MacForensicsLab Inc. is pleased to announce the immediate availability of version 3.0 of MacForensicsLab for Mac OS X.
Maintenance contract customers will recieve a package with a new USB dongle for version 3.0.
License owners that have purchased MacForensicsLab after January 1st 2010 are entitled to receive a free upgrade to version 3.0. Please contact sales@MacForensicsLab.com for more information about upgrading.
Changes and Updates in version 3.0
MacForenicsLab 3.0 once again ups the standard for Mac forensics tools. The new version brings many new features along with rock solid stability and big speed improvements.
The latest version of MacForensicsLab features redesigned core functions making it faster to zero in on suspect evidence with a easier and more intuitive interface. The industry standard in Macintosh-based forensics just got better. With over twenty new features, such as hashing and data carving throughout the application along with improved stability and speed, MacForensicsLab 3.0 is the of the must have tool for Mac forensics.
Changes include:
- The new Analyze window now defaults to ASCII view instead of Hex view to make viewing easier. It now features a larger viewing window to allow the investigator to view a block of data at a time.
- With the addition of a hash button on the main screen, investigators can now hash anything from anywhere.
- Data can now be highlighted and carved out for further analysis. The user can now also scroll a block at a time to aid in carving data.
- The user can now export and save any tile from any function window within MacForensicsLab.
- The skin tone analysis function now features a sliding bar to make adjusting the skin tone percentage of images shown easier. Simply use the slider bar to display images with a greater or lesser percentage of skin tone within them.
- The main window now features a new interface that divides device view and file view to make viewing entire devices or specific files easier then before.
- The device view now notes the system drive for the user to avoid analyzing the contents of the investigation machine's main drive.
- The user may now apply skin tone analysis to the results of a browse operation to help narrow down files that may be of interest.
- Results of the Audit function can now be reported to a separate HTML and/or text document from the main investigation report. The Audit results can also be saved or exported out.
- MacForensicsLab 3.0 brings big speed improvements with some functions being carried out up to 12 times faster then in previous versions.
- MacForensicsLab 3.0 now offers full support for Apple's newest operating system Mac OS X 10.6 - Snow Leopard. It also offers more robust stability and fixes compatibility issues.
- This new version of MacForensicsLab has redesigned the allocation of memory to prevent system freezes due to memory leaks and/or inefficient memory allocation by the operating system. (This feature requires the user to have Apple's XCode installed. XCode is freely available from Apple by signing up for a free Developer account.)
- System information is now displayed across the bottom of the screen on the main window. This information includes time and date, memory usage, and system uptime.
- The floating location bar that showed the device or file a user was currently working with in MacForensicsLab 2.5 has been removed.
- The Acquire function window has been totally redesigned with an easier and more intuitive look and feel.
- When using the Acquire function, investigators may now save the acquired image and golden master to separate volumes.
- The Acquire function's acquisition engine is now 64-bit to take full advantage of Snow Leopard and the power of the Intel processor.
- The limit on the size and number of keywords within the Analyze function has been increased to 128. The function is now 64-bit for speed and scalability.
- Investigate a suspect disk image with the new Shadow File function to emulate the disk being writable without actually writing to the disk itself.
- When investigating a suspect disk image, the user can now choose to ignore permissions. This maintains the permissions data but ignores them, giving the investigator access to any user files in all parts of the software.
