Release Channels

Stable 3.0.0

Use this release if you want a stable and rigorously tested release. The only changes made to this channel between releases are bug fixes and security related updates to libraries and runtimes.

Release Candidate 3.1.x

Use this release if you want access to new functionality not found in the stable release.

Evimetry releases progress on two channels. The stable channel is lab and field tested, receiving minor updates to fix security and other bugs. The pre-release channel is for lab testing of new functionality.

It is recommended that you use a Stable release as the basis of your practice, and validate its operation independently.


Release 3.0.9

Released Monday, 9 April 2018

Fixes

  • Prevent filesystem bridge reads from timing out on highly contended devices.
  • Fix acquisition halting for striped images larger than 2TB.

Known Issues

  • Filesystem Bridge doesn't autostart on Windows 10.
Download from Portal Link to this Release


Release 3.0.8

Released Tuesday, 14 Mar 2018

Enhancements

  • Updated progress bar in Controller to show Orange instead of red in event of IO errors during activity.
  • Warn is Cloud Agent is provisioned with too little memory.
  • Warn on partition layout of Deadboot creation if target is 2TB+

Fixes

  • Limit Header metadata in E01/EWF's converted from AFF4 so Encase doesn't complain.
  • Update Windows Controller installer to handle broken Dokan installations.
  • Numerous UI bugfixes.
  • More verbose logging.

Known Issues

  • Filesystem Bridge doesn't autostart on Windows 10.
Download from Portal Link to this Release


Release 3.1.6-UNSTABLE

Released Wednesday, 14 March 2018

Features, fixes and improvements

  • Same as 3.0.8

Known Issues

  • Filesystem Bridge doesn't autostart on Windows 10.
Download from Portal Link to this Release


Release 3.0.7

Released Tuesday, 14 Feb 2018

Fixes

  • Fix network performance regression.

Known Issues

  • Filesystem Bridge doesn't autostart on Windows 10.
Download from Portal Link to this Release


Release 3.1.5-UNSTABLE

Released Wednesday, 14 Feburary 2018

Major Features

  • Deadboot Imager: GUI Imager uses larger fonts.
  • Controller: Native Deadboot creation from within Controller (beta). Allows the creation of a single disk acting as both a Deadboot Agent/Imager .

Fixes and improvements

  • Filesystem Bridge: Significant speed improvements.
  • All fixes and improvements to 3.0.7

Updates

  • Dead Boot Agent+Controller: Update to Oracle Java 8u162.

Known Issues

  • Filesystem Bridge doesn't autostart on Windows 10.
Download from Portal Link to this Release


Release 3.0.6

Released Thursday, 1 Feb 2018

Major features

  • Implement Dead Boot Agent ISO to USB writer for Windows Controller (beta). Limited to working with empty USB drives.
  • Portable Controller Windows x64 for running directly off a USB drive (beta).

Improvements

  • Reverse connection with Deadboot Agent able to retry infinitly if no connection.
  • Improve AFF4 Verification engine to better handle verification of corrupt images, warn of missing containers in a striped set, and other failure conditions.
  • Various Controller UI usability improvments.
  • Log more details about agent network interfaces, ciphers used, and client certificate details.
  • Improved i8n support in case notes and log files.
  • More specific error messages throughout.
  • Dokan installation is disabled if already present, and fixed if driver not registered.
  • Update Dead Boot Agent to Linux kernels 4.9.0 and 4.11.3.

Fixes

  • Correct UI issue where acquisitions with rate exceeding 5000 MB/s showed as 0.0MiB/s
  • Fix virtual drive automount failure in some circumstances, and slowdowns under high load.
  • Fixed allocated-only acquisitions missing content for NTFS volumes on non-partitioned removable media.
  • Fix i8n issue when converting AFF4 image metadata to E01.
  • On shutdown of dead boot agent without first unmounting, save logs to evidence storage drive.

Known Issues

  • Image transfer over network between Deadboot Agent and Windows based Controller is very slow (regression).
  • Filesystem Bridge doesn't autostart on Windows 10.
Download from Portal Link to this Release


Release 3.1.3-UNSTABLE

Released Friday, 15 Sept 2017

Major Features

  • ALL: Multi-channel network connections for faster network communications.
  • Dead Boot Imager: Shift to XWindows based GUI rather than text GUI (some EFI implementations don't support text UI's).
  • Controller: Enable user settable priorities for non-linear acquisition.
  • Controller: iMEM endpoint enabling live analysis of volatile memory (ALPHA).

Fixes and improvements

  • Controller: Update licence display to simplify communication of licence entitlements.
  • ALL: Improved memory consumption across the board.
  • Dead Boot Agent: Update to kernels 4.4.0-79 and 4.11.3.
  • Light Agent (Linux): handle KASLR on linux kernel 4.11+ for physical memory acquisition.
  • Light Agent (Windows): correct intermittent device enumeration stringify bug.

Updates

  • Dead Boot Agent+Controller: Update to Oracle Java 8u131.
Download from Portal Link to this Release


Release 3.0.5

Released Tuesday, 28 Nov 2017

Fixes & Improvements

  • Light Agent (Linux): Volatile memory acquisition now includes /proc/iomem & /proc/kallsyms.
  • Light Agent (Linux): Fix segfault in network device enumeration for tunneled network interfaces.
  • Light Agent (Windows): Fix device enumeration failure for some USB based multi-function card readers.
  • Light Agent (All): More robust error handling on device enumeration.
  • Controller: Fix reporting of image size during verification of very small images.
Download from Portal Link to this Release


Release 3.0.4

Released Tuesday, 31 Oct 2017

Fixes

  • Controller: Fixed a regression in virtual drive unmounting, which prevented unmounting the virtual disk. Primarily occurred when a Windows 8.1 or 10 based analysis workstation accessed a virtual disk containing NTFS volume snapshots.
  • Controller+Dead Boot Agent: Fixed an error verifying very old pre-standard AFF4 images.
  • Controller: Fixed high CPU usage on Windows 7 when no dongle present
Download from Portal Link to this Release


Release 3.0.3

Released Friday, 13 Oct 2017

Fixes

  • Fix excessive memory usage during verification in some instances.
  • Fix virtual drive unmounting issue with Controller -> Light Agent sharing in some circumstances.
Download from Portal Link to this Release


Release 3.0.2

Released Friday, 15 Sept 2017

Fixes and improvements

  • Controller: Update licence display to simplify communication of licence entitlements.
  • Light Agent (Linux): handle KASLR on linux kernel 4.11+ for physical memory acquisition.
  • Light Agent (Windows): correct device enumeration bug which occasionally prevented identification of storage devices.
Download from Portal Link to this Release


Release 3.0.1

Released Monday, 17 July 2017

Fixes and improvements

  • Improved memory consumption with light agent.
  • Fix Deadboot Agent -> Controller acquisition not honoring user requested abort.
  • Update TLS handshake to use AES256-GCM by default.
  • Correct disk share performance issue with Deadboot Agent -> Controller acquisition.
Download from Portal Link to this Release


Release 3.0.0

Released Monday, 22 May 2017

Major Features

  • Remote physical memory acquisition for Windows, MacOS and Linux.
  • Default image format is now AFF4 Standard v1.0
  • Support for HiDPI / Retina Displays.
  • Updated Linux kernel to 4.9.0 on Deadboot ISO.
  • Improved speed on striped images.
  • Beta release of MacOS Controller.

Fixes and improvements

  • Improved Multi-lingual support.
  • Improved compatibility with Linux iSCSI Initiators.
  • Improved performance of AFF4 Container verification.
  • UX simplification around evidence storage device unlocking and repository management.
  • Added pre-flight checks for potential issues that the user may experience.
  • Default TLS certificates issued with a wide valid date range so computers with bad BIOS times can still be communicated with.
Download from Portal Link to this Release


Release 3.0.0-RC6 (UNSTABLE)

Released Monday, 1 May 2017

Fixes

  • Fix regression in iSCSI virtual disk on Windows 10.
Download from Portal Link to this Release


Release 3.0.0-RC5 (UNSTABLE)

Released Friday, 7 April 2017

Major Features

  • Remote physical memory acquisition for Windows, MacOS and Linux.
  • Default image format is now AFF4 Standard v1.0
  • Support for HiDPI / Retina Displays.
  • Updated Linux kernel to 4.9.0 on Deadboot ISO.
  • Improved speed on striped images.
  • Beta release of MacOS Controller.

Fixes and improvements

  • Improved Multi-lingual support.
  • Improved compatibility with Linux iSCSI Initiators.
  • Improved performance of AFF4 Container verification.
  • UX simplification around evidence storage device unlocking and repository management.
  • Added pre-flight checks for potential issues that the user may experience.
  • Default TLS certificates issued with a wide valid date range so computers with bad BIOS times can still be communicated with.

Updates

  • OpenSSL 1.0.2k
  • Oracle JRE 8u121
Download from Portal Link to this Release


Release 2.1.7

Released Tuesday, 4 April 2017

Bug fixes

  • Update default TLS certificates due to certificate expiry.
  • Default TLS certificates issued with a wide valid date range so computers with bad BIOS times can still be communicated with.
Download from Portal Link to this Release


Release 2.1.6

Released Friday, 24 Feb 2017

Bug fixes

  • Fix device enumeration with Wiebetech USB3 write blocker on Windows.
  • Fix EWF segment enumeration for very large images.
Download from Portal Link to this Release


Release 2.1.5

Released Tuesday, 2 Feb 2017

Bug fixes

  • Update interoperability of Licence Dongle with RDP redirection.
  • Improve robustness of virtual disk mounter in presence of existing iSCSI configurations.

Additions

  • Improve Multi-lingual support.
Download from Portal Link to this Release


Release 2.1.4

Released Tuesday, 22 Nov 2016

Bug fixes

  • Fix performance regression in filesystem bridge.
  • Fix virtual disk sharing incompatibility with Encase 6.19.
  • Correct persistent paths in file system bridge when folders contain spaces.

Additions

  • Release Light Agent x64 build for Microsoft Windows.

Updates

  • Oracle Java 8u102.
Download from Portal Link to this Release


Release 2.1.3

Released Thursday, 18 Aug 2016

Bug fixes

  • Improve memory resource usage during allocated acquisitions on very large and heavily fragmented file systems.

Changes

  • Improve memory consumption post acquisition with Light Agent.
Download from Portal Link to this Release


Release 2.1.2

Released Friday, 29 July 2016

Bug fixes

  • Fixed failed unmount of evidence drive when using striped images in some circumstances.

Changes

  • Change error dialog with exception stack trace to be more readable.
  • Correct Controller displaying local host address as node address on Ubuntu 16.04+.

Additions

  • Enable the use of USB network adapters on Dead Booted Agents.
  • Enable image conversion sessions to be paused on the Controller.
  • Add Dead Boot Agent variant based on the Linux Kernel 4.2.0, useful for very recent hardware.
Download from Portal Link to this Release


Release 2.1.1

Released Monday, 25 July 2016

Bug fixes

  • Correct invalid characters in iSCSI transport for remote images in some instances.

Changes

  • Improve memory resource usage during non-linear partial acquisition.
Download from Portal Link to this Release


Release 2.1.0

Released Monday, 13 June 2016

Bug fixes

  • Improve reliability of FileSystem Bridge in network operations.
  • Improve memory consumption during Non-Linear Object based acquisitions on very large volumes.
  • Improve compatibility with EnCase 6 for generated EWF files

Changes

  • Queries.yaml schema includes descriptions/attributions
  • Improve startup performance of allocated region acquisition with EXTx based filesystems.
  • Improve high memory usage notification to the user. (Filesystem Bridge).
  • Improve scanning time of mounted repositories on the Controller and Filesystem Bridge.

Additions

  • Added logging option for matches of objects acquired during Non-Linear Object based acquisition. (Useful for developing and debugging object patterns)

Updates

  • OpenSSL 1.0.2h
  • Oracle Java 8u92
Download from Portal Link to this Release