Sunday, January 29, 2012

Intella New Version

Intella has released version 1.5.3

Whats new:

Date Format setting in the preferences, so you can display the dates in the format of your region
Solved an issue of the main process not stopping properly when a user exits Intella
Java heap size of the main and child processes can no be adjusted

Numerous Index features added as well

Thursday, January 26, 2012

Wetstone has two new releases

Gargoyle Investigator Forensic Pro Edition Version 5.0

Stego Suite Version 6.0

Access Data New License Manager

License Manager 3.1.3 has been released

Cellebrite Release

Cellebrite has released two new versions of software.

Physical Analyzer has been released

Cellebrite Application Firmware Update has been released

Four (4) new Blackberry devices supported via physical:
  • GSM - 8520 Curve
  • GSM - 8120 Pearl
  • GSM - 8910
  • CDMA - 9650 Bold
Improvements related to:
  • Blackberry Logical Extractions
  • Blackberry 8900 curve physical extraction
  • Android Physical Extractions
Physical Analyzer has had the following changes:
  • New Decoding for the following
  1. HTC: ADR6400L, ADR6425, PG41200
  2. Motorola: A953, A956, MB810, MB855, MB870, XT610, XT865
  • UFED Physical Analyzer Improvements to iPhone backups and the decryption and decoding of Blackberry email.

    Wednesday, January 25, 2012

    EnCase 6 New Version

    EnCase 6.19.3 has been released

    Items fixed as of the release:

    Fluctuating CPU speeds with On Demand machines causes values in the Registry to change, which in turn stops the SAFE.

    A user cannot decrypt RMS devices with known good credentials

    The default error granularity (64) for memory acquisitions is too high.  It should be 1.

    CREDANT file decryption intermittently fails to properly process a file, resulting in a hash mismatch.

    Friday, January 20, 2012

    Cellebrite Blackberry Physical

    It is here.  It works.

    This is not a chip off examination.  The blackberry was not damaged by this imaging!

    I have tried it on one phone so far and intend to keep playing with the tool.  I had a successful physical dump from a blackberry!

    The Cellebrite dumped this into a .bin file that you can look at with any tool that allows you to view hex.  (Physical Analyzer, EnCase, FTK Imager, or any others.)

    Thursday, January 19, 2012

    Encase 7 New Version

    Encase 7.02.04 is here.

    Foreign language support is here!

    Items Fixed:

    An Internal error occasionally displays when running Case Analyzer, casing Case Analyzer to not start.

    When using the format DD/MM/YY, EnCase reports a "Date is out of range" error.  This occurs only for European customers.

    Thursday, January 12, 2012

    Cellebrite Update!

    New Cellebrite Version is out.

    Physical Analyzer 2.4 is also out

    Cellebrite is claiming Blackberry Support.  I will test it this week and report back on it here.

    Thanks for tuning in!

    Remember to keep a copy of the previous versions just in case an error occurs.  This happens with all Forensic tools on occasion and it is better to be safe than sorry.

    Monday, January 9, 2012

    Current Versions

    Listed are some of the tools I use and the current versions.  I will update this blog weekly and edit this list as a Master of these tools.  If there are any tools you want added to the list please ask.

    The homepages for the listed tools are linked as well.  For most of the sites you will need to create user accounts to gain access.

    If you want/need to purchase any of these tools visit us at: or call us 801-596-2727

    Regards Hew

    Guidance Software
    EnCase 7.06
    EnCase 6.19.7
    EnCase Portable 4.01

    Access Data
    FTK 4.2
    FTK 3.4.1
    FTK 1.81.6
    Registry Viewer 1.6.3
    FTK Imager 3.1.2
    FTK Imager Lite 3.1.1
    PRTK 7.0
    DNA 7.0
    PORT 2.0.3
    License Manager 3.1.5
    Mobile Phone Examiner Plus 5.2.1
    MPE+ Investigator 5.2.1

    Device Seizure v6
    P2 Commander v2
    E-mail Examiner v7.1

    X-Ways Forensic 16.8
    Investigator 16.8
    Win Hex 16.8

    Lightbox Technologies
    Lightgrep Search 1.01

    Firware Updater 7.01

    Forensic Dossier 3.3.3RC13
    USB/Firewire Cloning 0.27
    Talon Enhanced 3.3.3RC13
    Quest 2 1.08
    Talon (Legacy) 2.57

    UFED Touch Application:
    UFED Classic Application:
    UFED Physical Analyzer 3.6.5
    Phone Detective 1.1.7

    Micro Systemation
    XRY 6.5 current

    Black Bag
    MacQuisition 2013 Release 1
    BlackLight 2012 Release 4.1

    Katana Forensics
    Lantern 2.4.1
    Lantern Lite Imager 0.7.2

    Intella 1.6.3

    Gargoyle Forensic Pro 5.2.1
     Latest Gargoyle Data-set is November 2012
    Fibonacci Dataset Creator 1.0
    Gargoyle Investigator Enterprise Module (GEM) 3.2.0
    Stego Hunt 6.0
    Stego Break 6.0
    Stego Analyst 6.0


    F-Response Field Kit 4.0.6
    F-Response Consultant 4.0.6
    F-Response Enterprise 4.0.6

    Magnet Forensics (Formerly JAD Software)
    Internet Evidence Finder v5.8.1

    Passware Kit Forensic 12.3

    Distributed Password Recovery 2.99
    Office Password Recovery 5.11
    Office Password Breaker 3.02
    Phone Password Breaker 1.87

    H-11 Digital Forensics offers training on many of the tools listed above.  If you have questions about any of the tools feel free to email me.

     If you are interested in training check out our training pages: