BlackBag Technologies are excited to share that BlackLight 2018 R3.1 has officially been released with important updates and improvements that will help your software run as efficiently as possible. This release is especially important for users who run BlackLight on Windows systems as changes by Microsoft in their latest release will impact prior versions of BlackLight.
R3 Overview: New and Improved
• Comprehensive report options
• APFS Snapshots
• Streamlined support for all GrayKey image formats
• iOS Hidden Photos
• Enhanced Windows Memory Support
The release of BlackLight 2018 R3.1, when combined with MacQuisition 2018 R3, is the world’s first and only complete end-to-end acquisition, decryption, and analysis solution for the latest Apple File System (APFS).
Demand for a reliable acquisition and analysis solution is growing daily as more and more APFS formatted devices are being brought to examiners. BlackBag Technologies, with over 14 years of experience supporting Apple forensics, once again proves to be the leader in providing forensic examiners with a truly complete solution to investigate Apple devices.
BlackLight quickly analyzes computer volumes and mobile devices. It sheds light on user actions and now even includes analysis of memory images. BlackLight allows for easy searching, filtering and otherwise sifting through large data sets. It can logically acquire Android and iPhone/iPad devices, runs on Windows and Mac OS X, and can analyze data from all four major platforms within one interface. It’s simply the best option available for smart, comprehensive analysis.
The latest release, BlackLight 2018 R3, includes:
- Comprehensive Report options
- APFS Snapshots
- Streamlined support for all GrayKey image formats
- iOS Hidden Photos
- Enhanced Windows 10 Memory Support
Recent feature highlights from 2018 R2 include:
- Viewing and Filtering Across Multiple Devices
- Spotlight Index Parsing
- Report View Email Improvements
- Improved displaying of NTFS ACL information
- Time zone improvements
Earlier this year, BlackLight 2018 R1 was released which includes full APFS support – when combined with MacQuisition 2018 R1, it is the world’s first complete end-to-end acquisition, decryption, and analysis solution for the latest Apple File System.
In addition, it includes support for latest versions of the following mobile applications:
- Facebook Messenger
- Line
Feature highlights from 2017, include the following:
- Export media to LACE, C4ALL, and Project VIC formats for further analysis
- Support for EML formatted email files, included on the easy Communication view
- Identify ‘Recent’ documents and applications from Mac OS 10.11 and 10.12
- Latest phones and operating systems, including iPhone 8, iOS 11 and Android 8.0 (Oreo)
- Ingest Mac sparse images directly into BlackLight
- Full collections from iOS 11 including from iTunes Backups
- Users are now prompted for passwords for iOS 11 Encrypted backups to complete the collection
- Generate reports in CSV format to allow examiners to review data in external programs
- Ability to export case data as XML for import into various analytic tools
- New ‘Reset’ button when filtering the current view or searching to easily start a new filter or search of items, for example messages and media filters
- Updated hash set support to include identifying ‘Known’ and ‘Trusted’ items from hashsets.com, for the latest Mac and Windows Operating Systems
- BETA support for parsing ExFAT, ISO9660, EXT 2, EXT 3, EXT 4, UFS, and YAFFS2 file systems
- Updated Parsing for FSevent Files
- Windows 10 Fall Creators Update
- EWMounter Additional Drive Support
- Improved Volume Shadow Copy (VSC) Display
