August 24th, 2018



Thank you for using BlackBag Technologies products.


The Release Notes for this version include important information about new features and improvements made to BlackLight. In addition, this document contains known limitations, supported versions and updated system requirements. While this information is complete at time of release, the information below is subject to change without notice and is provided for informational purposes only.




To enhance our forensic analysis tool, BlackLight 2018 R3 includes:


·      Comprehensive Report options

·      APFS Snapshots

·      Streamlined support for all GrayKey image formats

·      iOS Hidden Photos

·      Enhanced Windows 10 Memory Support       



Reporting Updates

Reporting is a critical step in an investigation and the latest release of BlackLight has been improved to include streamlined reporting options.  New to this release, is the ability to have a simple report with comprehensive reporting, on a per device basis, without having to review or tag items.  Users can choose to include all Case Data for the entire device, or select specific categories, within the evidence.  In addition, HTML reports are now broken down into smaller pages to make it easier to load onto systems.

APFS Snapshot parsing

Continuing with our leading APFS support, BlackLight now allows for parsing of APFS Snapshots.  APFS was designed using Snapshots as a means for built in backup support. Snapshots leverage the copy-on-write property of APFS to provide “instant” backups of the entire state of an APFS volume. Snapshots can be mounted as read-only volumes that are exact copies of the file system state at the time they were taken. To examine snapshots, simply choose the “Parse Snapshots / Volume Shadow Copies” option from the advanced processing options.

Streamlined support for all GrayKey image formats

GrayKey, by Grayshift, is designed to provide access to devices that were previously inaccessible.  In addition, GrayKey images include iOS data that was previously not available due to the limitations of iTunes backups. Using BlackLight as the analysis tool for GrayKey allows full filesystem analysis, memory file support and proper handling of dates, as recommended by the Grayshift.

BlackLight examiners can add GrayKey images either by dragging and dropping them onto a case on Mac, or choose the 'Add' evidence button. BlackLight will process the GrayKey zip file just as if it were processing an iOS backup, except with much more data. Whether adding the full system image or the backup image BlackLight can handle either one. Navigation through the GrayKey image will look the same as if it came straight from the device itself.

If the GrayKey memory file is added BlackLight will prompt the examiner how to handle it. The file can be brought in as a simple zip file so you can see the contents, or you can treat it as a file and run content searches to get evidentiary items like IP address, email addresses, etc.

Enhanced Windows 10 Memory Support

BlackLight now supports Windows 10 Spring Creator Update version 1803 for memory analysis.

iOS 8 hidden album support

Starting with iOS 8 a user could tap and hold on a picture in the Photos app to display the option to "Hide" the picture. The picture would then be placed into an album named "Hidden". While Blacklight would obtain these pictures during ingestion it would not be apparent that they were hidden by the user. Those pictures are now flagged as part of the Hidden album. In addition, they can be filtered on within the File Filter view.

Hash sets installer is now separate from the BlackLight installer

In order to streamline updates to the BlackLight distributed hash sets they are no longer included with BlackLight product installer. Instead they are now included in their own installer and may be updated as needed on the Software Download page.


Use of ExFAT for storage media is NOT recommended.

Due to issues with the Apple file system driver, use of exFAT formatted storage media may cause serious performance issues when using BlackLight.  We highly recommend that you DO NOT use exFAT for storage of your case or image files on macOS, and highly recommend the use of NTFS, HFS, or APFS for storage.



Expanding tree structure using hotkeys has changed

When expanding the tree structure using hotkeys, option-click (Mac) or alt-click (Windows), has been modified.  Previously, on views like the browser view, using the hotkey would open the whole tree structure, now it will just only expand the top two levels.






Attached Disk are now able to be properly added


Adding specific multiple iTunes backup files into the same case showed incorrect path information


Issues when installing BlackLight on a drive other than the C drive have been resolved


Report view: APFS volumes now display disk data that was previous missing


Calculating MD5 hash value of an attached source drive does not match other tools


BlackLight Windows Installer - Unchecking the BBT PostgreSQL box no longer causes error during install


Improved Report Generation to render reports with tens of thousands of tagged images


Improved report generation to handle issue when generating a very large report


On specific APFS FV2 images, BlackLight now accepts password for double recovery key disk


BlackLight now properly opens a restored case with an iTunes backup


MacOutlookNormalizer processing time has been improved


MacOutlookNormalizer now shows a total execution time


MailAttachmentNormalizer now normalize specific attachments it was previously missing


The Media - Thumbnail overlay position is now properly accessed beneath the thumbnail icon


Search results are now displaying properly when a case file is upgraded


Report - Shellbags - Date Created/Accessed/Modified now time zone offset and are properly adjusted for chosen case time


Report - Messages - Table view no longer cuts off after a certain length


Now displaying missing device information when importing data from a Samsung Galaxy S5


Disk View-Disk Structure data now shows properly in report


SQLite - Export to CSV/TSV now exports the proper content and not just the column headers


When exporting selected files from BlackLight on Windows the export log now displays the proper time information


Component List: Carved Files partition now maintain their order when the case is closed and reopened


Specific RTF files that were not rendered now display correctly


Views with a DatabaseListbox can now activate the QuickLook using the spacebar








Mac OS X 10.11.4 or newer*‡

Windows® 7 or newer

Windows® Server 2016 or newer


BlackLight runs on Intel® based systems only
BlackLight requires the following additional software:
• iTunes 12.6 or higher
• QuickTime 7.6.9 or higher for Mac

• Windows Media Player 12 for Windows


• Mac OS X El Capitan (10.11.4) or Windows 7
• 2.7 GHz Intel Dual Core i7
• 16 GB DDR3
• 5GB of Disk Space (Installation)

• 25GB of Disk Space (Temp Space)
• 1024 x 768 or higher screen resolution


• MacOS Sierra (10.12.6) or Windows 10
• Intel Xeon E5, 6-Core, or better
• 32 GB DDR3 or higher
• 5GB of Disk Space (Installation)

• 25GB of Disk Space (Temp Space)
• 1680 x 1050 or higher screen resolution


‡ We recommend strongly against using macOS versions .0 and .1 in all cases.  For example (10.13.0 or 10.13.1)

**For Windows systems, BlackLight uses whatever the default app may be for playing media files. Windows Media Player 12 is recommended. If Windows examiners do not have QuickTime installed and they wish to play certain file types such as .AMR files (voicemail, etc.) they will need to install some non-default codecs, following the instructions found here:

For information about downloading iTunes and QuickTime, please visit




The BlackLight® macOS installer is delivered as a package file (.pkg) while the Windows installer is delivered as a setup executable. 

In addition to the BlackLight installers, installers for offline maps, operating system hash sets, and memory symbols will need to be installed in order for BlackLight to take advantage of those.  All installers can be found on the BlackBag software downloads page here:





·       iPhone 3G and newer with iOS 4.0 to 11.4.1

·       All iPads with iOS 4.0 to 11.4.1

·       iPod Touch 2G and newer with iOS 4.0 to 11.4.1



·       Devices running Android 4.0.4 to 8.1

·       Devices manufactured by: Samsung, Motorola, HTC, LG, Google Nexus

Note*: Additional devices running Android 4.0 or later may function properly if the appropriate USB driver for Windows OS is installed




If you need support, we are here to help.


Please use the form at to submit your request for support and someone for our technical support will respond.




As we grow and perfect new features and functionality within our products, we need you to continue to provide the insightful feedback that has allowed us to develop the tool we are proud to offer today. If you would like to submit feedback or suggestions, please contact us through our product feedback form. Through your feedback, we can continue to provide investigators with the solutions they need to solve the critical issues they face every day.