Version 3.4 Released Halloween 2022

• The Registry node in the Data Triage has been completely reorganized to make access to the important keys easier for an investigator and reflect the investigation process. Now, it includes the following categories of keys:
  o Amcache (raw)
  o AppCompatFlags
  o Auto-run
  o DEFAULT user
  o Devices
  o Network Connections
  o Programs
  o Recently Used Files
  o RunVirtual
  o Search and Navigation
  o Security
  o Scheduled tasks (raw)
  o Shimcache
  o SRUM
  o System
  o Users Accounts
  o Winlogon
• More than ten new registry keys have been added to new and existing categories in Data Triage.
• Other categories of Data Triage have been reorganized to make navigation easier.

• Full Android 13 support has been added for logical and physical acquisition.
• Support of ADB backup import for Android 13 has been added.
• Full iOS 16 support has been added for logical acquisition.
• Support of iOS 16 encrypted and not-encrypted backups import has been added.
• Import of GrayKey cases with iOS 16 and Android 13 data has been added.
• iMessages parsing has been improved to reflect new iOS 16 features such as message editing, deleting, and recalling for iOS 16 logical acquisition.
• The progress displayed during the GrayKey iOS case import was improved to make it less confusing for the user and to reflect the real process more clearly.

• New import of Instagram cloud data from the private accounts has been added. Now, you can import such Instagram data as:
  o Account Info
  o Following
  o Followers
  o Posts
  o Archived Stories
  o Chats
• New import of Skype cloud accounts is allows importing such data as:
  o Contacts
  o Individual and group chats
• The authentication flow has been changed for cloud import from Gmail and Google Drive to incorporate new security verification from Google.
• Remote Cloud Collector connection security has been enhanced.
• Potential issues with receiving the Friends list during the Facebook cloud import have been resolved.
• A special mechanism for temporary storing authentication tokens in the encrypted database has been implemented to minimize the risk of account blocking by cloud services due to repeated login attempts with credentials.

• No changes this release.

• A new OSINT Cloud Import wizard has been added for analyzing OSINT data stored on the cloud-based services.
  • Support of public Instagram accounts investigation (OSINT) has been added. Now, you can import and analyze such data as:
  ▪ Account Info
  ▪ Following
  ▪ Followers
  ▪ Posts
  • Support of private Instagram accounts investigation in case when the follower’s credentials are known has been added.
• Twitter OSINT cloud import allows the collecting of the following data from any public Twitter accounts:
  o Profile Info
  o Own Tweets
  o Tweets and Replies