Versions Compared

Old Version 31

changes.mady.by.user Sally McLeod

Saved on

compared with

New Version Current

changes.mady.by.user Craig Wilson

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Section
Column

Introduction to HstEx v3.8

In this release (Change Log v3.8) we have added some new functionality in terms of source processing and browser support.  We have added support for processing data saved in Advanced Forensic Format as well as well as adding the ability to recover Google Chrome cache records.  In addition, we have added support for Logicube Dossier E01 images.

Column

Image RemovedImage Added

Advanced Forensics Format (AFF®) Support

The Advanced Forensics Format (AFF®) is an extensible open format for the storage of disk images and related forensic metadata.  It was developed by Simson Garfinkel and Basis Technology.  HstEx (and Blade) now support the processing of AFF® image files (as well as other forensic formats).  The following page lists the current supported file formats: Forensic Image Formats Supported by HstEx.

Recovery of Deleted Google Chrome v2 -

...

19 Cache Records

HstEx version 3.8 now adds the ability to recover live and deleted Google Chrome Cache records from all source data types.  This is a significant addition to the software, as previously, it was only possible to examine live recordrecords, which were still available, on a suspect system.  HstEx v3.8 can recover cache entries from Google Chrome browser v2 through to the current release v16v19.

 

 Image Added

 Image Removed

Recovery of Deleted Mozilla Firefox v1 to 12 Cache Records

Mozilla has committed to a more aggressive release schedule for the Firefox web browser. There were nearly three years between the launch of Firefox 3 and Firefox 4, however, versions 5 to 12 have been released within a matter of months.  This has been a technical challenge from a support point of view as many artefacts have changed during these releases.  We are pleased to support to announce that HstEx now supports all version versions of Mozilla Firefox cache entries from version 1 through to the current release, Firefox version 12.

  Image Removed

Image Added

Recovery of Firefox v12 'moz-pages-thumb' entries

...

Section
Column

According to Logicube:

"The sixth generation of computer forensic solutions from Logicube, the Forensic Dossier® was designed and engineered exclusively to meet forensic investigators' requirements.  Version 2.0.1 provides support for the E01 file format compression (hardware-based compression to maintain line-speed performance), and support for NTFS file format for support of 2TB and greater capacity hard drives and support of single, disk-wide dd image capture."

With HstEx v3.8, we have added support for the E01 files produced by the Logicube Forensic Dossier.  Unfortunately, earlier versions of HstEx are unable to load and read the E01 files generated by the Logicube Dossier because of an incompatibility with the metadata fields.  Some of the values written to these fields are in a different format than those written by EnCase or FTK Imager.  This has now been resolved.

Column
width300px