- Added ability to configure a USB drive to use new logical imager tool.
- Added logical imager tool that runs on a live Windows computer and saves results to a USB drive.
- Added ability to import logical imager results into Autopsy as a data source.
- Changed file type detection so that Tika does not rely only on extension.
- Email ingest module assigns thread IDs to messages
- Android ingest modules store thread ID from their databases.
Content Viewers (lower right of UI):
- New \u201cText\u201d viewer that consolidates previous Strings and \u201cIndexed Text\u201d viewers.
- New \u201cTranslation\u201d panel was added to the new \u201cText\u201d viewer.
- Added integration with Google and Bing translation (credentials required)
- Redesigned \u201cOther Occurrences\u201d viewer to have 4th column with details of selected item.
- Added Willi Ballentin\u2019s \u201cRegistry Hive Viewer\u201d panel to the \u201cApplication\u201d viewer.
- Improved HTML viewer to use style sheets and better layout.
- Added ability to draw a box on a picture while tagging it.
Result Table (upper right of UI)
- Added paging to all views for faster loading of large data sets.
- Improved speed of displaying results when a column was sorted.
- Portable cases can contain files marked as Interesting Items
- Portable cases can be compressed and chunked
- \u201cFiles – Text\u201d report can use either tabs or commas as the delimiter
- \u201cFiles – Text\u201d report better handles Unicode text.
- Added ability to create a CSV report for the contents of a table
- HTML report for tagged pictures includes a copy with the overlay box
- Added Account Summary view
- Added Contacts panel to show all contacts associated with an account.
- Added Media panel to show media attachments associated with an account
- Added filter to show accounts if they involved with the most recent messages.
- Messages can be grouped by thread.
- New Test button was added to help diagnose permission and configuration issues.
- Created new Triage Standard Operating Procedure (SOP) section to the User Docs
Directly related posts: