Artifacts
- Apple Wallet Transactions | iOS: Added support to recover transaction histories. [iOS 11]
- Calendar Events | All platforms: Updated support to reduce the number of poorly carved hits.
- Device Identifiers | All platforms: The identifiers refined result has been split into two distinct artifacts: Device identifiers and People Identifiers. Device identifiers include IP Addresses, MAC Addresses and SIDs, while People Identifiers include names, usernames, phone numbers and email addresses.
- Facebook Messenger Messages and Facebook Messages sometimes carved hits from incorrect sources.
- Facebook Messenger Messages | iOS: Added support to recover thread keys. [130]
- Facebook Messenger | iOS: Updated support to recover messages, contacted users and groups. [255]
- Google Maps Business Locations | Android: Added support to recover the Ludocid, Place ID, and FID for a location. [10.32.1]
- Google Maps Directions | Android: Added support to recover origin and destination information in the same hit from a single search. [10.32.1]
- Google Searches | All Platforms: Updated support to recover the load date and time of the previous page.
- Instagram Profiles | iOS: Updated support for recovering profiles in the latest version. [127]
- InteractionC | iOS: Added support for recovering contacts and interactions. [iOS 12]
- Keystore | Android: Updated support to recover keystore entries for all the accounts a user has logged in with for an app. [Android 10]
- LinkedIn Searches | Android: Added support for recovering a user's search queries.
- Notes | iOS: Added support for decrypting Notes using encryption keys recovered in the Apple Keychain Generic Passwords artifact. [iOS 13]
- Outlook Emails | Windows: Added support for recovering sensitivity flags.
- Photos | iOS: Added support to recover photo and photo album data. [iOS 13.1]
- Pictures | All Platforms: Added null checks to ignore pictures that are null.
- Prefetch Files | Windows: Updated support to display application paths even if the Application fragment is not complete.
- Signal Messages | iOS: Updated support for recovering and decrypting messages. [3.2]
- Significant Locations | iOS: Added support to recover the location of address, city, country and more. [iOS 13]
- Telegram | Android: Updated support to recover all media types, messages and attachments. [5.15.0]
- TextNow Contacts | Android: Updated support to recover contact information. [6.50.2]
- TextNow Profiles | Android: Updated support to allow the Profile artifact to populate a null value for the phone number when there is no assigned number. [20.0.1+]
- Tinder Accounts | Android: Updated support to recover a user’s biography, last activity date/time, and distance preference. [11.2.1]
- VK Messages | Android: Updated support for displaying attachment types. [5.47]
- VK Messages | iOS: Added support to preview picture and video attachments from messages in chat threads. [5.0+]
- Yahoo Webmail | iOS: Updated support to recover contact information. [6.0.8]
- Zalo Messages | Android: Updated parsing support for recovering messages. [20.01.01]
- Zalo Messages | Android: Updated support to recover message type information, including system messages, GIFs, stickers and more. [20.01.01]
- Zalo Messages | iOS: Updated support to recover message type information, including GIFs, link previews and more. [19.12.03]
Bug fixes
- For Installed Applications on iOS 12.2 and later, the content that was found in the “Internal Version” fragment in earlier versions, was being displayed in the “Display Version” fragment. Additionally, the content found in the “Display Version” fragment in earlier versions, was not being recovered. -MA-1549
- Full email bodies could not be recovered from Windows 10 Mail. -COMP-680
- If a user had more than one Yahoo Webmail account, some emails might be flagged as duplicates if they’re received by both accounts. -MA-1514
- In Signal 2.36.1 for iOS, the number of recovered contact hits was incorrectly reported. -MA-1592
- In the Instagram Posts for Android, the Poster ID and Post ID fragments did not accurately describe the data that was recovered. -MA-1310
- The Receiver ID was not displayed for Facebook Messenger Messages for Android. -MA-1675
- The Last Accessed Time Enabled values that were recovered from Windows OS Information were being displayed as negative numbers. -COMP-602
