Artifacts
- .webm | All platforms: You can now parse and carve .webm videos.
- Chatous | Android: Added support for the Chatous app, including messages and chat partners.
- Chatous | iOS: Added support for the Chatous app, including messages and chat partners.
- Custom artifacts: A new custom artifact has been uploaded this month:
- Fake GPS (Android) - Alexis Brignoni
- Facebook Messenger | iOS: Now identifies queued messages (sent but not yet received).
- Facebook Messenger | iOS: Updated support to recover calls in the latest versions. [225]
- Human Trafficking URLs | All platforms: Added a new refined result that identifies website URLs that are associated with human trafficking.
- Locally Accessed Files | Windows: Recover information about local files that were accessed by the File Explorer.
- Mega | iOS: Added support for recovering accounts, chats, and contacts. [3.6.0.227]
- OneDrive | Windows: Added support for recovering Business accounts.
- Operating System Info | macOS: Updated support for the latest versions. [macOS 10.14.5, 10.15]
- Outlook | Windows: Implemented performance improvements to reduce scan times.
- Owner Information | iOS: Now includes the setup date and type of setup for the device. [iOS 12]
- PowerLog Battery Level | iOS: Recover battery level information.
- SnapChat | iOS: Decrypt memories and My Eyes Only snaps (pictures only) in images acquired using GrayKey.
- Snapchat Messages | Android: Recovered messages now come with metadata about any media that they include.
- Snapchat Stories | iOS: Added parsing support for stories.
- Telegram Channel Chats | iOS: Some of the fragments in this artifact have been renamed to more accurately describe their contents. Started By (Peer User Name) has been updated to Last Sender. Started By (Peer ID)has been updated to Last Sender ID. Start Date/Time has been updated to Last Message Date/Time. First Message has been updated to Last Message.
- Tor and Onion URLs | All platforms: Added a new refined result that identifies Tor and .onion websites.
- Viber | Windows: Updated support to recover messages in the latest versions. [9.9.4.417]
- Videos | All platforms: Added ability to parse .m4a videos.
- Wickr | iOS: Recover and decrypt Wickr messages in images acquired using GrayKey.
Bug fixes
- Android SMS messages weren't being carved properly from some sources. -MA-1039
- Browser plugin entries that include Google in the name were being reported as the Google Searches refined result. -COMP-521
- Mail | iOS: Updated support to recover messages on the latest version. [iOS 13] -MA-1018
- Searches on the Google support website were showing up in the Google Searches refined result. -COMP-235
- Some group member IDs were missing from iOS Snapchat artifacts. -MA-1022
- The ShimCache was only being recovered if it was found at its default location. Now, it can be recovered anywhere on the system. -COMP-480