Artifacts
- Google Calendar Reminders | iOS: Added support for recovering more detailed information about recurring reminders including frequency details.
- LINE Contacts | Android: Updated support for recovering contacts. [10.20.1]
- Motion Photos | Android: Recovered .jpg and .mp4 files are now combined into a single hit with two different evidence sources.
- Parler | Android: Added support for recovering users and activity.
- Parler | iOS: Added support for recovering users and activity.
- QQ | Android: Updated support for recovering file transfers and messages. [8.4.18]
- Reddit | iOS: Updated support for recovering usernames for recently visited Subreddits. [2020.43.0]
- Signal | Android: Added support for recovering groups and chats.
- Signal | iOS: Updated support for recovering group members and local users. [3.16]
- Signal – Users | Android: Added support for recovering users and profiles known to the target account.
- Skype | Windows: Improvements to logging for Skype artifacts.
- Snapchat – Group Members | iOS: Added support for recovering group members.
- TamTam Messenger | iOS: Updated support for recovering channels, contacts, conversations, groups, and messages. In some cases, you might not be able to preview video attachments recovered for these artifacts. For more information about a workaround for viewing video attachments for TamTam Messenger, log in to the Customer Portal to review the following article: Reviewing video files from TamTam Messenger. [3.0.0]
- Updated Exif-enabled artifacts, such as Pictures and Videos, to include a new Exif Data fragment. The data for the Exif Data fragment are raw Exif value. For more information, log in to the Customer Portal to review the Exif data fragment for Exif-enabled artifacts article.
- WeChat | Android: Updated decryption support for messages and friends. [7.0.17]
- WickrMe | Android: Updated support to carve database files for deleted messages. [5.63.10]
- Yahoo Mail | Android: Updated support for recovering emails and user accounts. [6.12.1]
Bug fixes
- In some cases, V1 decryption would fail for the Private Photo Vault artifact for an iOS acquisition. -MA-2715
- The “Category” fragment for the following artifacts is now called “Type”: Installed Applications (iOS and Android), Pebble (Android), Pinterest (iOS and Android), Google Toolbar (Windows Computer and macOS), Pidgin (Windows Computer), Finder Sidebar (macOS). -MA-2578
- The “Category” fragment the following Windows computer artifacts is now called “Type”: Ares Shared Files, Ares Downloads, and Areas Incomplete Downloads”. -MA-2577
- The “Comments” fragment for the following Windows computer artifacts is now called “Comment”: Calc Documents, Excel Documents, Impress Documents, PowerPoint Documents, Shareaza Library Files, Word Documents, and Writer Documents”. -MA-2575
