BLACKLIGHT 2018 R2

RELEASE NOTES

July 17th, 2018

 

 

Thank you for using BlackBag Technologies products.

 

The Release Notes for this version include important information about new features and improvements made to BlackLight. In addition, this document contains supported versions and system requirements. While this information is complete at time of release, the information below is subject to change without notice and is provided for informational purposes only.

 

SUMMARY

 

To enhance our forensic analysis tool, BlackLight 2018 R2 includes:

 

·      Viewing and Filtering Across Multiple Devices

·      Spotlight Index Parsing   

·      Report View Email Improvements

·      Improved displaying of NTFS ACL information

·      Time zone improvements           

 

NEW FEATURES

Viewing and filtering across multiple devices

BlackLight now supports viewing data from multiple devices at the same time without having to change selected devices. Each evidence item is associated with a colored badge number.

In order to see any data from a specific item within any BlackLight view, the checkbox next to the desired volume needs to be selected. If the checkbox is not selected that particular item will not appear in any view.

Likewise, the 'File Filter' view will show the numbered badge in the first column for each responsive item. Every view within BlackLight will work this same way.

Spotlight Index Parsing

BlackLight now gives you the ability to parse macOS Spotlight indexes. Spotlight is a system- wide search feature of macOS and the iOS operating systems. It was designed to allow the user to quickly locate a wide variety of items on the computer, including documents, pictures, music, applications, and System Preferences.

Under the 'Advanced Options' in the 'Add Evidence' Window or within the 'Evidence Status' Window the 'Spotlight Parsing' option can be selected to run.

The Spotlight index items can be located within the 'Metadata' tab of the 'File Content Viewer' for any item in a macOS or iOS volume. All of the items will exist under the Spotlight heading within the metadata.

In addition to the 'Metadata' view for Spotlight indexes these pieces of information can be filtered on within the 'Filter' view.

Report View Email Improvements

BlackLight has supported various types of email parsing but has been improved for better support of Apples EMLX EMLX Partials. EMLX is a Mail Message (Apple Mail Email) file used to store an email message. These are plain text files that store just a single email message. EMLXPART files are used by Apple Mail as well, but as attachment files instead of as the actual email files. The emails will show the typical context instead of the header information and the attachments will be automatically included.

IMPORTANT NOTE: In order to render the attachments in the report a preference option must be enabled. It is off by default as it can slow down the report generation for very large reports.

When the report is generated the email can be seen as well as previewed by clicking on the Preview link. This will show the email as the user saw it. Any attachments can also be seen in the preview of the report as well as the attachment link.

NTFS ACL integrated into the UI

File system permissions in NTFS are controlled with Access Control Lists (ACL). Each user logged onto the system holds an access token with security information for that logon session. The system creates an access token when the user logs on. Every process executed on behalf of the user has a copy of the access token. The token identifies the user, the user's groups, and the user's privileges. A token also contains a logon SID (Security Identifier) that identifies the current logon session. This information is now displayed for NTFS files and folders.

Auto-adjust for Daylight Savings Time

BlackLight has always allowed timezones to be changed case wide, however it never accounted for time shifts for places that observe daylight savings time. Having to manually adjust times plus or minus hours and even minutes can be laborious and error prone. BlackLight now recognizes daylight savings time shifts for different parts of the world. Change the case time zone display to the desired time zone, which is now based on the zoneinfo database, in the 'Case Info' view. and all dates and times will automatically be adjusted accordingly.

Support new date Cocoa/nanosecond timestamp format

From time to time Apple changes storage formats for certain things. The new format for timestamps on iOS 11 and macOS 10.13 (High Sierra) changed from 9 digits to 18 digits for some date columns. BlackLight will now support these longer nanosecond timestamps when they are encountered.

 

 

RESOLVED ISSUES

 

BL-13324

PhotoDNA sets that previous were not handled properly now complete importing and processing

BL-13184

Certain time machine backup files that could not be parsed are now properly processed

BL-13172

BlackLight now support Unlocking APFS FV2 with a password that starts with a space

BL-13168

Improved support for emlx files on APFS volumes

BL-13012

HTML report with items from FAT volumes now display properly on Windows machines

BL-12993

Certain APFS volumes that previously would not complete processing now finish

BL-12992

LINE Incoming Calls are now properly displayed

BL-12919

Content Search with an ' (apostrophe) in search name no longer return no results

BL-12853

File Filter now properly filters for Tagged State (Tagged Files) and Metadata Fields together

BL-12656

Processed hash sets are now properly listed in the File Filter dropdown

BL-12652

When using the File Filter, the 'Tagged' Icon is now displayed properly on items where it was missing

BL-12592

Improved Hash Set Exporter to better handle recovered deleted files/folders

BL-12531

Improved WhatsApp parsing to support version 2.17.52 messages and contacts

BL-12270

Outlook 2016 for Mac emails now properly display

BL-12168

Users can now tag all data in Top Contacts or Favorites

BL-11554

Improved parsing Recycle Bin files from an external NTFS drive's recycle bin

BL-11049

File Filter and View filter now honor selected time zone

BL-10963

Improved display of recovered records in SQLite Preview for Snapchat

BL-10233

Report for Internet History "Visit Count" now displays the number instead of True

BL-10035

User can now properly apply multiple sorts in the Audio view

 

 

 

 

 

 

SYSTEM REQUIREMENTS

 

OPERATING SYSTEM SPECIFICATION

Mac OS X El Capitan (10.11) or higher / Windows 7 or higher

COMPATIBILITY

BlackLight runs on Intel® based systems only
BlackLight requires the following additional software:
• iTunes 12.6 or higher
• QuickTime 7.6.9 or higher for Mac, and Windows Media Player 12 for Windows

MINIMUM REQUIREMENTS

• Mac OS X El Capitan (10.11) or Windows 7
• 2.6 GHz Intel Dual Core i5
• 8 GB 1067 MHz DDR3
• 5GB of Disk Space (installation only)
• 1024 x 768 or higher screen resolution

OPTIMUM REQUIREMENTS

• MacOS Sierra (10.12.5) or Windows 10
• 3.1 GHz 6-Core Intel Xeon E5 or better
• 16 GB 1866 MHz DDR3
• 5GB of Disk Space (installation only)
• 1680 x 1050 or higher screen resolution


*Note: For Windows systems, BlackLight uses whatever the default app may be for playing media files. Windows Media Player 12 is recommended. If Windows examiners do not have QuickTime installed and they wish to play certain file types such as .AMR files (voicemail, etc.) they will need to install some non-default codecs, following the instructions found here: http://shark007.net/win8codecs.html

 

SUPPORTED DEVICES

 

IOS

·       iPhone 3G and newer with iOS 4.0 to 11.2

·       All iPads with iOS 4.0 to 11.2

·       iPod Touch 2G and newer with iOS 4.0 to 11.2

 

ANDROID

·       Devices running Android 4.0.4 to 8.0

·       Devices manufactured by: Samsung, Motorola, HTC, LG, Google Nexus

·       Note*: Additional devices running Android 4.0 or later may function properly if the appropriate USB driver for Windows OS is installed

 

SUPPORT   

 

If you need support, we are here to help.

 

Please use the form at https://www.blackbagtech.com/support.html to submit your request for support and someone for our technical support will respond.