.8.4432

  • Display View – Updated Display view for Office documents.
  • File Carve – Improved File Carve for MS Office with other embedded documents.
  • File System – Double-click on a folder in File List now navigates to the sub-folder.
  • Quick Reports – Updated for MAC Triage.
  • Quick Reports – Will now update TOC on open of the Word document.
  • Quick Reports – Added a default logo selection.
  • Send To Email – Now records in the log which files have been successfully sent.
  • Other script maintenance.

10 Oct 2023 – v5.6.8.4386

  • File System – Added Expand Video button to toolbar.
  • Filters – Added folder filter for cloud services and virtual machines.
  • Other script maintenance.

18 Sep 2023 – v5.6.8.4340

  • Case/Evidence Time Zone:
    • New Case, Add Evidence – Defaults to UTC (previously Local Time).
    • Changed wording of ‘None’ to ‘Not Set’, When ‘Not Set’ is used, (e.g., for the Case folder), child items (e.g., forensic images) can be set individually.
  • Save Case – Fixed extract metadata issue that could have led to a save case error.

13 Sep 2023 – v5.6.8.4324

  • Graphics Analysis – Improved detection speed.
  • Artifacts – Updated Brave Browser, Android Gmail.
  • Custom Filter – Fixed issue editing a custom filter.
  • Display View – Updated display view windows. Additional file type display.
  • Display View – Improved mouse wheel zoom.
  • Hash Differential – Added hash error messages to column.
  • Hash Fuzzy – Added hash error messages to column.
  • Hash Match – Improved Differential and Fuzzy by including percentage hashed.
  • Hash Speed – Fixed introduced hash speed issue.
  • TAR – Improved expansion of large .TAR produced in in phone acquisitions.
  • VMDK – Added support for older VMDK files.

18 Aug 2023 – v5.6.8.4240

  • Activation – CodeMeter updates.
  • Artifacts – Updates for iOS and Android.
  • Column Filter – Fixed issue switching between column filters.

8 Aug 2023 – v5.6.8.4210

  • Artifacts – Updates for iOS and Android.
  • Email – Fixed msg export size error.
  • License Manager – Updated the GetData License Manager.
  • L01 – Added a single acquisition hash that can be verified in FEX or EnCase.
  • L01 – Added hash information to log file.
  • Scripts – Added conditional define to share scripts between GUI and CLI.

28 Jul 2023 – v5.6.8.4170

  • Artifacts – Updates for iOS and Android.
  • Cellebrite.UFDR – Format added to Open Image option.

22 Jul 2023 – v5.6.8.4138

  • Artifacts – Updates for iOS and Android.
  • Other minor updates.

14 Jul 2023 – v5.6.8.4086

  • Artifacts – Added W11 Program Compatibility Assistant.
  • CR3 – Improved identification and display of CR3 graphics.
  • Other minor updates.

5 Jul 2023 – v5.6.8.4070

  • Artifacts – Updated chat artifacts.

30 June 2023 – v5.6.8.4046

  • Artifacts – Added MAC CUPS printing metadata.
  • Category Graph – Added column sort.
  • DVR – Improved Hikvision. Added folders for individual cameras.
  • Memory – Improved memory management.
  • Permissions – Improved extraction of permissions metadata.
  • Script – Added ability to export JSON from Info, Filesystem Record and Metadata views.
  • Signature MPEG – Improved Mpeg file signature identification.
  • Signature Yahoo – Improved Yahoo chat file signature identification.

23 June 2023 – v5.6.8.4000

  • Artifacts – Removed artifact folders with zero counts.
  • Artifacts – Fixed issue with artifacts module resetting required columns.
  • Artifacts Browsers – Now includes URL summary (e.g., Bing, Google, YouTube queries).
  • Registry – Added LastKnownGoodTime to Quick Registry and Registry module.

8 Jun 2023 – v5.6.8.3972

  • Index Search – Update process distribution for machines with a high core count.
  • Quick Word Report – Added to File System and Bookmark toolbars on startup.
  • Quick Word Report – Added default column selections.
  • Registry – Added time sync and auto-update keys.

8 Jun 2023 – v5.6.8.3972

  • Script maintenance.

1 Jun 2023 – v5.6.8.3964

  • Artifacts – Added MAC deleted users, MAC preferences.
  • Column Filter – Blank and Not Blank column filters are now read only fields.
  • Custom Columns – Added ability to save and load custom column layouts.
  • Display View – Improved for complex SQLite files.
  • Quick MS Word Report – Updated Files System > Tools > Quick MSWord Report.
  • Verification – Added AFF4 verification hash information to Evidence module.

20  May 23 – v5.6.8.3902

  • Hash Match – Added support for NSRL v3 Minimal hash sets..
  • Artifacts – Improved WhatsApp for Android.

15  May 23 – v5.6.8.3886

  • Improved validation of Hikvision (DVR) file systems.
  • File and Folder Name Search – Search inside Zip/Rar checked on fresh install.
  • Other minor script updates.

8  May 23 – v5.6.8.3868

  • Artifacts – Added Google Play Installed Applications (Android).
  • Artifacts – Added Photos.sqlite (iOS).
  • Artifacts – Added Photos Internal (Android).
  • Artifacts – Added Photos External (Android).
  • Artifacts – Added Wifi Configurations (Android).
  • 3rd Party Tools – Added TrID File Identifier.
  • 3rd Party Tools – Added Zimmerman Jump List Examiner.
  • Other minor updates.

1  May 23 – v5.6.8.3834

  • Google Earth KML – Added HEIC to Google Earth KML creation.
  • Prefetch – Updated code for Prefetch Execution Count.
  • Other minor script updates.

24 Apr 23 – v5.6.8.3816

  • DVR – Added Hikvision DVR file system support.
  • DVR – Added LVF (Logitech Video Effects File) file system support.

15 Apr 23 – v5.6.8.3796

  • Artifacts – Added Fitbit and Slack.
  • Scripts – Other minor script updates.

12 Apr 23 – v5.6.8.3778

  • Artifacts – Added Apple Health.
  • Email – Improved non-English character support.
  • Export – Improved BMP video keyframe export.
  • Script – Updated Journal parser script.

4 Apr 23 – v5.6.8.3746

  • Display Docx – Fixed introduced error where docx were being displayed as compound files.

31 Mar 23 – v5.6.8.3740

  • Quick Word Report – Updated underlying MSOffice integration code.
  • Scripts – New script defaults to UTF8-BOM for language support.
  • Zip – Improved Zip64 support.

18 Mar 23 – v5.6.8.3710

  • Email – Index search result no longer displays container (e.g. PST), just message.
  • Export Rows – Upgraded export CSV, HTML.
  • RAR – Improved set-password in File System.
  • Setup Files – Updated setup file builder.
  • Other minor script updates.

08 Mar 23 – v5.6.8.3676

  • Bookmark Folders by Hash Set Match – Export report added.
  • Copy cell – Now works with multiple file selection.
  • Recover Folders – Select all button added.
  • Other minor script updates.

27 Feb 23 – v5.6.8.3626

  • Evidence module – Credentials repository for Bitlocker and File Vault passwords.
  • NodeXL: Updated Visualize Email script. Added LNK visualize.
  • Video View > Export > Export Video Quick Views (‘story-boards’ as jpg).

15 Feb 23 – v5.6.8.3584

  • File and Folder Name Search – Updated for unicode support,
  • Verify Device = Added hash of logical image segments.

15 Feb 23 – v5.6.8.3572

  • AFF4 – Fixed introduced error where AFF4 File System did not process.

12 Feb 23 – v5.6.8.3564

  • Bitlocker – Auto-process after right-click add encryption password.
  • Codemeter – Updated digital certificate for Win11.
  • Entropy – Added full file entropy calculation: Analysis Programs > Entropy (Shannon).
  • Other minor GUI updates.

3 Feb 23 – v5.6.8.3536

  • Metadata – Additional Extract Metadata and Bookmark options for MS Office.
  • Hash Match – Display column checkbox is now on by default.
  • Hash Create – Fixed vertical scroll issue on form.
  • Other minor GUI updates.

27 Jan 23 – v5.6.8.3512

  • Export – Enabled typed paths for file export.
  • Investigator – Improved addition and management of investigator details.

9 Jan 23 – v5.6.8.3468

  • FEX Graphics Analysis:
    – Face Detection
    – Face Recognition
    – Object Detection
    – Weapon Detection
  • JSON Hash Match – Fixed issue populating HashSet Category column.
  • Reports – Fixed issue with specific email body text not displaying.
  • Tools > 3rd Party Tools – Added Elcomsoft Encrypted Disk Hunter.
  • VMDK – Fixed issue reading VMDK image.

12 Dec 22 – v5.6.8.3392

  • Gallery/Video Views – Red border indicates a filtered view.
  • Gzip – Fixed issue expanding Gzip.
  • Other minor updates.

25 Nov 22 – v5.6.8.3300

  • Artifacts – Improved extraction of .evtx Event Data.
  • Artifacts – Added button to export artifact folder contents to CSV.
  • Email – Added project Vic export to Email module.
  • Live Boot – VM date options are now created from all drives (not just boot drives).

21 Nov 22 – v5.6.8.3282

  • Artifacts – Improved identification of Chrome/Chromium based Autofill artifacts.
  • Bookmarks – Tree filter no longer includes default bookmark folders.
  • Duplicate Items by MD5 (filter) – Active files now take filter precedence over carved files.
  • Email – Signature Analysis now performed by default when files are sent to the Email module.
  • Evidence Module – Can add or move between groups when a process is running.
  • Log Files – Removed redundant logs.
  • Log File Viewer – Added column sorting.
  • OCR – Fixed logical/physical size difference in OCR GUI.
  • RamDisk Tools – Improved feedback from Zimmerman AppCompatCacheParser.
  • Recovered Folders – Improved for FAT.

11 Nov 22 – v5.6.8.3252

  • Bookmarks – Improved auto adding of selected text to bookmark.
  • Bookmarks – Improved visual display of bookmarked item icon.
  • Email – Signature analysis is now performed by default when sending files to the Email module.
  • Filters – Added Registry – Amcache.hve filter.
  • File System folders tree – Right-click ‘Reset view’ (removes: branch plate, checks, folders filter, contracts all).
  • Hashing – Reduced memory and improved speed when using EnCase multi hash.
  • HashSets – Added NSRLv3 support.
  • Keyword Search – Added renaming of previous keyword search results.
  • RamDisk Tools – Added Zimmerman AppCompatCacheParser.

28 Oct 22 – v5.6.8.3214

  • Artifacts: Added Office 2016 Backstage.
  • Email: Improvements for encoded email headers.
  • Live Boot: Fixed Live Boot Deploy error introduced in previous version.

25 Oct 22 – v5.6.8.3200

  • Email: Added filter option to ‘Extract Addresses’.
  • Evidence: Improved progress for Ex01 verification.
  • Gallery View: Dual middle information bar.
  • Index Search: Updated unallocated clusters to stop file sig. in first sector changing indexing behavior.
  • Live Boot: Updates for compatibility with VirtualBox 7.
    • Note: Live Boot with VirtualBox 7 is currently under testing.
  • Signature: Updated $MFT file signature.

14 Oct 22 – v5.6.8.3168

  • EX01 – Fixed issue with Ex01 acquisition hash not displaying in Evidence module.
  • Gallery View – Fixed crash with image inside expanded file.
  • Live Boot – Additional updates to improve Live Boot of Win 11.
  • Reports – Improved drag and drop of tables to report editor.

28 Sep 22 – v5.6.8.3122

  • Live Boot – Updates for Windows 11.
    • Windows 11 now autodetects in Live Boot form.
    • Increased default memory size to 4G.
  • Scripts – Updates to Script Editor.
    • Added begin > end vertical lines and other minor features.

24 Sep 22 – v5.6.8.3106

  • CPU – Fixed increase in CPU resources from previous release.
  • Physical Device – Fixed issue previewing physical devices.

17 Sep 22 – v5.6.8.3096

  • Checkbox – Improved checkbox speed for large cases.
  • Email – Updated decoding of subject for Google Takeout .mbox.
  • Email – Added ‘Labels’ folder for Google Takeout mbox.
  • Expand Files – Updated with additional options for graphics and video.
  • Folder Tree – Right-click copy cell added.
  • GPS Scripts – Co-ordinates added to bookmark comments.
  • Information Bar – Middle information bar split to 2 lines. LS (Logical Size) and PS (Physical Size) now specified.
  • Signature Analysis – Is now included in the default processing profile.
  • Triage Report – Added a report section for Windows Password Hints.
  • Wibu Codemeter update, 7.51.
  • Other minor updates.

15 Aug 22 – v5.4.8.2946

  • Email – Fixes issue saving email to PST.
  • Filter – Added File System > Printers filter.

12 Aug 22 – v5.4.8.2938

  • Artifacts Chat – Added Android: TikTok, Vemo, Viber, WeMe, Wire.
  • Artifacts – Added button to create GPX map file for common GPS artifacts.
  • Branch Plate – Updates to branch plate speed.
  • Date/Time: Active case/evidence timezone now highlighted in tree.
  • Send To Registry: Improved sending of registry files to Registry module.
  • Other minor updates and improvements.

25 Jul 22 – v5.4.8.2896

  • Artifacts – Added Skype Chatsync.
  • Categories Chart – Improved display for individual folders.
  • DPI configuration registry key added to enable manual adjustment of FEX display.
  • Index Search – Added logging of options selected.
  • FileSystem > Analysis Programs > Regex Search – Improved progress bar for checked items only.

15 Jul 22 – v5.4.8.2868

  • Gallery View – Fixed issue with Gallery View display after refresh (introduced in previous release).
  • Other minor updates.

08 Jul 22 – v5.4.8.2856

  • Evidence Processor – Fixed issue in Evidence Processor expanding files for additional devices.
  • Improved GPX file creation in: File System > Analysis Programs > GPS – Google My Maps Create.

30 Jun 22 – v5.4.8.2842

  • MD5 Hash – Improved hash speed.
  • File System > Filename Search – Renamed Bitcoin to Crypto Currency.
  • File System > Analysis Programs > GPS – Google My Maps Create.
  • Recover Folders – Fixed GUI AV after Recovered Folders had been manually removed.
  • Right-Click Expand Compound Files – Fixed error introduced in previous version causing right-click expand compound files to fail.

17 Jun 22 – v5.4.8.2814

  • File System > Analysis Programs – Added Shadow Copy OnDiskSnapshotProp.
  • HEX View – Fixed Info. bar refresh for GOTO File Offset.
  • Sector Start – Column now blank when sector start is unknown.
  • Triage – Added Shadow Copy OnDiskSnapshotProp to Triage and Triage report.

8 Jun 22 – v5.4.8.2794

  • APFS – Improved reading of APFS filesystem.

3 Jun 22 – v5.4.8.2786

  • APFS – Improved memory management.
  • Other minor updates.

22 May 22 – v5.4.8.2754

  • Artifacts – Added Opera browser carve.
  • Artifacts – Added Discord.
  • Bookmarks – Fixed display of Bookmark Folder column.

12 May 22 – v5.4.8.2740

  • FEX Viewer – Fixed email filters.
  • CRC32 Hash – Fixed issue with display text direction.
  • Search Artifact Results – Updated to save custom search as .txt.
  • Volume Label – Added root folder volume ID to extraction script and Triage report.

2 May 22 – v5.4.8.2714

  • Email Export – Added checkbox on export form to ignore all attachments.
  • Export – Fixed issue prefixing Bates ID when exporting from Email and Bookmarks modules.
  • Word Quick Report – Stability update for Word 365.

8 Apr 22 – v5.4.8.2698

  • Classification – Fixed issue updating a previously classified picture.
  • Event Logs – Added Windows .evtx Event Log processing to Artifacts module.
  • Extract Metadata – File System > Toolbar > Extract Metadata > Extract Permissions To Columns – Add options for HPFS and APFS.
  • File Info – File System > Toolbar > File Info: Updated for HFS and APFS.
  • TAR – Updated drivers for faster .TAR extraction of large images (e.g. cell phone extractions).
  • Other – Minor GUI updates.

21 Mar 22 – v5.4.8.2672

  • Artifacts – Updated:
    • iOS ApplicationState
    • iOS Instagram
    • iOS Line chat
    • iOS Photo Vault
    • iOS Telegram
    • iOS Wire
  • Other minor GUI updates.

21 Mar 22 – v5.4.8.2644

  • Artifacts – Updated:
    • iOS Cell Tower Locations
    • iOS Facebook Messenger
    • iOS Installed Applications
    • iOS Mail
    • iOS Notes
    • iOS Parked Car Locations
    • iOS Significant Locations
    • iOS TextNow
    • iOS TikTok
    • iOS Wifi
    • iOS Zoom
  • Progress Window – Now clears logs between cases.

11 Mar 22 – v5.4.8.2616

  • Translation – Fixed translation error on startup for non-English versions.
  • Reference Library – File System > Tools > Reference Library. Replaced existing library with Zotero.
  • Other minor updates.

01 Mar 22 – v5.4.8.2578

  • Artifacts – Update of browsers and chat.
  • Delete Bookmark Sub-Folder – Fixed access violation on delete.
  • Display View – Improved table display for SQLite.
  • Email – Update to Export to PST.
  • Reports – Improved tree sort when manually creating a report template.
  • Video Bookmarks – Adding blur for bookmarked video thumbnails now shows in report.

21 Feb 22 – v5.4.8.2554

  • Artifacts – Updated: Android MMSSMS, Burner, ProtonMail, Skype, SnapChat, TextNow.
  • Display View – Clear viewers when currently selected file is filtered out.
  • Export Email – Added export to PST.
  • Export L01 – Fixed display error in Export to L01 for Folder Data checkbox.
  • Hash – Added SHA512.
  • Hash – Added ability to process EnCase multi-type.hash sets.
  • Hash – Create flat hash set fix to excluded expanded compound files.
  • Installation – Fixed Microsoft SmartScreen message on FEX install.
  • Relativity – Fixed issue importing segmented L01 into relativity.

21 Jan 22 – v5.4.8.2474

  • FFMpeg and VLC Play – File System > Tools > RamDisk. Added warning message if checked videos > 5.
  • Hash Match – File System > Hash Match > Bookmark Files by Hash Set Match remembers last Hash Set location.
  • Index Search – Added additional logging for excluded encrypted files.
  • Physical Device Serial Number – Added to: ‘File System module > Analysis Programs > Volume ID and Partition Information’.
  • Other minor updates.

7 Jan 22 – v5.4.8.2456

  • 3rd Party Tools – Added Nirsoft NetworkUsageView.
  • ESE – Fixed error parsing corrupt Exchange Database file.
  • Highlight File in Module – Now shows a message if file is excluded by filter.
  • Investigator – Updated new investigator form.
  • Reports – Fixed missing Documents and Pictures samples.

23 Dec 21 – v5.4.8.2392

  • File Carve – Added columns (Base: Bates; Filename; Path) to identify source.
  • Gzip – Improved identification of corrupt files to limit false export size.
  • Keyword Search – Improved search for HFS file systems.
  • Hash Set Create – Added options to exclude items from hash set (folders, free space, NTFS, system).
  • Index Search – Added Metadata tab to module.
  • License Manger – Fixed issue renaming dongle.
  • Metadata – Added ODT creator metadata tag.
  • Reports – Fixed column width for include checkbox.
  • Reports – Improved landscape options in Reports module.

26 Nov 21 – v5.4.8.2320

  • CLI – New release and updates to FEX GUI CLI launcher.
  • Export – Added export to XLSX.
  • File List – Updated colors for File List views.
  • HashSet Create – Added exclude options.
  • OCR – Improved text parsing.
  • Project Vic – Updated Project Vic classification colors.
  • Recycle Bin – Added script to parse WinXP Info2 records.
  • Scripts – Backend updates to scripting engine.

10 Nov 21 – v5.4.8.2250

  • Email – Updated Search Email Columns script.
  • Other minor updates.

01 Nov 21 – v5.4.8.2232

  • Classification – Updated classifications options window. Added button to File List module.
  • File System – Added double-click in File List to drill into folders.
  • Load Case – Fixed issue loading case with expanded compound PDFs.

26 Oct 21 – v5.4.8.2198

  • Hash Set – Fixed freeze creating very large .db3 hash set.
  • Metadata – Export Metadata tab contents to .txt.

20 Oct 21 – v5.4.8.2182

  • Email – Added UTC to email message header in Display view.
  • Email – Added Clam AntiVirus to Email module.
  • Metadata – Improved extraction of .torrent files.
  • Metadata – Updated extract metadata script.
  • File List – Fixed issue where highlight of large list could freeze.
  • Reports – Fixed issue where bookmark comment did not display.
  • Other minor updates.

11 Oct 21 – v5.4.8.2150

  • L01 – Fixed issue with L01 being read by NUIX.
  • Scripts – RamDisk script updates.
  • Other minor updates.

07 Oct 21 – v5.4.8.2134

  • Byte Plot – Fixed display error viewing large files.
  • Encryption – Improved detection of 7z and PDF encryption.
  • Export – Improved export of files when saving to root folder of a drive.
  • Hash – Added xxHash64.
  • Video – Improved keyframe extraction.
  • Zip – Increased speed on zip detection.
  • Other minor GUI updates.

24 Sep 21 – v5.4.8.2084

  • Export – Solved issue creating root export folder on external USB.
  • Logs – View log text during process.
  • Registry – Updated Registry module icons.
  • Registry- Improved user account idenifification for UsrClass.dat and ntuser.dat.

21 Sep 21 – v5.4.8.2058

  • Checkbox – Improved checkbox responsiveness on large cases.
  • Column Text Filter – Added a separate Simple search with boolean AND, OR , NOT functionality.
  • Disk view – Improved disk view responsiveness on large cases.
  • Preview – Locked preview case remove by another instance of FEX.

12 Sep 21 – v5.4.8.2018

  • Analysis Programs > Encrypted Files – Identify encrypted files within archives.
  • Email – Improved column filter for To/From/Subject/Attachments.
  • Splash – Fixed startup error with 90 day dongle license.
  • Other minor updates.

01 Sep 21 – v5.4.8.1968

  • Encrypted Files – Improved detection of encrypted DOC, PPT, XLS.
  • Scripts – Added Analysis Programs > Journal Parser ($UsnJrnl~$J).
  • Zip Export – Improved handling of special char in file names.
  • Zip Export – Added warning message for decompression programs that do not handle > 250 char. path lengths.
  • Other minor updates.

22 Aug 21 – v5.4.8.1926

  • Activation – Wibu Codemeter update.
  • Case Number – Added this field to case information.
  • ClamAV – Update for new ClamAV config.
  • Column Filter – Added AND/OR logic to simple column filter.
  • Columns Default – Removed Flags, Classification.
  • Display – Update to display view for additional file previews.
  • DTSearch – Update to DTSearch DLL.
  • Email – Updates to EDB, EML, EMLX, MBOX, MSG, OST, PST.
  • Email – Added Read column.
  • File Carve – Fixed error carving TGA files.
  • Filters – Added additional email filters.
  • OCR – Added graphics Optical Character Recognition (OCR).
  • RamDisk Tools – Added VLC to RamDisk tools.
  • Script – Added xxHash capability.

17 Jun 2021 – v5.4.2.1678

  • Email – Updates to OST processing.
  • Email – Update to Outlook Caesar decoder for resident small attachments.
  • Registry – Updated to display REG_UNKNOWN key data.

7 Jun 2021 – v5.4.2.1650

  • Email – Fixed save and load error with very large PST files in Email module.

1 Jun 2021 – v5.4.2.1634

  • 3rd Party Tools – Added IrfanView screen capture and thumbnails.
  • Export Files – Added option to export with file slack.
  • Export JSON – Added graphics and video tags to Project VIC JSON export.
  • Live Boot Deploy – Fixed issue ordering multiple devices in deploy script.
  • Metadata – Added Extract Metadata for Track Changes.
  • Reports – Fixed issue with landscape.
  • Reports – Improved email message display.
  • Other minor updates (icons etc.)

30 Apr 2021 – v5.4.2.1578

  • C4All – Fixed import error.
  • FileVault – Fixed unlock of APFS system container after Catalina update.
  • Progress Bar – Improved progress bar formatting.
  • Quick Word Reports – MS Word stability updates.
  • Signature/Display – Added Webp signature, preview, and gallery view.

19 Apr 2021 – v5.4.2.1536

  • Activation – Improved action when local dongle connectivity lost.
  • Activation – Network dongles switch when connectivity is lost.
  • Artifacts – Added GroupMe JSON.
  • Download – New certificate. (Note: Download may trigger Defender SmartScreen).
  • Keyword – Fixed issue with default keyword txt not populating on install.
  • Project Vic – Added graphics/video tag to export.
  • RamDisk Tools – Added Zimmerman Shell Bag Explorer.
  • Signature – Added Zip (Encrypted).
  • Translations Updates – Chinese, French, German, Indonesian, Spanish, Turkish.
  • Word Quick Report – Improved stability.
  • Other minor updates and improvements.

20 March 2021 – v5.4.2.1404

  • Clam Antivirus – New database update links.
  • Email Module – Added duplicate email script, filter and toolbar button.
  • Display – Improved DOCX display.
  • Other minor updates.

15 March 2021 – v5.4.2.1380

  • Email Module – Added right-click > Export > PDF File.
  • Evidence Module – Updated Check For Updates config. to check on launch.
  • File System Module – Updated Analysis Programs > Recycle Bin Match $I with $R
  • Non-English OS – Fixed launch issue from previous update.
  • Reports Module – Improved High-Res PDF export.
  • Other minor updates.

6 March 2021 – v5.4.2.1352

  • Codemeter – Update to 7.20a.
  • Extract Metadata – Added user permissions.
  • File Signature – Added ODT (Encrypted).
  • GetDataNetworkServer – Fixed issue when run as Windows Service.
  • Interpol Classification – CAM script update.
  • File Carve – Fixed issue with Minolta RAW returning large file size.
  • Quick Report – Added export email to PDF.
  • Quick Registry – Added Windows UserSID.
  • Recover Folders – Fix issue returning invalid files on HPFS.
  • Triage Report – Added UserSID section.

25 February 2021 – v5.4.2.1316

  • Display View – Updated Adobe.psd display for multiple images.
  • Display View – Updated OpenOffice.odt display.
  • Email Module – Added a display tab for the message header.
  • GUI Updates – Column separators, highlight and select colors, icons.
  • Script – Added File System > Analysis Programs > Folder Sizes.
  • Word Report – Added File System > Tools > Quick Word Report.

03 February 2021 – v5.4.2.1238

  • Classification – Added Interpol Baseline 4 category.
  • Email – Updated PST/OST Send-To-Module.
  • Reports – Improved high-res PDF export.
  • Reports – Improved sort by field.

14 January 2021 – v5.4.2.1180

  • Fixed German translation error causing freeze.
  • Update RamDisk scripts for new NirSoft versions.
  • Other minor script updates.

23 December 2020 – v5.4.2.1140

  • Email – PST processor update.
  • Filter – Fixed hash set match filter.
  • GUI – Improved forms ‘stay in front’.
  • Other minor updates.

16 December 2020 – v5.4.2.1122

  • Bitlocker/File Vault – Password is added to the column and Triage report.
  • Branch Plate – Added an icon to indicate sub-folders are plated.
  • Categories – Added date categories and improved speed.
  • Display – Fixed column offset for some SQL files.
  • Display – Improved Display view for MSOffice docs (added PPTX).
  • Email – Added tab views for Contacts and Calendar.
  • Email – Added NodeXL chart.
  • Email – Improved support for EDB, ESE, MBOX, PST, OST.
  • Email – Added script to collect email address.
  • French – Fixed translation error for hash sets.
  • JSON Export – Path extended to include device.
  • Logging – Fixed MBR count in log file.
  • MOV – Improved processing speed.
  • Reports – Added export options for blurred graphics.
  • Reports – Fixed intermittent error changing between report folders.
  • Updated FEX memory management.
  • Video – Improved video speed, sound and display.

21 October 2020 – v5.2.2.9978

  • Artifacts – Added Instagram direct chat.
  • Bookmark – Fixed error causing occasional crash adding bookmark.
  • Scripts – File System > Analysis Programs > Recycle Bin Match $I with $R.
  • Reports – Samples: Added Recycle Bin report to link $R file with $I metadata.

9 October 2020 – v5.2.2.9944

  • Reports – Fixed error creating ‘Report Templates’ folder.

5 October 2020 – v5.2.2.9936

  • Artifacts – Added Windows 10 Time Line.
  • exFat – Fixed issue reporting incorrect cluster allocation.
  • Display View – Improved display of SQLite tables.
  • Display View – Improved ODT display.
  • Gallery view – Improved blur.
  • Install – Fixed issue in last release with language versions installing in English.
  • Reports – Fixed freeze clicking between report folders.
  • Un-dock – Fixed issue where slow render of SQLite tables un-docked data view.
  • Other minor updates and improvements.

3 September 2020 – v5.2.2.9866

  • Artifacts – Added unallocated carve for search URLs.
  • FEX Imager Servlet – Now caters for remote imaging with Dynamic IP Changes.
  • Filename Search – Search Zip and RAR to 20 levels.
  • File System module – Updated File Info button.
  • FEX Viewer (free stand-alone product) now available for case review.
  • FEX Viewer Case Export – Added to config button shortcut in header toolbar.
  • Metadata:
  • Updated Extract Metadata button.
  • Added extraction of Video metadata.
  • Added extraction of Adobe XMP metadata.
  • MKV – Detect multiplexing and expand video thumbnails to track folders.
  • Text view – Added right-click, show printable characters only.

28 July 2020 – v5.2.2.9748

  • Launch Speed
  • Improved first install launch speed.
  • Improved launch speed.
  • Triage Report – Sorted registry so that current appears first.
  • Triage MAC – Updated Triage report with additional artifacts.
  • Other minor updates and improvements.

21 July 2020 – v5.2.2.9736

  • APFS – Improvements based on new Apple documentation.
  • Case – Fixed error opening FEX-Triage case.
  • Classification – Drop down menu added for Gallery View CEM Classification:
  • Project Vic
  • Copine
  • SAP
  • SOD
  • Display View – Updated preview of DOCX files in display view tab.
  • Expand Compound – Fixed error expanding 7z.
  • Project Vic – Changed export date times from local to UTC.
  • Scripts – Improved forcing display windows to front of screen.

14 July 2020 – 5.2.2.9714

  • Artifacts – Added Browsers:
  • Safari Bookmarks
  • Safari Downloads
  • Safari Top Sites
  • Artifacts – Added MAC Operating System:
  • Mail BackupTOC
  • Recent iWork Numbers
  • Recent iWork Pages
  • Recent QuickTime
  • Recent TextEdit
  • Recent VLC
  • Custom Byte Carve – Quick Add Google Maps.
  • Display View – Updated DOCX display.
  • FEX-Imager changed to 64-bit to allow for Ex0, Lx01 conversion to E01 or L01.
  • Live Boot – Added button to Evidence module.
  • Reports – Fixed issue with blur on exported PDF.
  • Website Update – Check for Updates button now links with new download page.

29 June 2020 – 5.2.2.9680

  • Email – Improved MBOX support.

22 June 2020 – 5.2.2.9662

  • Bookmarks – Artifact bookmarking auto-creates bookmark folder.
  • Email – Improved MBOX support.
  • License Manager – Identifies locked dongle.
  • Live Boot – Select storage controller (Auto, IDE, SATA, BusLogic, LsiLogic, LsiLogicSAS).
  • Load Case – Improved load case time.
  • Preview – Button in Evidence module now default.
  • Registry – Improved Office MRU script.
  • Reports – Fixed AV in copy and paste of table row.
  • Reports – PDF resolution improved.
  • Reports – Updated report column sorting.
  • Reports – Updated sample templates.

11 June 2020 – 5.2.2.9632:

  • Email – Fixed error loading an old case with PST email.

06 June 2020 – 5.2.2.9622

  • Email – Improved export from property view.
  • PDF – Fixed issue with expanded PDF causing freeze.
  • Reports – Export PDF in high resolution.
  • Video – Added .ts video file type.

03 June 2020 – 5.2.2.9618

  • Artifacts – Improved search speed for Artifact files.
  • Artifacts – Added Chromium bookmarks and improved categorization.
  • Artifacts – Clear of 1601 blank Delphi date fields.
  • Evidence Processor – Changed button to Skip processing.
  • Gallery Cache – Improved gallery cache speed.
  • Metadata – Added metadata for HEIC files.
  • FEX-Imager – Speed improvements.
  • Recover File – Added drag and drop for case recovery files.
  • Remote – Improved network connection speed for remote devices.
  • Other minor updates and improvements.

7 May 2020 – 5.2.2.9526

  • Artifacts – Minor fixes and improvements.
  • ClamAV – Updates to improve speed. Removed default check for PUA.
  • FEX-Imager – Released FEX-Imager v2 (located in install folder).
  • Gallery View – Fixed cache thumbnail error on small cache graphics causing a freeze.
  • Email – Added Email module support for mbox mail.
  • Email – Added Email module support for EDB mail.
  • Email – Fixed issue with blank OST email subject displaying message page offset.

21 Apr 2020 – 5.2.2.9472

  • Bookmarks – Fixed issue re-bookmarking a bookmarked file.
  • Remote – Updated protocols (increase remote serve-let connection speed).
  • Other minor updates.

15 Apr 2020 – 5.2.2.9452

  • Btilocker Partitions – Now return isEncrypted status.
  • Progress – Fixed issue with progress bar staying on-top of other applications.
  • Project VIC2 – Import and Export support added.
  • VDI – Updated support for Virtual Desktop image format.

9 Apr 2020 – 5.2.2.9444

  • APFS – Updated drive decryption routine.
  • Artifacts – Script updates.
  • C4All – Add Cellebrite C4All export to FEX.
  • RAID6 – Added RAID 6 support.
  • Remote – Updated Add Remote network config.

31 Mar 2020 – 5.2.2.9420

  • Merge Files – Right click menu option added.
  • Setup – Improved setup for non-admin installs. Removed auto-launch.
  • Permissions – Added NTFS Permissions viewer.
  • Other minor script updates and improvements.

17 Mar 2020 – 5.1.2.9378

  • Live Boot – Fixed issue causing Live Boot to not launch.

13 Mar 2020 – 5.1.2.9372

  • Artifacts – Added Viber for PC v11.
  • File Vault – Fixed pwd check for AES-128 encrypted volumes converted to APFS.
  • Hex Data Inspector – New layout.
  • Merge Files – File System right-click menu option to merge data.
  • RamDisk Tools – Added FFmpeg.

05 Mar 2020 – 5.1.2.9342

  • Load Case – Fixed error loading case created from folder containing Zone files.
  • APFS – Improved support for MacQuisition decrypted APFS volumes.
  • Other minor script updates and improvements.

24 February 2020 – 5.1.2.9324

  • Filters – Improved Read From File filter.
  • L01 – Improved detection of corrupt L01 or missing segments on add of evidence.
  • Scripts – Updates to File Name Search to handle large imported keyword lists.
  • Triage – Fixed error introduced in previous build causing Default + Triage to fail.

13 February 2020 – 5.1.2.9314

  • Bookmarks – Fixed sub-folder sort error.
  • Bookmarks – Added Artifacts as a default folder.
  • Display View – Updated multi-video view buttons.
  • File Name Search – Updated array size for large keyword lists.
  • HEX View – Fixed flicker on double click.
  • Index Search – Added additional data view tabs (Hex, Display, Filesystem Record).

5 February 2020 – 5.1.2.9306

  • Bookmarks – Non default folders get different icon.
  • Display – FFMPEG DLL update (fix OGG and WK3 freeze).
  • File Carve – Added USN Journal file type.
  • File Signature – Update to ESE file type to improve speed.
  • HEX – Update to HEX selection.
  • Keyword Search – Enabled multi select of keyword.txt import files.
  • Recover Folders – If Bad Cluster file recover set at 0 size.
  • Registry – Improved speed of ‘Send to Registry’.
  • Toolbar – Fixed minimize maximize error on toolbar.

29 January 2020 – 5.1.2.9288

  • CLI Hash min/max size fix.
  • Metadata To Columns – Added ‘Extract Recycle Bin’ for $I values.
  • Recycle Bin – Decode INFO2 in File Metadata tab (after signature).
  • Recycle Bin – Added Zimmerman RBCmd to 3rd Party Tools.
  • Other minor script updates.

24 January 2020 – 5.1.2.9270

  • Fixed exit error caused by Evidence Groups.
  • Metadata To Columns – Added LNK MAC Address.
  • Other minor script updates.

06 January 2020 – 5.1.2.9254

  • Cases – Options > Cases path now preserved as base cases folder.
  • Checked Items – Fixed issue with checks no clearing green squares.
  • Script – Additional export options added to Export Files by Type.
  • Script – Added CLI launcher to Scripts\Evidence\CLI_Launcher.pas.

20 December 2019 – 5.1.2.9226

  • Spanish – FEX GUI translation update.
  • Other – Minor updates.

17 December 2019 – 5.1.2.9222

  • APFS – Updated detection of encrypted partitions.
  • Project Vic – Fixed issue with some Project Vic files not being recognized.
  • Scripts – Fixed issue resizing script forms.

11 December 2019 – 5.1.2.9200

  • APFS – Fixed issue with encrypted partitions reporting unallocated space size.
  • Help – Updated Turkish v5 User Guide.
  • Reports – Fixed issue with Reports not reading some cached pictures.
  • Splash – Fixed issue with splash reporting an expiring license date.

5 December 2019 – 5.1.2.9180

  • Backup Case – Writes to both screen and log when logging is selected.
  • Cache Images – Update for Gallery and Video views.
  • Thumbs-cache – Update to decode of thumbs indexes.
  • Fixed remove folder error introduced in previous release.
  • Fixed error in date filter tool introduced in previous release.

20 November 2019 – 5.1.2.9148

  • Live Boot – Updates for APFS Live Boot support (file vault drives are not currently supported).
  • GUI Update – Windows themes added. Snap to monitor now supported.
  • Video Gallery – Significant speed increase in Video Gallery.
  • Video Gallery – Fixed corrupt video crashing gallery.

08 November 2019 – 5.1.2.9128

  • APFS – Added support for 128bit encryption keys.
  • Live Boot – Added support for APFS.
  • Registry – Improved speed of script buttons.
  • Tumbs.db – Fixed display of thumb image.
  • Video View – Fix crash caused by corrupt video.

29 October 2019 – 5.1.2.9090

  • APFS – Fix issue prompting for encryption password.
  • Filters – Added registry signature filter.
  • Filters – Updated Registry drop down filter.
  • L01 write – Increased L01 write segment size.
  • Triage – Improved triage speed.

22 October 2019 – 5.1.2.9072

  • APFS Encryption – Now handles multiple volume keys in the KeyBag.
  • Expand Compound – Fixed issue with signature analysis of children.
  • Scripts – Added script to count zero sectors.
  • 7Zip – Improved expansion function.

17 October 2019 – 5.1.2.9054

  • Categories View – Fixed error displaying categories.
  • Evidence – Recent Cases double click during case.
  • Evidence – Added case modified date to displayed information.
  • Evidence – Case names in bold font for recent cases.
  • L01 – Improved read speed.
  • Skin Tone drop down filter added (must run skin tone first).
  • ZMODO video file type added for signature and carving.

14 October 2019 – 5.1.2.9046

  • Evidence – Fixed issue with drag and drop of multiple evidence files.
  • German/Spanish – Fixed MBR translation error.
  • Spanish – Fixed triage report.
  • Other minor updates.

10 October 2019 – 5.1.2.9028 – Major Version Release
Version 5 Release Notes

Other Download Links

Learn more about the debug version