BLACKLIGHT 2018 R3

RELEASE NOTES

August 24th, 2018

 

 

Thank you for using BlackBag Technologies products.

 

The Release Notes for this version include important information about new features and improvements made to BlackLight. In addition, this document contains known limitations, supported versions and updated system requirements. While this information is complete at time of release, the information below is subject to change without notice and is provided for informational purposes only.

 

SUMMARY

 

To enhance our forensic analysis tool, BlackLight 2018 R3 includes:

 

·      Comprehensive Report options

·      APFS Snapshots

·      Streamlined support for all GrayKey image formats

·      iOS Hidden Photos

·      Enhanced Windows 10 Memory Support       

 

NEW FEATURES

Reporting Updates

Reporting is a critical step in an investigation and the latest release of BlackLight has been improved to include streamlined reporting options.  New to this release, is the ability to have a simple report with comprehensive reporting, on a per device basis, without having to review or tag items.  Users can choose to include all Case Data for the entire device, or select specific categories, within the evidence.  In addition, HTML reports are now broken down into smaller pages to make it easier to load onto systems.

APFS Snapshot parsing

Continuing with our leading APFS support, BlackLight now allows for parsing of APFS Snapshots.  APFS was designed using Snapshots as a means for built in backup support. Snapshots leverage the copy-on-write property of APFS to provide “instant” backups of the entire state of an APFS volume. Snapshots can be mounted as read-only volumes that are exact copies of the file system state at the time they were taken. To examine snapshots, simply choose the “Parse Snapshots / Volume Shadow Copies” option from the advanced processing options.

Streamlined support for all GrayKey image formats

GrayKey, by Grayshift, is designed to provide access to devices that were previously inaccessible.  In addition, GrayKey images include iOS data that was previously not available due to the limitations of iTunes backups. Using BlackLight as the analysis tool for GrayKey allows full filesystem analysis, memory file support and proper handling of dates, as recommended by the Grayshift.

BlackLight examiners can add GrayKey images either by dragging and dropping them onto a case on Mac, or choose the 'Add' evidence button. BlackLight will process the GrayKey zip file just as if it were processing an iOS backup, except with much more data. Whether adding the full system image or the backup image BlackLight can handle either one. Navigation through the GrayKey image will look the same as if it came straight from the device itself.

If the GrayKey memory file is added BlackLight will prompt the examiner how to handle it. The file can be brought in as a simple zip file so you can see the contents, or you can treat it as a file and run content searches to get evidentiary items like IP address, email addresses, etc.

Enhanced Windows 10 Memory Support

BlackLight now supports Windows 10 Spring Creator Update version 1803 for memory analysis.

iOS 8 hidden album support

Starting with iOS 8 a user could tap and hold on a picture in the Photos app to display the option to "Hide" the picture. The picture would then be placed into an album named "Hidden". While Blacklight would obtain these pictures during ingestion it would not be apparent that they were hidden by the user. Those pictures are now flagged as part of the Hidden album. In addition, they can be filtered on within the File Filter view.

Hash sets installer is now separate from the BlackLight installer

In order to streamline updates to the BlackLight distributed hash sets they are no longer included with BlackLight product installer. Instead they are now included in their own installer and may be updated as needed on the Software Download page.

KNOWN LIMITATIONS

Use of ExFAT for storage media is NOT recommended.

Due to issues with the Apple file system driver, use of exFAT formatted storage media may cause serious performance issues when using BlackLight.  We highly recommend that you DO NOT use exFAT for storage of your case or image files on macOS, and highly recommend the use of NTFS, HFS, or APFS for storage.

 

BEHAVIOR CHANGES

Expanding tree structure using hotkeys has changed

When expanding the tree structure using hotkeys, option-click (Mac) or alt-click (Windows), has been modified.  Previously, on views like the browser view, using the hotkey would open the whole tree structure, now it will just only expand the top two levels.

 

 

RESOLVED ISSUES

 

BL-13568

Attached Disk are now able to be properly added

BL-13541

Adding specific multiple iTunes backup files into the same case showed incorrect path information

BL-13403

Issues when installing BlackLight on a drive other than the C drive have been resolved

BL-12843

Report view: APFS volumes now display disk data that was previous missing

BL-13654

Calculating MD5 hash value of an attached source drive does not match other tools

BL-13420

BlackLight Windows Installer - Unchecking the BBT PostgreSQL box no longer causes error during install

BL-13205

Improved Report Generation to render reports with tens of thousands of tagged images

BL-8347

Improved report generation to handle issue when generating a very large report

BL-13127

On specific APFS FV2 images, BlackLight now accepts password for double recovery key disk

BL-13624

BlackLight now properly opens a restored case with an iTunes backup

BL-13519

MacOutlookNormalizer processing time has been improved

BL-13518

MacOutlookNormalizer now shows a total execution time

BL-13517

MailAttachmentNormalizer now normalize specific attachments it was previously missing

BL-13478

The Media - Thumbnail overlay position is now properly accessed beneath the thumbnail icon

BL-13454

Search results are now displaying properly when a case file is upgraded

BL-13432

Report - Shellbags - Date Created/Accessed/Modified now time zone offset and are properly adjusted for chosen case time

BL-13410

Report - Messages - Table view no longer cuts off after a certain length

BL-13333

Now displaying missing device information when importing data from a Samsung Galaxy S5

BL-13273

Disk View-Disk Structure data now shows properly in report

BL-13271

SQLite - Export to CSV/TSV now exports the proper content and not just the column headers

BL-12528

When exporting selected files from BlackLight on Windows the export log now displays the proper time information

BL-12433

Component List: Carved Files partition now maintain their order when the case is closed and reopened

BL-11907

Specific RTF files that were not rendered now display correctly

BL-13666

Views with a DatabaseListbox can now activate the QuickLook using the spacebar

 

 

 


 

SYSTEM REQUIREMENTS

 

OPERATING SYSTEM SPECIFICATION


Mac OS X 10.11.4 or newer*‡

Windows® 7 or newer

Windows® Server 2016 or newer

COMPATIBILITY

BlackLight runs on Intel® based systems only
BlackLight requires the following additional software:
• iTunes 12.6 or higher
• QuickTime 7.6.9 or higher for Mac

• Windows Media Player 12 for Windows

MINIMUM REQUIREMENTS

• Mac OS X El Capitan (10.11.4) or Windows 7
• 2.7 GHz Intel Dual Core i7
• 16 GB DDR3
• 5GB of Disk Space (Installation)

• 25GB of Disk Space (Temp Space)
• 1024 x 768 or higher screen resolution

OPTIMUM REQUIREMENTS

• MacOS Sierra (10.12.6) or Windows 10
• Intel Xeon E5, 6-Core, or better
• 32 GB DDR3 or higher
• 5GB of Disk Space (Installation)

• 25GB of Disk Space (Temp Space)
• 1680 x 1050 or higher screen resolution

 

‡ We recommend strongly against using macOS versions .0 and .1 in all cases.  For example (10.13.0 or 10.13.1)

**For Windows systems, BlackLight uses whatever the default app may be for playing media files. Windows Media Player 12 is recommended. If Windows examiners do not have QuickTime installed and they wish to play certain file types such as .AMR files (voicemail, etc.) they will need to install some non-default codecs, following the instructions found here: http://shark007.net/win8codecs.html.

For information about downloading iTunes and QuickTime, please visit http://www.apple.com/quicktime/download/

 

SOFTWARE DOWNLOADS

 

The BlackLight® macOS installer is delivered as a package file (.pkg) while the Windows installer is delivered as a setup executable. 

In addition to the BlackLight installers, installers for offline maps, operating system hash sets, and memory symbols will need to be installed in order for BlackLight to take advantage of those.  All installers can be found on the BlackBag software downloads page here: https://www.blackbagtech.com/resources/software-downloads.html

 

SUPPORTED DEVICES

 

IOS

·       iPhone 3G and newer with iOS 4.0 to 11.4.1

·       All iPads with iOS 4.0 to 11.4.1

·       iPod Touch 2G and newer with iOS 4.0 to 11.4.1

 

ANDROID

·       Devices running Android 4.0.4 to 8.1

·       Devices manufactured by: Samsung, Motorola, HTC, LG, Google Nexus

Note*: Additional devices running Android 4.0 or later may function properly if the appropriate USB driver for Windows OS is installed

 

SUPPORT   

 

If you need support, we are here to help.

 

Please use the form at https://www.blackbagtech.com/support.html to submit your request for support and someone for our technical support will respond.

 

FEEDBACK REQUESTS

 

As we grow and perfect new features and functionality within our products, we need you to continue to provide the insightful feedback that has allowed us to develop the tool we are proud to offer today. If you would like to submit feedback or suggestions, please contact us through our product feedback form. Through your feedback, we can continue to provide investigators with the solutions they need to solve the critical issues they face every day.