July 17th, 2018



Thank you for using BlackBag Technologies products.


The Release Notes for this version include important information about new features and improvements made to BlackLight. In addition, this document contains supported versions and system requirements. While this information is complete at time of release, the information below is subject to change without notice and is provided for informational purposes only.




To enhance our forensic analysis tool, BlackLight 2018 R2 includes:


·      Viewing and Filtering Across Multiple Devices

·      Spotlight Index Parsing   

·      Report View Email Improvements

·      Improved displaying of NTFS ACL information

·      Time zone improvements           



Viewing and filtering across multiple devices

BlackLight now supports viewing data from multiple devices at the same time without having to change selected devices. Each evidence item is associated with a colored badge number.

In order to see any data from a specific item within any BlackLight view, the checkbox next to the desired volume needs to be selected. If the checkbox is not selected that particular item will not appear in any view.

Likewise, the 'File Filter' view will show the numbered badge in the first column for each responsive item. Every view within BlackLight will work this same way.

Spotlight Index Parsing

BlackLight now gives you the ability to parse macOS Spotlight indexes. Spotlight is a system- wide search feature of macOS and the iOS operating systems. It was designed to allow the user to quickly locate a wide variety of items on the computer, including documents, pictures, music, applications, and System Preferences.

Under the 'Advanced Options' in the 'Add Evidence' Window or within the 'Evidence Status' Window the 'Spotlight Parsing' option can be selected to run.

The Spotlight index items can be located within the 'Metadata' tab of the 'File Content Viewer' for any item in a macOS or iOS volume. All of the items will exist under the Spotlight heading within the metadata.

In addition to the 'Metadata' view for Spotlight indexes these pieces of information can be filtered on within the 'Filter' view.

Report View Email Improvements

BlackLight has supported various types of email parsing but has been improved for better support of Apples EMLX EMLX Partials. EMLX is a Mail Message (Apple Mail Email) file used to store an email message. These are plain text files that store just a single email message. EMLXPART files are used by Apple Mail as well, but as attachment files instead of as the actual email files. The emails will show the typical context instead of the header information and the attachments will be automatically included.

IMPORTANT NOTE: In order to render the attachments in the report a preference option must be enabled. It is off by default as it can slow down the report generation for very large reports.

When the report is generated the email can be seen as well as previewed by clicking on the Preview link. This will show the email as the user saw it. Any attachments can also be seen in the preview of the report as well as the attachment link.

NTFS ACL integrated into the UI

File system permissions in NTFS are controlled with Access Control Lists (ACL). Each user logged onto the system holds an access token with security information for that logon session. The system creates an access token when the user logs on. Every process executed on behalf of the user has a copy of the access token. The token identifies the user, the user's groups, and the user's privileges. A token also contains a logon SID (Security Identifier) that identifies the current logon session. This information is now displayed for NTFS files and folders.

Auto-adjust for Daylight Savings Time

BlackLight has always allowed timezones to be changed case wide, however it never accounted for time shifts for places that observe daylight savings time. Having to manually adjust times plus or minus hours and even minutes can be laborious and error prone. BlackLight now recognizes daylight savings time shifts for different parts of the world. Change the case time zone display to the desired time zone, which is now based on the zoneinfo database, in the 'Case Info' view. and all dates and times will automatically be adjusted accordingly.

Support new date Cocoa/nanosecond timestamp format

From time to time Apple changes storage formats for certain things. The new format for timestamps on iOS 11 and macOS 10.13 (High Sierra) changed from 9 digits to 18 digits for some date columns. BlackLight will now support these longer nanosecond timestamps when they are encountered.






PhotoDNA sets that previous were not handled properly now complete importing and processing


Certain time machine backup files that could not be parsed are now properly processed


BlackLight now support Unlocking APFS FV2 with a password that starts with a space


Improved support for emlx files on APFS volumes


HTML report with items from FAT volumes now display properly on Windows machines


Certain APFS volumes that previously would not complete processing now finish


LINE Incoming Calls are now properly displayed


Content Search with an ' (apostrophe) in search name no longer return no results


File Filter now properly filters for Tagged State (Tagged Files) and Metadata Fields together


Processed hash sets are now properly listed in the File Filter dropdown


When using the File Filter, the 'Tagged' Icon is now displayed properly on items where it was missing


Improved Hash Set Exporter to better handle recovered deleted files/folders


Improved WhatsApp parsing to support version 2.17.52 messages and contacts


Outlook 2016 for Mac emails now properly display


Users can now tag all data in Top Contacts or Favorites


Improved parsing Recycle Bin files from an external NTFS drive's recycle bin


File Filter and View filter now honor selected time zone


Improved display of recovered records in SQLite Preview for Snapchat


Report for Internet History "Visit Count" now displays the number instead of True


User can now properly apply multiple sorts in the Audio view










Mac OS X El Capitan (10.11) or higher / Windows 7 or higher


BlackLight runs on Intel® based systems only
BlackLight requires the following additional software:
• iTunes 12.6 or higher
• QuickTime 7.6.9 or higher for Mac, and Windows Media Player 12 for Windows


• Mac OS X El Capitan (10.11) or Windows 7
• 2.6 GHz Intel Dual Core i5
• 8 GB 1067 MHz DDR3
• 5GB of Disk Space (installation only)
• 1024 x 768 or higher screen resolution


• MacOS Sierra (10.12.5) or Windows 10
• 3.1 GHz 6-Core Intel Xeon E5 or better
• 16 GB 1866 MHz DDR3
• 5GB of Disk Space (installation only)
• 1680 x 1050 or higher screen resolution

*Note: For Windows systems, BlackLight uses whatever the default app may be for playing media files. Windows Media Player 12 is recommended. If Windows examiners do not have QuickTime installed and they wish to play certain file types such as .AMR files (voicemail, etc.) they will need to install some non-default codecs, following the instructions found here:





·       iPhone 3G and newer with iOS 4.0 to 11.2

·       All iPads with iOS 4.0 to 11.2

·       iPod Touch 2G and newer with iOS 4.0 to 11.2



·       Devices running Android 4.0.4 to 8.0

·       Devices manufactured by: Samsung, Motorola, HTC, LG, Google Nexus

·       Note*: Additional devices running Android 4.0 or later may function properly if the appropriate USB driver for Windows OS is installed




If you need support, we are here to help.


Please use the form at to submit your request for support and someone for our technical support will respond.