Artifacts
- Bluetooth Devices | iOS: Now includes information about Bluetooth low-energy devices.
- Evernote | iOS: Recover accounts, contacts, notes, and work chat.
- Facebook Messenger | iOS: Updated support to recover missing data in the Users, Groups, and Messages artifacts. [224.0]
- KakaoTalk Messages | iOS: Messages and user’s phone numbers can be decrypted in the latest versions. [8.3.2, 8.5.0]
- LinkedIn | Android: Added support for recovering profiles, connections, and messages.
- Locally Accessed Files | Windows: Recover information about local files that were accessed by the File Explorer.
- Mega | Android: Added support for recovering accounts, chats, and contacts. [3.6.0]
- Mega | iOS: Added support for recovering accounts, chats, and contacts. [3.6.0.227]
- Owner Information | iOS: Now includes the setup date and type of setup for the device. [iOS 12]
- PowerLog Battery Level | iOS: Recover battery level information.
- PowerLog Camera State | iOS: Recover information about the camera state.
- PowerLog Screen Autolock | iOS: Recover information about when the device’s screen autolocks.
- PowerLog Screen Autolock | iOS: Recover information about when the device’s screen autolocks.
- Refined Results: Updates to URL lists for Classified Ads, Cloud Services, Dating Sites, Social Media Sites, Tax Sites, Shipping Sites, and Web Chat.
- Safari Recently Closed Tabs | macOS: Recover visited websites from closed tabs.
- Snapchat Friends | iOS: Added parsing support for Snapchat Friends.
- Snapchat Messages | Android: Recovered messages now come with metadata about any media that they include.
- Snapchat Stories | iOS: Added parsing support for stories.
- Telegram Channel Chats | iOS: Some of the fragments in this artifact have been renamed to more accurately describe their contents. Started By (Peer User Name) has been updated to Last Sender. Started By (Peer ID)has been updated to Last Sender ID. Start Date/Time has been updated to Last Message Date/Time. First Message has been updated to Last Message.
- Telegram Chats | iOS: Updated to support missing fragments. [5.1.1 - 5.9.1]
- Telegram Messages | iOS: Added thumbnail previews for video attachments.
- Telegram Messages | iOS: Recover audio file attachments.
- Telegram Users | iOS: Updated to support missing fragments. [5.1.1 - 5.9.1]
- TextNow | iOS: Updated support to properly parse evidence again.
- Twitter Direct Messages | iOS: Updated support to recover messages from the new location. [7.56]
- Waze | Android: Recover information about saved events, favorite locations, and places. [4.5.4]
- WeChat | Android: Updated support to decrypt friends and messages in the latest updates. [7.0.6]
- WhatsApp Messages | Android, iOS: Updated to indicate whether a message was forwarded.
- iMessage | iOS: Improvements to carving offsets to remove unwanted characters from message bodies.
Bug fixes
- Carved data from TextNow on Android was displaying unwanted characters and no values were being displayed for dates/times. -MA-853
- Cypher.exe was erroneously being flagged as an encryption / anti-forensics tool when it was detected on a computer. -COMP-409
- Gmail user accounts aren’t always being recovered on iOS and Android. -MA-796
- USB history wasn’t being recovered on macOS 10.14. -COMP-265
