BlackLight 2016 Release 3 (build 20161119.203701-0be99e6)

For a complete list of all new features, improvements, and bug fixes, please scroll down!

Full Changelog

  • New[HALO-2276] - iOS 6/7/8/OS X 10.10 - Parse the Recents DB
  • New[HALO-2504] - Parse Apple System Logs
  • New[HALO-6578] - Hex templates for identifying data structures
  • New[HALO-7446] - Create hash sets for Windows OS's
  • New[HALO-8093] - Parse WebCache file from Internet Explorer 10, 11 and The Edge
  • New[HALO-8441] - Parse and display data from Win 8-10 hiberfil.sys
  • New[HALO-8722] - Add support for evt/evtx to artifact_parser
  • New[HALO-10200] - Support parsing Kik attachments in Comm-Messages
  • New[HALO-10588] - Add Python v 2.7 to the Win installer
  • New[HALO-10040] - Parse ooVoo Android
  • New[HALO-10041] - Parse ooVoo iOS
  • New[HALO-10537] - Parse contacts from Recents DB
  • New[HALO-10538] - Parse locations from Recents DB
  • New[HALO-10540] - Parse messages from Recents DB
  • New[HALO-10541] - Parse email from Recents DB
  • New[HALO-10657] - Add shortcuts to add evidence, manage hashsets, and manage file signatures
  • New[HALO-10719] - Add shortcut ctrl-q to be able to quit BL on windows
  • Improved[HALO-3466] - Add the ability to "Go to Offset" when viewing hex of a file
  • Improved[HALO-4351] - User should be able to "Type Down" to a file in all Views
  • Improved[HALO-5302] - When doing a CSV export of deleted data, have a column to mark it as so
  • Improved[HALO-6391] - Internet - Parse Firefox downloads (v34?) from moz_annos table of places.sqlite database
  • Improved[HALO-6544] - Parse iOS Message GPS (text/x-vlocation vcf cards) and display GPS coordinates in the locations view
  • Improved[HALO-7654] - Media view - scroll smoother and faster
  • Improved[HALO-7794] - Unallocated - Include Delivered-To in the EMLX header regex
  • Improved[HALO-8857] - Extract thumbnails from Android thumbdata3 files
  • Improved[HALO-9003] - Have Status Bar display consistently in all views when selecting multiple rows
  • Improved[HALO-9062] - System-Applications view: Show tag icon by the app icon when user tags profile data
  • Improved[HALO-9871] - Communication-Contacts view: Add a Service column to allow the user to sort by service
  • Improved[HALO-10001] - Email view - Add option click to expand and collapse all mailbox folders
  • Improved[HALO-10216] - Append partitions to previously imported source disk
  • Improved[HALO-10236] - Make Atrifact Parser check headers before processing
  • Improved[HALO-10249] - Auto detect os build manually adding embedded hiberfil.sys
  • Improved[HALO-10321] - Advanced File System Analysis window: Better indicate the difference between the File System Logs and System Logs options
  • Improved[HALO-10352] - Decrypt iOS 10 backup folders
  • Improved[HALO-10569] - Warn about iOS decryption failures in UI
  • Improved[HALO-10645] - Prepend partition ID to all debug messages in the Debug Console
  • Improved[HALO-10654] - System logs view should refresh if processing is done after initial import
  • Fixed[HALO-7067] - Locations-Maps: Status Bar is blank after selecting multiple items in the Content Pane
  • Fixed[HALO-8952] - Act Intel - Device Connections - Year is being appended to System log/Kernel log dates
  • Fixed[HALO-9007] - Report: Locations->Location Data does not honor Time Zone
  • Fixed[HALO-9346] - Do not allow user to import the same exact image into one BL case file
  • Fixed[HALO-9381] - Time Machine - Folder hard links are not being resolved
  • Fixed[HALO-9676] - File Content View - Hex: NOE when clicking in FCV pane if no item had been selected in the Content Pane
  • Fixed[HALO-9822] - Pausing and resuming a search can result in incorrect hit counts.
  • Fixed[HALO-9902] - Attempting to get contact pic fails with NOE on contacts with only a preview image
  • Fixed[HALO-9976] - Artifact Parser can miss PST/OST mail headers
  • Fixed[HALO-10012] - File Content View window: Cannot tag from torn off window
  • Fixed[HALO-10017] - Adding a (locked) mobile device causes BL to beachball and get stuck at pending with delayed warning message
  • Fixed[HALO-10075] - Exception when parsing Firefox downloads
  • Fixed[HALO-10122] - VMDK - No Partitions Detected error when adding a snapshot VMDK (*-flat.vmdk)
  • Fixed[HALO-10131] - VMDK - OOBE in debug when attempting to add a snapshot VMDK (*-flat.vmdk)
  • Fixed[HALO-10175] - Add Evidence - "All" Ingestion Options - red text is partially cut off
  • Fixed[HALO-10193] - Partition relations change after closing and reopening a casefile
  • Fixed[HALO-10210] - BlackLight User Interface stops responding during processing when user tries to calculate disk hash - Windows
  • Fixed[HALO-10212] - Android imports are creating multiple /apps/ folders during full collection
  • Fixed[HALO-10220] - File Content View - Preview: Pane doesn't update properly when user selects an email and enlarges Preview
  • Fixed[HALO-10226] - NOE when user right clicks in the Evidence window then clicks the Cancel button
  • Fixed[HALO-10231] - Report view: the bottom part of the Report view is greyed out after user tags an image
  • Fixed[HALO-10234] - Not detecting locked Lollipop and up devices
  • Fixed[HALO-10235] - Windows version reorders drive partitions on Reopening a case
  • Fixed[HALO-10239] - Artifact Parser - No $UsnJrnl data displayed updating 2016R1 case file
  • Fixed[HALO-10282] - 2016R2 Processing stuck on "Checkpointing wal file" during processing of Mac OS
  • Fixed[HALO-10285] - Artifact Parser incorrectly calculating offsets for USN records
  • Fixed[HALO-10287] - Communication-Favorites: data source changed from speeddial.plist to AddressBook.sqlitedb
  • Fixed[HALO-10320] - Hiberfil and Pagefile files are not automatically relocating when a case file is copied to another location
  • Fixed[HALO-10332] - Windows Only: PartitionNotFound occurs and hiberfil.sys fails to parse
  • Fixed[HALO-10333] - Search Results view: Lower Content Pane results disappear when pane is resized and when Context header is selected
  • Fixed[HALO-10337] - Actionable Intel-Program Execution-Jump Lists: Lnk file paths are displaying in the status bar instead of the correct source file
  • Fixed[HALO-10359] - Communication-Favorites - File displayed in Status Bar and FCV-Metadata is not the same file used for actions such as Reveal in File Browser and Copy Path
  • Fixed[HALO-10368] - Tag Container: Tagged images do not show the same hex as what is shown in Media view for the file
  • Fixed[HALO-10399] - Win 10AE Mem Dump-Carved Files Partition: Large amount of single byte CPIO files appear
  • Fixed[HALO-10402] - Details view: Extended Information is not consistent between USB import and iOS backup of iOS devices
  • Fixed[HALO-10404] - Carved Files fail on Win10AE mem dump from a Surface Pro
  • Fixed[HALO-10419] - VSCs not showing after case relocation and data missing from FCV
  • Fixed[HALO-10429] - Closing and reopening case with VSCs causes VSCs to be listed in Component List
  • Fixed[HALO-10436] - BL hangs when user attempts to reprocess memory file
  • Fixed[HALO-10454] - Normalizing Hangs on Win 10 VSC's
  • Fixed[HALO-10472] - Win only: Win 10 (non-AE) raw memory parsing fails
  • Fixed[HALO-10484] - ImportError when acquiring an iOS 10 device w/encrypted backups and a Profile that prevents disabling encryption
  • Fixed[HALO-10487] - Android devices fail to import and cause a stack overflow
  • Fixed[HALO-10495] - Add Evidence - Unlocked FV2 partition has no checkbox
  • Fixed[HALO-10505] - Internet:Cache view: KeyNotFoundException error when user selects the Cache view again
  • Fixed[HALO-10526] - Cannot import iPhone 7 or iPhone 6S Plus
  • Fixed[HALO-10551] - BlackLight reports different hash than MacQ Acquisition Log & FTK Imager
  • Fixed[HALO-10560] - 3TB E01 Best Compression - Calculate Disk Hash reports different hash than Acquisition Log
  • Fixed[HALO-10562] - Import appears to fail and start over for JB iPhone 5 BBTIPH015
  • Fixed[HALO-10566] - Add Evidence - BlackLight does not properly detect the partition layout of a 3TB NTFS disk (compressed E01)
  • Fixed[HALO-10580] - Details View: iPhone SE does not display an icon as expected
  • Fixed[HALO-10607] - Bad file paths for iOS imports
  • Fixed[HALO-10617] - Generic file system label for partitions not imported
  • Fixed[HALO-10621] - Normalization hangs and does not complete while normalizing Internet Logs
  • Fixed[HALO-10623] - System-System Logs view: Loading overlay does not go away until user click in the Content Pane
  • Fixed[HALO-10626] - Add Evidence view: Edited Evidence ID is not retained after import
  • Fixed[HALO-10628] - Missing “Delete Selected Tag Item…” from context menu
  • Fixed[HALO-10642] - Act Intel - Kernel log timestamps show UTC instead of UNKN and timestamps are adjusted by the image timezone
  • Fixed[HALO-10653] - “Cannot read file fork” warning and “Could not find file at path”, “Could not find file hash” errors in Debug Console
  • Fixed[HALO-10669] - Communication-Contacts view: Because of how we dedupe contacts, we are missing a valid contact
  • Fixed[HALO-10693] - Voicemails from iOS 10 are not recognized as a format that can be displayed
  • Fixed[HALO-10718] - Win Only: Could not find file hash for path occurs when user attempts to import iOS 10 backups