Artifacts
- Android Keystore | Android: Added support for parsing tokens and credentials. [Android 6.0+]
- Android Usage History: Updated support to recover information from multiple user accounts. [Android 9.0]
- Android Usage History: Updated support to recover package and configuration events. [Android 9.0]
- Calendar | macOS, Windows: Recover information from calendar files such as event name, description, date/time, location, and more.
- Chrome | Android: Updated support to recover Sync Data and Sync Accounts. [Chrome 59.0.3071.125]
- Device Information | iOS: Improved existing support and updated support to recover device information such as model, OS version, passcode set, and more. [iOS 12.1]
- Discord | Android: Added support recovering information from the Discord app, including account info, conversations, call logs, and channels. [8.3.3]
- Discord | iOS: Added support recovering information from the Discord app, including account info, conversations, call logs, and channels. [2.4.2]
- File System Events | macOS: Recover file system event information such as file name, file path, flags, event ID, file ID, file system created date/time, and file system last modified date/time. [macOS 10.11.6, 10.13.2, 10.14.1]
- Gmail | Android: Updated existing support for the latest version. [9.1.13.233495724 to 9.2.3.235065705]
- Google Play | Android: Updated carving support to better recover WAL files from SQLite databases.
- Telegram | Android: Updated support to recover user contact information. [5.4.0]
- TikTok | Android: Added support to recover chats and saved media. [10.1.10]
- TikTok | iOS: Added support to recover chats and saved media. [10.3.0]
- Uber | iOS: Merged Uber Profiles and Accounts and added support for Cached Locations and Rider Payment Details. [3.340]
- Verizon Messages | Android: Added support to parse SMS messages.
- WeChat | iOS: Updated support to differentiate between group chats and one on one chats. [6.6.5]
Bug fixes
- Chat threads were not being created for Slack messages. -MA-188
- In some cases, iMessages displayed several characters before a message, sometimes resulting in incorrect date/time reporting. -MA-224
- Messages weren’t being decrypted in WeChat 7.0 on Android. -MA-47
- When exporting from Outlook messages, the PST export option was unavailable. -MA-210
- iMessages would display several characters before a message, sometimes resulting in incorrect date/time reporting. -MA-204