New updates and improvements to Forensic Email Collector

FEC Release

Read release notes

🆕 Introduced Credential Manager


Credential Manager

Allow management of credentials in existing acquisition projects to support the following workflows: Replace a Remote Authenticator token with a new one This can be useful if the authentication token is accidentally invalidated by the end-user during the acquisition and has to be replaced without starting the acquisition over. Change the target account password/app password Similarly, for acquisitions involving legacy username/password authentication, make it possible to change the password in an acquisition project in case the end-user accidentally revokes the app password that was provided. Clear Credentials Make it possible to clear the credential cache in an acquisition project at any time, preventing FEC from being able to authenticate with the target mailbox in the future. Automatically Close Acquisition Projects When an acquisition finishes successfully (i.e., there are no remaining items that could be acquired), automatically clear the credential cache of the acquisition project.

Arman Gungor


🔥Support for Resource Key locked Drive attachments

✔️Added option to automatically detect low disk space and send an optional notification email when disk space is critically low

✔️Output PST EntryID capture


Reflect Output PST EntryIDs in Downloaded Items Log

When the PST output option is selected, include the EntryID of each item written to the output PST in the Downloaded Items Log. This will help correlate items within an output PST with the list of items in Downloaded Items log for metadata overlays, mailbox remediation with Obliterator, etc.

Arman Gungor


🔥Improved Post-Acquisition Actions page

✔️It is now possible to clear permanent error flags from items with permanent errors

✔️Hash preference on the output page is now retained during navigation

✔️Improved logging during Drive attachment & revision acquisition

✔️Added UTC label to Date column in the Gmail API in-place search preview window

✔️An additional file is no longer created when FEC has to fall back to a secondary Drive attachment acquisition strategy

✔️Acquisitions in which no items were identified for collection are now clearly identified in email notifications and end of acquisition messages.

✔️An additional safety check is now performed to ensure that the original output path in an acquisition project matches the active path when a project is resumed after the fact.

✔️Numerous minor performance and user interface improvements