In this release (Change Log v3.8) we have added some new functionality in terms of source processing and browser support. We have added support for processing data saved in Advanced Forensic Format as well as well as adding the ability to recover Google Chrome cache records. In addition, we have added support for Logicube Dossier E01 images.
The Advanced Forensics Format (AFF) is an extensible open format for the storage of disk images and related forensic metadata. It was developed by Simson Garfinkel and Basis Technology. HstEx (and Blade) now support the processing of AFF image files (as well as other forensic formats). The following page lists the current supported file formats: Forensic Image Formats Supported by HstEx.
HstEx version 3.8 now adds the ability to recover live and deleted Google Chrome Cache records from all source data types. This is a significant addition to the software, as previously, it was only possible to examine live record, which were still available, on a suspect system.
Mozilla has committed to a more aggressive release schedule for the Firefox web browser. There were nearly three years between the launch of Firefox 3 and Firefox 4, however, versions 5 to 10 have been released within a matter of months. This has been a technical challenge from a support point of view as many artefacts have changed during these releases. We are pleased to support that HstEx now supports all version of Mozilla Firefox cache from version 1 through to the current release, Firefox version 10.