BLACKLIGHT 2017 R1.1

RELEASE NOTES

JANUARY 8TH, 2018

 

 

Thank you for using BlackBag Technologies products.

 

The Release Notes for this version include important information about new features and improvements made to BlackLight. In addition, this document contains supported versions and system requirements. While this information is complete at time of release, the information below is subject to change without notice and is provided for informational purposes only.

 

SUMMARY

 

To enhance our multi-platform forensic analysis tool, BlackLight 2017 R1.1 includes:

 

·      Added new High Sierra FSEventsinode’ reference number to ‘System Logs’ view

·      Support for Windows 10 Fall Creators Update (Version 1709) memory images

·      Enhanced Volume Shadow Copy (VSC) display

·      EWMounter support for Mac OS 10.13 and the ability to mount images with a 4096 block size


 

NEW FEATURES

 

UPDATED PARSING FOR FSEVENT FILES

 

BlackLight 2017 R1.1 can now parse out the unique identifier, or ‘inode’ number, for the item that the FSEvent record refers to, which is present in High Sierra (10.13). By adding this reference number identification field, examiners can track a file or folder through moves and name changes. A new ‘inode’ column is displayed in the ‘System’ category ‘System Logs’ view and the examiner can sort, hide/show and filter on this column. In addition, the ‘inode’ number is listed in the Tag container and displayed in the report for tagged FSEvents items when generated by users.

 

WINDOWS 10 FALL CREATORS UPDATE

 

Here at BlackBag, supporting our customers in the field with the ongoing challenge of new operating systems and updates to versions is a top priority. BlackLight 2017 R1.1 supports the Windows 10 Fall Creators Update and ensures that the significant changes to this new version of Windows do not affect our customers’ ability to process memory images from this operating system.

 

IMPROVED VOLUME SHADOW COPY (VSC) DISPLAY

 

BlackLight 2017 R1.1 provides an improved Volume Shadow Copy display. The enhanced display allows an examiner the ability to identify the file history more easily.

 

If the examiner chooses to process Volume Shadow Copies, a new top level aggregate partition is displayed in BlackLight 2017 R1.1 under Evidence. This can be expanded to show or hide the individual volume shadow copies. When the top-level ‘Active & VSCs’ partition is selected, all active files and all processed VSC files can be examined. Alternatively, an examiner could select just the active files partition to show only the active (current) files, or select an individual Volume Shadow Copy to show only the files for that specific VSC instance.

 

 

EWMOUNTER ADDITIONAL DRIVE SUPPORT

 

To assist with examining Apple’s new file system (APFS), EWMounter v1.9 (included with BlackLight 2017 R1.1 Mac version) is supported on High Sierra 10.13 with enhanced features. EWMounter v1.9 allows examiners to select the appropriate block sizes, which includes mounting images with a 4096 block size from newer Mac computers on High Sierra. EWMounter v1.9 can also assist with mounting images for unlocking FileVault 2 and merging Fusion drives.

 

RESOLVED ISSUES

 

BL-12476

Large sparse images, 2TB or larger, are now properly detected

BL-12479

Previously misidentified Windows partition types are now properly displayed and processed

BL-10620

iOS devices with MDM Forced Encryption profiles are now acquired successfully

BL-12490

BlackLight now contains the missing symbols to support ingesting additional hiberfil files

BL-12288

Carving now complete on an image that displayed a "driver: bad connection" error

BL-12444

Carving now complete on an image that previously timed out

BL-12515

During restoration of case files, BlackLight now properly restores the pagefile.sys

BL-12492

Larger sparse images now display file content that wasn’t displayed previously

BL-12543

Images that were stuck on normalization during processing now finish

BL-12591

Complex criteria filters that included hashing complete in the expected time

BL-12315

iOS 11 devices w/ MDM forced encrypted backups displaying an error code 22 now completes

BL-12558

Issue during processing that caused specific image not to complete has been resolved

BL-12540

Issue during processing that caused specific image not to complete has been resolved

BL-12507

Issue during processing that caused specific image not to complete has been resolved

BL-12494

Issue during processing that caused specific image not to complete has been resolved

BL-12491

Issue during processing that caused specific image not to complete has been resolved

BL-12568

The Brower View no longer resets to root when users select a different view

BL-10729

The dongle required prompt no longer erroneously displays after mount/unmount events

BL-12594

The File Size filter in the media view now returns the correct results

BL-12628

Timestamps that were stored in 18 digit dates are now displayed properly for iOS 11 devices

BL-12555

Users are now able to save the report to locations with special characters without error

BL-12569

Users are now able to view specific Volume Shadow Copies that were reporting errors

BL-12658

Visible and Hidden metadata fields that were in conflict are now correctly displayed

BL-12516

When restoring case files the content searches are now properly retained

 

SYSTEM REQUIREMENTS

 

OPERATING SYSTEM SPECIFICATION

Mac OS X El Capitan (10.11) or higher / Windows 7 or higher

COMPATIBILITY

BlackLight runs on Intel® based systems only
BlackLight requires the following additional software:
• iTunes 12.6 or higher
• QuickTime 7.6.9 or higher for Mac, and Windows Media Player 12 for Windows

MINIMUM REQUIREMENTS

• Mac OS X El Capitan (10.11) or Windows 7
• 2.6 GHz Intel Dual Core i5
• 8 GB 1067 MHz DDR3
• 5GB of Disk Space (installation only)
• 1024 x 768 or higher screen resolution

OPTIMUM REQUIREMENTS

MacOS Sierra (10.12.5) or Windows 10
• 3.1 GHz 6-Core Intel Xeon E5 or better
• 16 GB 1866 MHz DDR3
• 5GB of Disk Space (installation only)
• 1680 x 1050 or higher screen resolution


*Note: For Windows systems, BlackLight uses whatever the default app may be for playing media files. Windows Media Player 12 is recommended. If Windows examiners do not have QuickTime installed and they wish to play certain file types such as .AMR files (voicemail, etc.) they will need to install some non-default codecs, following the instructions found here: 
http://shark007.net/win8codecs.html

 

 


 

SUPPORTED DEVICES

 

IOS

·       iPhone 3G and newer with iOS 4.0 to 11.2

·       All iPads with iOS 4.0 to 11.2

·       iPod Touch 2G and newer with iOS 4.0 to 11.2



ANDROID

·       Devices running Android 4.0.4 to 8.0

·       Devices manufactured by: Samsung, Motorola, HTC, LG, Google Nexus

·       Note*: Additional devices running Android 4.0 or later may function properly if the appropriate USB driver for Windows OS is installed

 

 

SUPPORT   

 

If you need support, we are here to help.

 

Please use the form at https://www.blackbagtech.com/support.html to submit your request for support and someone for our technical support will respond.