What's New in Version 7.07
- Evidence Processor performance scaling
- Bookmarking Case Analyzer data
- Mac OS X email message support
- Mac OS X Artifact Parser
- LinEn support features
- Sorting tags within a column
- PII Credit Card Pattern enhancement
- Apple iOS 6 support
Evidence Processor Performance Scaling
The Evidence Processor now automatically adjusts the number of threads it uses
to process information based on the number of logical cores on the examiner
computer. The Evidence Processor scales the number of threads, using more
threads on machines with more cores, and fewer threads on machines with fewer
cores. The number of logical cores on a system can be seen in the Performance
tab of Windows Task Manager.
Version 7.07 also includes a new comprehensive evidence processor status tool.
The Evidence Processor status will include:
- Lists of all possible tasks
- Known limits of concurrency
- Items pending
- Items completed
- Elapsed time per task
Bookmarking
Case Analyzer Data
Case Analyzer now gives you the ability to bookmark any single or multiple rows
while assigning a name and location for your bookmarks. When generating a final
report, items/reports that you bookmarked will be included.
Mac OS X Email Message Support
The Evidence Processor now identifies Macintosh OS X email messages (EMLX
files) using the Find Email function. These messages are collected in a LEF
identified as Loose Email.
Mac OS X Artifact Parser
The Macintosh OS X Artifacts Parser gathers common artifacts from OS X devices.
Artifacts from Macintosh OS X versions 10.6, 10.7, and 10.8 are supported. This
module identifies artifacts that are typically stored in Mac OS X Property
Lists (plist) or Apple System Log files.
After running the OS X Artifacts Parser, data collected is available in Case
Analyzer Macintosh reports. New reports have been added to provide detail for
available artifacts.
LinEn Support Features
Ex01 Files
LinEn now supports the creation of Ex01 files.
Console Window
LinEn now has a console window that displays error messages or information
during acquisition, including messaging that informs you if the acquisition
failed.
Add Devices Dialog
LinEn now includes a path in the Add Devices dialog. LinEn scans the selected
directory for block devices and adds them to the dialog list box. You can
select any of the devices in the list and acquire or hash them.
Sorting Tags within a Column
You can now sort the entire tag column by individual tag.
Sort by:
- Tag name
- Tag column
- Ascending order
- Descending order
PII
Credit Card Pattern Enhancement
Version 7.07 adds several standard bank card patterns that are known and
available as well as the ability to perform GREP customization. The interface
has been updated to be more configurable and customizable.
Apple iOS 6 Support
Version 7.07 supports the Apple iOS 6 operating system. This includes
implementation of the following new iOS 6 parsers:
- SMS
- MMS
- Apple Maps (History and Bookmarks)
- Accounts
- Calendar
- Call Log
- Voicemail