December 28th, 2018



Thank you for using BlackBag Technologies products.


The Release Notes for this version include important information about new features and improvements made to BlackLight. In addition, this document contains known limitations, supported versions and updated system requirements. While this information is complete at time of release, the information below is subject to change without notice and is provided for informational purposes only.




To enhance our forensic analysis tool, BlackLight 2018 R4 includes:


·      Apple’s latest picture and video formats (HEIC/HEVC) support

·      Tagging Improvements

·      iPhone XS, XR, and iPad Pro device support

·      Improved support for Android MMS on Samsung devices

·      Parsing “Recent Items” on macOS 10.13

·      Easier license management of BlackBag dongles

·      BlackLight is now exclusively a 64-bit application



Apple’s latest picture and video formats (HEIC/HEVC) support

Starting with iOS 11 Apple introduced a new format for image storage called HEIC. HEIC is the file format name Apple chose for the newer High Efficiency Image Format (HEIF) standard. This format is a more streamlined way to store image files using advanced compression methods. This format allows digital photographs to be created in smaller files sizes, all while retaining higher image quality than its JPEG alternative. HEIF is based on the High Efficiency Video Compression (HEVC) or H.265 video format already used on newer iPhones. BlackLight can now display and report on HEIC images and HEVC video, including image containers with multiple images like exist in Apple’s live photos.

Tagging Improvements

Blacklight has made tagged items easier to be seen and sorted. A new tag column exists in every view of BlackLight in the first column. The first two columns (tag and identifier) cannot be moved or placed in a different order like the other columns can. However, they can be sorted so it is now easier to see which items in a view have been tagged.

In addition, items with multiple tags are now easier to see and remove from multiple tag containers. Right (contextual) clicking on a tag item will reveal a menu system for removing that tag item. The menu will show every tag container that item is stored in and allow removal from all or some of the containers.

iPhone XS, XR, and iPad Pro device support

BlackLight running on macOS will now properly ingest the newer hardware devices without issue. If BlackLight is running on Windows it is important to install the latest BlackBag driver package or install the latest version of iTunes in order to have proper support.

Improved support for Android MMS on Samsung devices

Originally, Android devices did not have a native message app with group message capabilities. However, with Android 6 and up, users can now send group messages through the native application, although each message is sent as an MMS instead of a SMS.

Parsing “Recent Items” on macOS 10.13

BlackLight now parses “Recent Items” accessed or run on a system from macOS version 10.13. The format this information is stored in has changed from prior version. 

Easier license management of BlackBag dongles

A new license manager is available to more easily manager your dongle(s) and license. BlackLight will open the application through the 'Help' menu. It is also available on the BlackBag’s Software downloads page on the website and can be run independently of any application. This license manager is used to manage all BlackBag licenses and can be used to check and update the license. Note: the application must be run from a system with internet access.

BlackLight is now exclusively a 64-bit application

As computers have added resources, including large memory capabilities, the operating system has needed the ability to take advantage of those resources.  Most systems are now 64-bit, and when combined with 64-bit applications users can best take advantage of these resources.  BlackLight will now be able to take advantage of this additional memory space when doing large processing calculations on data. However, it should be noted that while performance gains have been seen, there can still be bottlenecks in I/O.




Tags on media files with specific improper metadata are now retained when re-opening a case


When importing a drive as an unallocated partition, BlackLight now properly displays all search hits


Improved support for tagging large numbers of files (40k+) at a time


Content Search completes when using Unsaved Filter that includes Ignore Folders & Duplicate Files option


Tagged items are properly retained when importing Mobilyze cases with specific tagged items


Added ability to acquire iOS device with encrypted backup password containing a "\" character


Will now properly display instances were tagging missed the email attachments in tag and report views


Improved Spotlight Metadata to display values in more clear fashion


BlackLight Report now displays 'Volume Name' for Volume Shadow Copies


Added Time Zone information to additional actionable info items


Messages Dropdown now displays content only from selected evidence sources


Resolved crash that occurred when exporting all files from Macintosh HD volume


Twitter contacts are now found from groups that in some instances were missing


Volume Create Date now correctly showing as local for Mac partitions


Under Account Usage, Deleted Users are once again displayed in red italics


Hex Templating for MFT File Record has been updated to handle unexpected data sizes


BlackLight now properly tags messages with an attachment > 1 GB





Use of ExFAT for storage media is NOT recommended.

Due to issues with the Apple file system driver, use of exFAT formatted storage media may cause serious performance issues when using BlackLight.  We highly recommend that you DO NOT use exFAT for storage of your case or image files on macOS, and highly recommend the use of NTFS, HFS, or APFS for storage.





Mac OS X 10.11.4 or newer*‡

Windows® 7 or newer

Windows® Server 2016 or newer


BlackLight runs on Intel® based systems only
BlackLight requires the following additional software:
• iTunes 12.6 or higher
• QuickTime 7.6.9 or higher for Mac

• Windows Media Player 12  or higher for Windows


• Mac OS X El Capitan (10.11.4) or Windows 7
• 2.7 GHz Intel Dual Core i7
• 16 GB DDR3
• 5GB of Disk Space (Installation)

• 25GB of Disk Space (Temp Space)
• 1024 x 768 or higher screen resolution


• MacOS Sierra (10.12.6) or Windows 10
• Intel Xeon E5, 6-Core, or better
• 32 GB DDR3 or higher
• 5GB of Disk Space (Installation)

• 25GB of Disk Space (Temp Space)
• 1680 x 1050 or higher screen resolution

* In testing it was determined that BlackLight performs best on OS X version 10.12.6.
‡ We recommend strongly against using macOS versions .0 and .1 in all cases. For example (10.13.0 or 10.13.1)

**For Windows systems, BlackLight uses whatever the default app may be for playing media files. Windows Media Player 12 is recommended. If Windows examiners do not have QuickTime installed and they wish to play certain file types such as .AMR files (voicemail, etc.) they will need to install some non-default codecs, following the instructions found here:  

For information about downloading iTunes and QuickTime, please visit  




The BlackLight® macOS installer is delivered as a package file (.pkg) while the Windows installer is delivered as a setup executable. 

In addition to the BlackLight installers, installers for offline maps, operating system hash sets, and memory symbols will need to be installed in order for BlackLight to take advantage of those.  All installers can be found on the BlackBag software downloads page here:





·             iPhone 3G and newer with iOS 4.0 to 11.4.1

·             All iPads with iOS 4.0 to 11.4.1

·             iPod Touch 2G and newer with iOS 4.0 to 11.4.1



·             Devices running Android 4.0.4 to 8.1

·             Devices manufactured by: Samsung, Motorola, HTC, LG, Google Nexus

Note*: Additional devices running Android 4.0 or later may function properly if the appropriate USB driver for Windows OS is installed




If you need support, we are here to help.


Please use the form at to submit your request for support and someone for our technical support will respond.




As we grow and perfect new features and functionality within our products, we need you to continue to provide the insightful feedback that has allowed us to develop the tool we are proud to offer today. If you would like to submit feedback or suggestions, please contact us through our product feedback form. Through your feedback, we can continue to provide investigators with the solutions they need to solve the critical issues they face every day.