Exterro FTK and FTK Lab 8.0-Release Notes
Exterro FTK and FTK Lab 8.0-Release Notes
0 – RELEASE NOTES
SEPTEMBER 2023
FTK & FTK LAB 8.0 – RELEASE NOTES
Table of Contents
Overview ......................................................................................................................................................................... 3
1.1.7 Review....................................................................................................................................................... 21
3 Limitation............................................................................................................................................................... 34
Overview
Exterro was founded with the simple vision that applying the concepts of process optimization and data science to
how companies manage digital information and respond to litigation would drive more successful outcomes at a
lower cost. We remain committed to this vision today. We deliver a fully integrated Legal GRC platform that enables
our clients to address their privacy, regulatory, compliance, digital forensics, and litigation risks more effectively and
at lower costs. We provide software solutions that help some of the world’s largest organizations, law enforcement
and government agencies work smarter, more efficiently, and support the Rule of Law.
1 What’s New
1.1 Enhancements
1. You can now choose to view and review cases in Smart View. To do so, you can click on the ‘Smart View’ button
displayed in the following areas of FTK application: (FCR-17373)
● From the header of the Case window.
● From the ‘Select case window template’ popup displayed upon opening a case.
● From the ‘Other Applications’ options of the ‘Tools’ tab inside a case.
Smart View:
Note: Refer to the FTK Central 8.0 User Guide for more information.
2. In this release, we've introduced a new feature powered by a Bloom filter that significantly improves system file
handling. It efficiently identifies known system files, reducing processing overhead and boosting performance,
especially in large datasets. While it enhances efficiency, please remember to verify files suggested by the Bloom
filter to ensure accuracy. Setup of KFF Server is not necessary to use this feature. It is built in FTK Processing
engine. (FCR-14045)
3. FTK has been enhanced to support VLC media player to seamlessly play all audio and video files. (FCR-15730)
4. FTK can now automatically clean up the Temp folders of completed job regardless of the intended operation’s
result. This should help with better handling of distributed jobs. (FCR-7315)
5. You can now change the date format for a Case using the newly introduced ‘Date Format’ field in the ‘New Case
Options’ pop-up. For existing cases, you can modify the date format from the ‘Time Display Format’ option under
the ‘View’ tab of the case. (FCR-8534)
6. FTK permissions have been enhanced to allow control of which users have the permission to mark files as
privileged/unprivileged. (FCR-8278)
Role Description
Mark as Privileged Only the users with this role can mark an item as ‘Privileged’.
Mark as Unprivileged Only the users with this role can mark an item as ‘Unprivileged’.
7. FTK has been enhanced to support up to 50 million items in a case (irrespective of its size) via PostgreSQL. (FCR-
16057)
Performance Metrics
Types of evidences used Windows, Mac OS, UFDR, Android, iOS, PSTs, Archives etc
8. FTK now supports processing of Slack JSON export files and is capable of parsing chat conversations using ‘Exterro
Chat’ parser from the ‘Expansion’ option. (FCR-11801)
Smart Grid View is an easy and efficient way to filter files in a case. Smart Grid View in FTK Central automatically
groups all metadata values and displays them in corresponding columns for easier review. All file metadata is
categorized in multiple scrolling grids. You simply need to click and select all values required to form a filter query
and view the corresponding set of files.
You can sort, filter, and search for the file details displayed in the ‘Smart Grid View’. (FTKC-24784) (FTKC-25246)
Note: The columns consisting of no values will not be displayed in the ‘Smart Grid View’. (FTKC-24789)
1. FTK is enhanced to support processing of iOS backups of unencrypted/encrypted data from iTunes (iOS mobile
devices up to 16.0 (20A362) version). (FCR-3303)
2. FTK is enhanced to support image processing of unencrypted file system images obtained from Cellebrite. (FCR-
9647)
3. FTK is now enhanced to parse the following artifacts for the ‘Mobile Phone (iOS) Biome Application Information’
in the ‘System Summary’ pane: (FCR-15648)
● Biome AppInFocus
● Biome AppInstall
● Biome Backlight Public
● Biome Battery Percentage
● Biome Device PluggedIn
● Biome Hardware Reliability
● Biome Notifications Public
● Biome Now Playing Public
● Biome Text Input Sessions
● Biome User Activity Metadata
● Biome WIFI
● Application Intent
Note: You can refer to the Exterro FTK Suite 8.0 - Artifacts Guide for more details.
4. The following artifacts have been introduced for ‘Location’ related data: (FCR-15592)
a) iOS:
Find My Information:
● Owner Information
● Device Information List
● Device Information
● Device Address
● Device Location
● Crowd Source Location
b) Android:
5. You can now export the HEIC converted images as JPG using the newly introduced ‘Export HEIC as JPG’ file option
from the ‘Export’ window. (FCR-12661)
6. The Native View of the Chat conversations has been enhanced to provide users with a near native experience
of the source chat application for easy reviewing. (FCR-13186)
• The following information are displayed in the Native view’s header specifically for chat conversions:
• The chat application’s name.
• The total number of messages present in the selected conversation.
• The participants of the conversation.
• The date and time of the first and last chats in the Conversation.
• The ‘Attachment(s)’ button to click and view all the attachments in the conversation.
Note: While viewing the attachments, you can click on the ‘Filter conversations around this attachment’
button to navigate and view the chat associated with the attachment in the Native view.
7. The ‘Evidence Processing’ section is now enhanced with an additional Processing Profile, ‘Mobile Processing’ to
process the mobile evidence efficiently. In this profile, basic parsing, system summary, and indexing options are
selected by default. The Expansion options include the following: (FCR-16980)
● Exterro Chat Parser
● Browser-related data (Including Google Chrome, Firefox, and Safari)
● All the archive types (ZIP, RAR, TAR, GZIP)
● iOS and Android backups
8. FTK is enhanced to automatically select UFDR and XRY Expansion options while processing the corresponding
files to simplify the processing workflow. (FCR-18790)
9. FTK is enhanced to parse data for the below mentioned iOS and Android applications:
Latest Supported
Latest Supported App
App Name Android App Version iOS
Version (iOS)
(Android)
Microsoft Teams Microsoft Teams
Attachment Attachment
Microsoft Teams
Microsoft Teams Calls
Calls
Microsoft Teams Microsoft Teams
Microsoft Contact 1416/1.0.0.20230727 Contact
5.8.0
Teams Microsoft Teams 02 Microsoft Teams
Conversation Conversation
Microsoft Teams Microsoft Teams
Group Conversation Group Conversation
Microsoft Teams Microsoft Teams
Messages Messages
LinkedIn -
LinkedIn - Attachment
Attachment
LinkedIn - Contact LinkedIn - Contact
LinkedIn 4.1.818.1 9.1.318
LinkedIn -
LinkedIn - Conversation
Conversation
LinkedIn - Messages LinkedIn - Messages
Uber Account Uber cached Location’s
Uber Cached Place NA
Uber 4.492.10000 3.580.10001
Uber Cached
NA
shortcuts
TikTok Contact NA
Tiktok TikTok Conversation 25.6.4 NA NA
TikTok Messages NA
Latest Supported
Latest Supported App
App Name Android App Version iOS
Version (iOS)
(Android)
Twitter Information Twitter Information
Twitter User Twitter User
Information Information
Twitter Banner Media
NA
Entity
Twitter Status
NA
Information
Twitter
Twitter Interest Topic 9.87.0-release.0 Twitter Link URLs 9.56.1
tweets
Twitter Live Events Twitter Media
Twitter Tweets Twitter Tweets
Twitter Structured
NA
Locations
NA Twitter URL Entity
Twitter User Twitter User
NA Twitter User Birthday
1. The ‘Language Identification’ feature in FTK is now enhanced to identify and display up to 5 languages present
in a file. (FCR-8913)
1. The workflow involved in creating a Portable Case has now been modified for a better user experience. You can
now enable the newly introduced ‘Portable Case’ format option from the ‘Report Output’ pop-up (Files > Reports)
to configure and generate a new Portable Case with the required files. (FCR-14424)
Note: As a part of this enhancement, the ‘Create Portable Case’ button has been removed from the ‘Files’ menu.
2. The ‘startftkplus.bat’ file intended to Launch the application is now renamed as ‘Launch FTK Portable Case.bat’.
(FCR-15835)
5. Upon applying any filters to the item list in the FTK Portable Case, the count of the associated filters will be
updated dynamically in the ‘Filters’ panel. (FCR-16353)
6. ‘Create Searchable Index’ and ‘Index Binary’ options are newly displayed on the ‘Sub Portable Case’ pop-up
window for you to specifically search the sub portable case items. (FCR-17303)
7. FTK Portable Case is enhanced to display the File icons in the ‘File Type’ column. (FCR-17726)
8. FTK Portable Case is enhanced to check and install the required prerequisites automatically. (FCR-16833)
1.1.6 Filters
1. A new panel, ‘Filters’ is introduced in the Portable Cases to filter the files using the predefined set of filter
options available in the panel. (FCR-13887)
1.1.7 Review
1. The ‘Restore Default Layout’ option is newly introduced in the Portable Cases to restore the rearranged viewers
to the default state. (FCR-16578)
2. The following viewer types are newly introduced for the Portable Cases to view the corresponding information:
(FCR-12793)
● Chat – To view chat and message file types.
● Hex – To view files in Hexadecimal format.
● Contact – To view the contact file types.
● Web – To view web page files.
● Video – To view video file types.
● OCR Text - To view text extracted from image files.
3. FTK Portable Case is now enhanced to generate and display thumbnails for the video files. (FCR-15851) (FCR-
15830)
3. For accurate filtering, the AND and OR Boolean operators are newly introduced against the search bar to
flawlessly perform nested searches in Portable cases. (FCR-13915)
1. The following column options are newly introduced in the Item List of Portable Case: (FCR-13655)
● Auto Column – Enabling this option will automatically add/remove columns in the Item List to match the file
types selected.
2. Checking/unchecking items in the ‘Item List’ viewer of Portable Cases is now enhanced by introducing the
following options: (FCR-15676)
● All In Current List – To only check/uncheck items that displayed on the page the user is currently on.
● All in Case – To check/uncheck all the items that are part of the Portable Case.
3. A new column, ‘Hit Count’ is introduced in the Item List panel to display the number of search term occurrences
present in the corresponding file. This column will be displayed only when a search is performed. (FCR-16706)
4. You can now view the regions and cities associated with the files present in a Portable Case. You can view the
information from the newly introduced ‘GeoTagRegion’ and ‘GeoTagCity’ columns in the Item List. (FCR-15827)
5. You can now export the items present in a Portable Case as a ZIP file. To do so, enable the newly introduced
‘Export to ZIP’ option while performing the Export operation. (FCR-14095) (FCR-14587)
1. The installer will now perform an automatic check-up of the installation environment before the installation. This
provides the user with all specifications (such as RAM, CPU Cores, and STATE/TEMP space) of the system on
which the application will be installed and provides some minimum recommendations. (FCR-13826)
Note: You can refer to the FTK 8.0 Installation Guide for more information.
Note: Customers who are using ABBY for OCR jobs are recommended to upgrade your ABBY FineReader to the
aforementioned version for continued support.
3. The latest FTK installer includes support for the latest 64-bit version of VLC (media player), 3.0.17.4. During the
installation, you will be automatically prompted to upgrade to or install the latest VLC version. (FCR-12006)
4. FTK application is now compatible on the following operating systems for installation:
● Windows 11 operating systems (FCR-16237)
● Windows Server 2022 (FCR-17893)
5. FTK has now added support for RDSv3 SQLite3 formatted NIST NSRL with KFF. (FCR-12431)
Note: You can refer to the KFF 7.6 (Support for SQLite Hash Sets) for more information.
6. FTK now supports migration of cases from Postgres 11.2 to Postgres 14. (FCR-12658)
Note: You can refer to the FTK PostgrSQL Migration Guide for more information.
7. FTK is enhanced to parse the Volume Serial Number (VSN) of USB devices from event logs. (FCR-15390)
8. Granularized agent management permissions have been added to 'Configuration Rights'. Creating, editing and
deleting agents will require appropriate permissions to be applied. (FCR-15619)
9. The FTK_Log.txt file has been enhanced with the following changes: (FCR-12128) (FCR-13821) (FCR-13820)
(FCR-13823) (FCR-14179)
• By default, a comprehensive logging of all the activities performed in a case is enabled.
• The maximum size of a file is set to be 48MB, beyond which a new log file (ftk_log.<timestamp>.txt) will be
created and recorded.
• The logs are now recorded in a user-friendly language.
• The debug log & JobProgressInformation log files are created inside the case folder upon processing the
evidence.
• All the logs of a case are now downloadable in a ZIP file by clicking the download button against the Collect
logs field.
• For more details, refer to the FTK Evidence Processing Logs Guide.
2 Resolved Issues
1. Resolved an issue where the users were not able to perform the Index search operations with Chinese characters.
(FCR-3180)
2. Resolved an issue where the FTK Imager did not display the exFAT directories created using macOS. This issue
occurred only when the exFAT formatting was created via macOS 11 (Big Sur) and macOS 12 (Monterey). (FCR-
7235)
3. Resolved an issue where the Provenance and Data provenance were incorrectly pointing to the Processed Case
File path instead of the actual path. (FCR-8761)
4. Resolved an issue where FTK was utilizing high RAM while processing UFDRs with a large number of attachments.
(FCR-13825)
5. Resolved a sporadic issue where the content of PDF files was not properly aligned while viewing it from the FTK
‘File Content’ pane. (FCR-13628)
6. Resolved an issue where the sorting of the ‘Disk Capacity’ column was incorrect. (FCR-13738)
7. Resolved an issue where FTK Lab was initiating repetitive queries to the database while an Index search was
performed. (FCR-15025)
8. Resolved an issue where the FTK application was utilizing high RAM upon processing Grayshift Mobile Images
with a large number of attachments. (FCR-17205)
9. Resolved an issue where the metadata of a .doc file was not parsed into the Microsoft Office Metadata
property set. (FCR-19179)
10. Resolved an issue where an error occurred while restoring the backup Case. (FCR-18632)
11. Resolved an issue where the parsing/extraction of mobile data failed for the XRY file. (FCR-18920)
12. Resolved an issue where the unencrypted ZIPs were incorrectly identified as encrypted ZIP files. (FTKC-23090)
13. Resolved an issue where the FTK application was not able to parse Metadata for the .doc files. (FCR-19179)
14. Resolved an issue where the Temp directories were occupying more space while processing the ZIP files. (FCR-
10238)
15. Resolved an issue where the complete path for ‘Reg Key’, ‘Data Provenence’, and ‘Bag slot’ of Shellbag was not
tagged in the FTK application. (FCR-12303)
16. Resolved an issue where the FTK application was not able to acquire the files with International characters from
macOS Ventura. (FCR-14728)
17. Resolved an issue where the number of search hits and counts of the indexed ZIP files were not displayed in the
‘Index Search’ tab of a case. (FCR-15457)
18. Resolved an issue where the system was not able to recognize the Bitlocker’s primary partition upon loading an
.E01 image captured using FTK Imager. (FCR-19709)
19. Resolved an issue where the selected columns were not displayed under the ‘Current Visible Columns:’ section
of the ‘Select Columns’ pop-up. (FCR-19678)
20. Resolved an issue where the excluded filters (the filters unselected after selecting all the filters) operations
were also performed for Labels and Bookmarks. (FCR-19639)
21. Resolved an issue where the filtered Text view was blank upon performing a search operation. (FCR-19531)
22. Resolved an issue where the Temp Drive was running out of disk space and the RAM utilization was more than
90% upon running an AA job on a case. (FCR-18879)
23. Resolved an issue where the users were not able the decrypt the Apple File System (APFS) drive and also the
Metadata for the image was missing. (FCR-16964)
24. Resolved an issue where the ‘Word’ option was not displayed in the ‘Report Format’ drop-down field while
creating a report. (QR-4475)
25. Resolved an issue where users with the ‘View Tags’ and ‘Assign Tags’ role were not able to view or access the
coding panel. (FTKC-23085)
26. Resolved an issue where the creation of DAT type load file for an export was being processed indefinitely.
(FTKC-24450)
27. Resolved an issue where the removed columns reappeared automatically upon sorting the columns. (FCR-
19544)
28. Resolved an issue where the FTK application was not able to recognize multiple partitions of Bitlocker produced
image. (FCR-20716)
29. Resolved an issue where the bookmarks applied to a file were not displayed in the ‘Bookmarks’ column of Item
List until the page is refreshed. (FCR-15845)
30. Resolved an issue where the ‘Actual Source File’ and ‘Child Items’ options were disabled in the ‘Create New
Bookmark’ pop-up. (FCR-15811)
31. Resolved an issue where the CPU memory was completely utilized while processing UFDR files in FTK. (FCR-
14364) (FCR-14114)
32. Resolved an issue where the FTK Lab application crashed when a user tried to add multiple Active Directory
custodian groups to a case. (FCR-15024)
33. Resolved an issue where the FTK application crashed while trying to cache large volumes of attachments from
the iOS device. (FCR-17205)
34. Resolved an issue where the FTK Lab application’s response was slow in the Active Directory environment.
(FCR-16017)
35. Resolved an issue where the options configured in the ‘Lab / eDiscovery Options’ section of a processing profile
were not saved. (FCR-12922)
36. Resolved an issue where the contents of ‘Viewer’ panel was misaligned for the following ‘Viewer’ types: (FCR-16931)
• Chat
• Contact
• Video
This issue occurred only when the ‘Viewer’ panel was placed on the right side of the application screen.
37. Resolved an issue where container files were also hidden in the Item List upon clicking on the ‘Hide Folders’
option. (FCR-16294)
38. Resolved an issue where all the items checked in the ‘Item List’ were reset/cleared upon closing and reopening
the Portable Case. (FCR-17177)
39. Resolved an issue where some of the logs in an EVTX file were not parsed by the FTK application. (FCR-15146)
40. Resolved an issue where an incorrect value was displayed in the ‘Total editing time’ field of ‘Properties’ tab in
the FTK application. This issue occurred only for the Microsoft Office files. (FCR-13834)
41. Resolved an issue where the number ‘0’ was prefixed to the values displayed in the ‘Vol serial#’ column in the
‘File List’. This issue occurred only for the ‘Jump List’ and ‘Link’ file types. (FCR-14622)
42. Resolved an issue where an invalid user named ‘Accessdata admin’ was additionally displayed in the ‘Associate
Users’ section displayed while restoring a case. (FCR-14273)
43. Resolved an issue where the ‘Selected ColumnSet’ name was not displayed on the ‘Selected Columns’ pop-up
of FTK Portable Cases. (FCR-20644)
44. Resolved an issue where the below mentioned file types were excluded from the FTK Portable Case
generation:(FCR-13713)
• File System Slack
• Slack Space
• Unallocated Space
• Unpartitioned Space
45. Resolved an issue where there was a considerable delay in loading and displaying of (iTunes encrypted) Chat
Messages under the ‘File Contents’ tab of Mobile Data of FTK. (FCR-17934)
3 Limitation
1. The 'Open With' option is not displayed while right-clicking on the files in the Thumbnails panel in FTK Portable
Case. However, you can perform this action for the required files in the Item List. (FCR-17947)
Contact Exterro
If you have any questions, please refer to this document, or any other related materials provided to you by Exterro.
For usage questions, please check with your organization’s internal application administrator. Alternatively, you may
contact your Exterro Training Manager or other Exterro account contact directly.
Contact:
Exterro, Inc.
2175 NW Raleigh St., Suite 400
Portland, OR 97210.
Telephone: 503-501-5100
Toll Free: 1-877-EXTERRO (1-877-398-3776)
Fax: 1-866-408-7310
General E-mail:[email protected]
Website: www.exterro.com
Information in this document is subject to change without notice. No part of this document may be reproduced or transmitted in any form or by any means,
electronic or mechanical, for any purpose, without the express written permission of Exterro, Inc. The trademarks, service marks, logos or other intellectual
property rights of Exterro, Inc and others used in this documentation ("Trademarks") are the property of Exterro, Inc and their respective owners. The
furnishing of this document does not give you license to these patents, trademarks, copyrights or other intellectual property except as expressly provided in
any written agreement from Exterro, Inc.
The United States export control laws and regulations, including the Export Administration Regulations of the U.S. Department of Commerce, and other
applicable laws and regulations apply to this documentation which prohibits the export or re-export of content, products, services, and technology to certain
countries and persons. You agree to comply with all export laws, regulations and restrictions of the United States and any foreign agency or authority and
assume sole responsibility for any such unauthorized exportation.
You may not use this documentation if you are a competitor of Exterro, Inc, except with Exterro Inc’s prior written consent. In addition, you may not use the
documentation for purposes of evaluating its functionality, or for any other competitive purposes.
If you have any questions, please contact Customer Support by email at [email protected].