Today I’m proud to be announcing a new edition of IEF and the release of v6.1. Over the past year, we have talked with our customers, friends, and supporters at tradeshows, conferences, and over email about what they would like to see us focus on or add to our products. Our mission is to impact people’s lives by uncovering the truth and empowering others to make a difference, and we feel that one of the best ways to do that is to stay in touch with our customers, listen to what they are asking for or struggles they are having, and then build products/technology to help them in those areas.
Through that process, we have heard many of you talk about an overwhelming need for more support in mobile forensics when it comes to recovering native and 3rd party apps, especially deleted data. Essentially, people wanted us to take what we do on PC/Mac images and do the same thing on mobile images.
We have a talented team here at Magnet that I’m proud to work with every day. It’s hard to remember any time that our developers and researchers have steered away from a challenge or a new undertaking. They and I have been working hard the last few months and today are happy to announce support for mobile images/artifacts in the new IEF Advanced Edition.
In this new edition, we have brought support to IEF for Android and iOS physical images and file system dumps. We are starting with support for 125+ types of artifacts, and are focused on the recovery of deleted data. You will still need to use your favorite mobile forensics tool to image the mobile device or dump the file system, once you’ve done that, you can use IEF Advanced to provide that extra level of data recovery, parsing, and analysis. Below are a couple of screenshots that show some of the types of artifacts you can expect to recover using IEF Advanced (click on the images to zoom in):
Over the next little while, we’ll continue to blog about some of the exciting new mobile artifact support we now have in IEF Advanced. Also, while Advanced is a new edition, we have made the decision to “grandfather” in everyone that has an up-to-date license for IEF Standard/Triage, so if you are currently using IEF and your maintenance is valid, you’ll get the Advanced features for free. When your license comes up for renewal, you can make the decision to renew at the Advanced rate or stay with Standard.
Last but not least, we also have some very exciting new features in IEF v6.1. The highlights include:
- First in forensics to add carving support for Internet Explorer 10 history – recover deleted history and records from the pagefile/hibernation file, unallocated space, and live RAM captures.
- First in forensics to have support for Bitcoin artifacts – wallet data and transaction records
- Support for Instagram artifacts
- Dropbox decryption on files from images, not just live systems
- XML export option
- Network licensing option now available
There are many other minor additions or improvements, including 64-bit support now to better handle very large cases. In the next few weeks, we’ll tell you more about some of the new features, but below is an example of what we can recover for IE10 history from searching only the pagefile.sys and hiberfil.sys files (click on the image to zoom in):
Again, thank you for your continued support and feedback. We strive to do our best for you and love to hear the stories of how our software has helped you and your clients (including victims of crime) find the truth.
If you have any questions about this new edition or release, please don’t hesitate to contact us.
All the best!
Jad and the Magnet team