BLACKLIGHT 2018 R1
FEBRUARY 13TH, 2018
Thank you for using BlackBag Technologies products.
The Release Notes for this version include important information about new features and improvements made to BlackLight. In addition, this document contains supported versions and system requirements. While this information is complete at time of release, the information below is subject to change without notice and is provided for informational purposes only.
To enhance our multi-platform forensic analysis tool, BlackLight 2018 R1 includes:
· APFS support
· Beta support for latest versions of the following mobile applications:
o Facebook Messenger
The High Sierra release of macOS 10.13 introduced the Apple File System (APFS), which replaced HFS+ as the default file system used by Apple. APFS is much different than HFS+. APFS no longer defines a volume, rather it implements a container inside of which, several volumes may be present. APFS was designed for solid state drives (SSDs) but can work with traditional drives as well.
Because APFS volumes within a container are not traditional partitions, these volumes cannot be individually imaged. As a result, imaging the unlocked state of an encrypted APFS partition is not possible. When an APFS volume is unlocked with a password or recovery key, the unlocked volume is available for data collection (logical copy of files from the volume). When imaging the APFS Container or the parent physical disk, the resulting image will contain the volume in its encrypted state, rather than the unlocked state. MacQuisition 2018 R1 supports imaging both the logical copies of unencrypted volumes and the encrypted physical disk.
On macOS 10.13.0 (and higher) while System Integrity Protection (SIP) is active, no user, even root, can read the physical disk the system is currently booted from, the physical partition the system is currently booted from, nor the APFS container that holds the currently booted volume. This makes it impossible to image the physical disk.
Adding APFS Evidence to BlackLight 2018 R1
APFS is very different than any other file system, therefore it will appear differently than what has traditionally been seen. Specifically, the APFS container uses pooled storage which is available to all volumes within it including unallocated space. BlackLight will present the APFS pooled container highlighted with a grey box around the pooled volumes. The other volumes will appear normally. If a volume is encrypted, it will not be selected by default and will display text indicating its encrypted status.
Once the checkbox next to an encrypted volume within the APFS container is selected, a password prompt will be displayed along with a password hint if one is available. Provide the known correct password or recovery key to unlock the volume. NOTE: To use a recovery key, please enter the key in all caps, including dashes in the password prompt.
If the password or key is correct, the volume will be selected otherwise BlackLight will prompt to re-enter the correct password. All other processing options will function the same as previous versions of BlackLight with one exception: File Carving.
Because APFS uses pooled storage, you cannot carve deleted files from volumes located inside of containers. With APFS, you can only carve from the pooled storage which means that you must choose to carve the unallocated space from the Add Evidence ingestion options window. Volumes NOT within the pooled storage will behave as previous versions of BlackLight and can be carved at any point.
Once the APFS image is ingested, data within BlackLight will appear as it has with previous versions.
Mobile Application Updates
Many 3rd party applications have changed and continue to change regularly. BlackLight 2018 R1 has been updated to include new parsers for the following applications:
· Line is an app for exchanging texts, images, video and audio.
· WeChat is a Chinese multi-purpose social media mobile application.
· Facebook Messenger is an instant messaging service and software application. Originally called Facebook Chat, the app service was changed to a standalone iOS and Android app.
· WhatsApp is an instant messaging and Voice over IP service. The application allows the sending of text messages and voice calls, as well as video calls, images and other media.
NOTE: These parsers are currently supported as beta features.
BlackLight processes specific FAT32 image where parsing previously did not complete
OPERATING SYSTEM SPECIFICATION
Mac OS X El Capitan (10.11) or higher / Windows 7 or higher
BlackLight runs on Intel® based systems only
• Mac OS X El Capitan (10.11) or Windows 7
• MacOS Sierra (10.12.5) or Windows 10
*Note: For Windows systems, BlackLight uses whatever the default app may be for playing media files. Windows Media Player 12 is recommended. If Windows examiners do not have QuickTime installed and they wish to play certain file types such as .AMR files (voicemail, etc.) they will need to install some non-default codecs, following the instructions found here: http://shark007.net/win8codecs.html
· iPhone 3G and newer with iOS 4.0 to 11.2
· All iPads with iOS 4.0 to 11.2
· iPod Touch 2G and newer with iOS 4.0 to 11.2
· Devices running Android 4.0.4 to 8.0
· Devices manufactured by: Samsung, Motorola, HTC, LG, Google Nexus
· Note*: Additional devices running Android 4.0 or later may function properly if the appropriate USB driver for Windows OS is installed
If you need support, we are here to help.
Please use the form at https://www.blackbagtech.com/support.html to submit your request for support and someone for our technical support will respond.