Magnet Forensics has released Magnet IEF v6.6. This release adds a number of new and advanced analysis features to IEF that will aid examiners in locating and validating recovered data. These features include Hex Viewer, Text Viewer, Profile development capabilities, Partial Artifact filter, Histogram View, and Examiner/Investigator Modes.

Hex Viewer
To assist users with artifact analysis, we have added a new Hex viewer to Magnet IEF. This new feature presents artifacts as hexidecimal data, allowing examiners to manually search for additional data and validate the location of their data on the hard drive. Hex Viewer will also allow examiners to see translated Hex values (i.e. Hex to ASCII) so they can view data as close as possible to the source.

Text Viewer
Similar to the new Hex Viewer, Text viewer is a new analysis feature that translates underlying hexidecimal data into a text representation. Evidence can be verified from the Text view since data is appearing in a raw format. It also provides examiners with a simplified view of Text evidence, without the corresponding HEX data.

Profiles
People are more connected now than they’ve ever been, meaning their activity is spread across multiple devices. With the new Profiles feature, Examiners can build profiles for Persons of Interest within their cases by associating identifiers (such as user names and email addresses), and filter artifacts associated with an individual user.

Examiner & Investigator Modes
We’ve introduced two new operating modes for Magnet IEF Report Viewer to better serve the needs of our users. Examiner Mode is a fully featured IEF report view with all the analysis and reporting features that allow examiners to dig deep into recovered data.* For non-technical stakeholders, Investigator Mode is a simplified view that allows users to review evidence without being exposed to complex data.

Partial Artifact Filter: Examiners can filter artifacts by full or partial hits
Histogram View: Graphical representation of artifacts types, which can be used for baseline comparison for similar case types.