New updates and improvements to Forensic Email Collector
This is a maintenance release with the following improvements:
✔️Improved memory management during Inline Search.
✔️Addressed a potential issue where automatic hashing of the output PST may not be completed at the conclusion of a small fraction of Gmail API acquisitions.
Like
This is a maintenance release with the following improvements:
✔️Improved in-place throttling mitigation during the snapshot phase of Gmail API acquisitions to handle an edge case.
✔️Addressed an issue where the PST split setting was not honored in some scenarios.
Like
🔥Introduced deferred PST creation. In addition to being able to create output PSTs progressively as usual, you can now create PSTs on demand post-acquisition—as long as item-level output options were selected.
🔥FEC projects now use relative paths. This makes it possible to perform post-acquisition actions on FEC projects from a different location or import them into FEI after a project was moved or archived.
Make the output paths in an FEC project relative so that the project can continue to work even if it’s moved to a different location. Example: You start an acquisition with the output path “X:\Client Files\12314.123\Emails\1234” and then move the project to “Z:\New Project Path”. The project, in its new location on the Z: drive, remains fully operational/resumable.
4
🔥Added support for additional Drive item types, such as Google Forms and Google Jamboard files.
🔥Introduced new advanced Drive acquisition options: Exclude Duplicates, Skip Last Revision, and Suppress Acquisition of Drive Attachment.
🔥History record exports now include decoded MessageId timestamps. This makes it easier to determine the timestamps of deleted messages.
✔️When the Fetch Only the Latest Revision before Parent was Sent option is selected, FEC now presents two options regarding what to do when no such revision is found—acquire all revisions, or acquire no revisions.
✔️Extended Inline Search to support calendar items and contacts. Added startdate and enddate as new search fields to target calendar event timestamps. This allows more granular calendar event searches than what most providers allow via In-place Search.
✔️Extended the Yahoo 100k item bypass feature to cover AT&T and SBC Global.
✔️Improvements to Acquisition Insights.
✔️PST output stability enhancements.
✔️Added new logs for excluded Drive attachments (when the Exclude Duplicates Drive option is selected) and Post-Acquisition PST export (when output PSTs are created as a post-acquisition action or in deferred mode).
✔️Numerous other performance and user experience improvements.
Like
This is a maintenance release with the following improvements:
✔️Stability improvements to multi-threaded processing.
✔️Fixed a minor GUI issue where Drive attachment count was not initially displayed in acquisitions where Drive revisions were not acquired.
2
This is a maintenance release with the following improvements:
✔️It is now possible to enable/disable Yahoo/AOL 100k item bypass from FEC's GUI. The option to disable this feature may be beneficial in smaller mailboxes that are not affected by the item cap.
✔️Whether the Yahoo/AOL 100k item bypass feature is turned on is now reflected in FEC's Acquisition Log.
✔️Improved FEC's performance when Inline Search is activated and acquisition errors are automatically retried.
✔️Updated the PST Acquisition Insight to take items filtered via Inline Search into account.
🔥Introduced the ability to output into disk images. FEC's MIME or MSG output can be packed into a VHDX container automatically upon completion of an acquisition, or on demand as needed. The created container(s) are hashed automatically.
Provide an option to have FEC output the acquired items inside a container file such as a virtual hard disk (VHD), AFF4 image, logical evidence file (L01), ZIP archive, 7-Zip archive, etc. If you are interested in this feature, please upvote and/or reply below and let us know which output format you would prefer.
1
🔥FEC can now bypass the 100,000 items per subfolder limitation imposed by Yahoo and AOL. After modern authentication support, this marks phase 2 of our Yahoo improvements.
🔥Introduced Acquisition Insights. At the conclusion of an acquisition, FEC will now interpret the key information in its logs and provide Insights to bring critical information to users' attention.
✔️It is now possible to perform reverse Differential Acquisitions. In other words, instead of providing exclusion lists, you can now provide inclusion lists. The acquisition would then be limited to the items on the inclusion lists.
✔️Acquisition statistics shown in the UI are now updated in real-time.
✔️Added in-place throttling mitigation to the snapshot phase of IMAP acquisitions to improve support for very large IMAP folders.
✔️Extended Inline Search to support searching by Item Class during Exchange (EWS) acquisitions. One can now filter the acquired items precisely by their Item Class. For example, itemclass:ipm.note*
✔️The number of items excluded by Inline Search is now shown in the UI during the acquisition.
✔️Improved support for Gmail labels with double quotes in Unified Query Builder.
✔️Extended the "Customizable Output PST Names" feature to include VHDX container naming.
✔️Clicking on the O365 hyperlink in Custom EWS acquisitions now automatically chooses the latest Exchange Server version.
✔️Improvements to PST output.
✔️Numerous other performance and user experience improvements.
This release contains the first phase of improvements to address Yahoo / AOL authentication issues.
✔️Added modern authentication (OAuth 2) support for Yahoo and AOL. Currently, the user brings their own Yahoo / AOL API credentials.
✔️Extended FEC's custom token import functionality to cover Yahoo / AOL—making it possible to use external authentication tokens.
✔️Output PST split preference and size are now retained on the output settings page during back-and-forth navigation.
✔️Numerous minor user interface and performance improvements.
✔️Added support for Exchange/M365 Public Folders in EWS acquisitions.
✔️It is now possible to customize FEC's output PST naming scheme using templates on FEC's preferences page.
Make it possible to enter a custom PST base name—instead of the target email address—during acquisition setup.
3
✔️Updated Microsoft's public key for .Net Framework 4.7.2 so that FEC can verify its signature during installation—only applies if that dependency is missing.
Like
Maintenance release that addresses an OAuth timeout issue in EWS acquisitions.
Like
🆕 Introduced Inline Search — a new mechanism to filter emails during acquisition.
🔥Added granular throttling mitigation to various areas in the acquisition pipeline to improve performance. The enhancement is especially felt during Drive acquisitions and folder snapshots in heavily-throttled Exchange/M365 acquisitions.
✔️Improved handling of special characters in Drive paths during modern attachment acquisition.
✔️Batch acquisitions no longer attempt to start an acquisition if the acquisition was previously closed (i.e., credentials cleared).
✔️Improvements to PST output performance.
✔️The "Use Impersonation" setting in EWS acquisitions is now recorded in Acquisition Log.
✔️Switched to .Net Framework 4.7.2.
✔️Permission errors encountered during the acquisition of Drive revision lists are now considered permanent.
✔️Improved Federal Information Processing Standards (FIPS) compliance.
✔️Numerous performance and user experience improvements.
2