• 0Shopping Cart
Digital Detective
  • Home
  • Corporate
    • About Us
      • Executive Team
      • Our Clients
      • Testimonials
    • News and Events
      • Latest News
      • Press Release
    • Legal
      • Privacy Policy
      • Cookie Policy
      • Returns Policy
  • Products
    • Forensic Software
      • NetAnalysis®
      • HstEx®
      • Blade®
    • Downloads
      • Evaluation Request
      • Free Digital Forensic Tools
    • Product Documentation
      • NetAnalysis® Documentation
      • HstEx® Documentation
      • Blade® Documentation
  • Careers
  • Support
    • Knowledge Base
    • Support Portal
    • Digital Forensics Forum
  • Store
    • Forensic Software
    • View Shopping Cart
  • Blog
  • Contact Us
  • Search
  • Menu Menu

Blade® v1.8 Release Notes

Blade®, Data Recovery, Digital Forensics, Digital Foresnsic Software, Forensic Analysis
Digital Detective Blade® logo on top of a open hard disk drive

Introduction to Blade® v1.8

This release of Blade has a number of new features and improvements.  We have added 8 new Data Recovery Profiles to the Global Recovery Database, as well as releasing some new Professional Modules.  We have released a new 3GP/MPEG-4/ISO Base Media Format Intelli-Carve® Recovery Profile for the recovery of MP4/3GP video files.  This is particularly useful for those of you involved in the forensic examination and recovery of data from cell/mobile phone hex dumps or memory cards.

User Interface

We have made some minor updates to the user interface of Blade to make it easier to identify Global, Personal and Intelli-Carve® Recovery Profiles.  As you can see from screen below, different types of recovery profiles are represented by different icons.

Digital Detective Blade v1.8 Professional

Select Profile Categories

We have added the option to select recovery categories as well as individual recovery profiles.  This option is available from the Tools menu; select the category you wish to recover (e.g. common graphic types) and this will auto-select the profiles from that category.  To clear all of the selected profiles, simply select Clear from the Categories menu or press F5.  We have not added an option to select all profiles as it would not be practical to attempt to recover every supported file type (this would not make sense from a forensic perspective).

Unique Output Session Folders

In previous versions of Blade, if you attempted to extract data into a folder that had already been used, Blade would report that the folder was not empty and not permit the folder to be used; this can be a torment for examiners if they wish to keep all of the extracted data together.  To solve the issue, Blade now creates a session folder for every extraction.  This means that multiple passes across the same data source can be kept neatly together within a single folder.

Cancel / Partial Recovery Option

We have added this feature at the request of a number of our users.  Sometimes it is difficult to get your personal recovery profiles working correctly, particularly if they use complicated regular expressions.  Having to wait until the whole disk or image is processed to find out if they have worked correctly is extremely time consuming.  We have now added an option to perform a partial recovery on pressing cancel during the search phase (pass one).  If data headers have been identified during the search phase, Blade will prompt the user to recover that data.

In addition, we have added an option to automatically open the export folder once the extraction has completed.  This allows you to quickly open the folder and start examining the recovered data.

Recovery Profiles

We have made a number of changes to the Recovery Profiles to add additional functionality.  Figure 2 shows the new Personal Profile screen.

In the File Header section, we have added a new field for the number of bytes to the Start of the File (Bytes to SOF).  This value can be positive or negative and represents where the start of the file is in relation to the File Header Signature.  This takes into account data where there is a recognisable pattern or structure x bytes into the file, but no static header exists.

Add_New_Recovery_Profile

We have added a secondary File Landmark Section for additional data validation.  We have put this to good use for the recovery of Microsoft Office 2007 documents.

And finally, we have added a new field to take into account length adjustments for data types which contain length markers.  In the Data Length section, you can see the Length Marker Adjustment field.  This value can also be positive or negative.  We have put this into good use with AVI files where is a UInt32 length marker at offset 0x04.  This marker provides the length of the data following the header but does not take into account the four bytes containing the length marker or the header itself.  This meant that the AVI files recovered were 8 bytes too short.  Now you can add a length marker adjustment to add the missing 8 bytes back on to the file.

3GP/MPEG-4/ISO Base Media Format

ISO base media file format defines a general structure for time-based multimedia files such as video and audio.  It is used as the basis for other media file formats (e.g. container formats MP4 and 3GP).  ISO base media file format was specified as ISO/IEC 14496-12 (MPEG-4 Part 12).

Blade now contains an Intelli-Carve profile® which reads and validates the recovered data prior to writing it out.  In addition, Blade also recovers the metadata from each file and can write it out to a CSV log.  This is particularly useful for recovering date/time information from video data where the video has been recovered from unallocated clusters.  To set the metadata extraction options, right click on the recovery profile.

Blade also identifies the type of media file and appends the correct file extension.  The table below contains a list of file extensions which are supported.

3GP/MPEG4/ISO Base Media Format Specification Extensions
3gp, 3g2, dvb, f4v, f4p, f4a, f4b, jp2, jpm, jpx, m4v, m4p, m4a, m4b, mj2, mqv and mov

INFO2 Record Extraction and Deconstruction

We have added a new Professional Recovery Module for the recovery and deconstruction of INFO2 records (Recycle Recovery for Vista/Windows 7 in final QA and testing and will be released in Blade v1.9).  This recovery module has a number of output options.  The profile recovers INFO2 records relating to deleted files and writes the various fields out to a number of different formats.  The capture below shows the options which are available for this module.

Blade Forensic Data Recovery INFO2 Extraction Properties

The INFO2 extractor is bundled as part of the Link File Recovery module and is available to all Blade Professional users.  This module fully supports Unicode data.

Cryptographic Hashing

We have also added a hashing module which will work with a number of sources including forensic images (note: if you wish to MD5/SHA1 hash the content of an EnCase® e01 image, please use the e01 Conversion Module which has an option to hash the internal data from an EnCase® image and check it against the embedded hash without having to convert the image).

Supported Cryptogtaphic Hashing Algorithms
MD5, SHA1, SHA256, SHA384, SHA512 and RIPEMD160

To select the required hashing algorithms, right click on the module, select module properties and tick the required values.  Select the required source file or image (e.g. segmented image file *.001) and then an export folder which will contain the hashing report.

Further Information

  • Blade® v1.8 Release Notes
  • Blade® v1.8 Change Log
  • Buy Blade®
16th December 2010/by Craig Wilson
Tags: Change Log, Hashing, INFO2, MPEG4, Release Notes
Share this entry
  • Share on Facebook
  • Share on Twitter
  • Share on WhatsApp
  • Share on Pinterest
  • Share on LinkedIn
  • Share on Tumblr
  • Share on Vk
  • Share on Reddit
  • Share by Mail
You might also like
Digital Detective Blade® logo on top of a open hard disk drive Blade® v1.11 Released
Digital Detective HstEx® featured image HstEx® v3.7 Released
Digital Detective Blade® logo on top of a open hard disk drive Blade® v1.15 Released
Digital Detective NetAnalysis® globo logo on top of a browser window NetAnalysis® v2.1 and HstEx® v4.1 Released
Digital Detective Blade® logo on top of a open hard disk drive Blade® v1.12 Released
Digital Detective NetAnalysis® globo logo on top of a browser window NetAnalysis® v3.1 Released
Digital Detective Blade® logo on top of a open hard disk drive Blade® v1.10 Released
Digital Detective Blade® logo on top of a open hard disk drive Blade® v1.13 Released

Categories

Recent Posts

  • DataDump™ – Data Extractor
  • NetAnalysis® v3.3 and HstEx® v5.3 Released
  • NetAnalysis® v3.2 and HstEx® v5.2 Released
  • Forensic Analysis of the Zone.Identifier Stream
  • NetAnalysis® v3.1 Released

Tags

ACPO AOL Big Endian Browser Evidence Byte Order Cache Case Study Change Log Cookies Data Extraction Data Recovery Data Recovery Profiles Date & Time Digital Evidence Discount Dongles Email Recovery Endianness File System Find Panel Free Good Practice Guidelines Hard Disk Head Swap Image Mounting Intelli-Carve Internet Explorer Junction Points Legal Licensing Little Endian Microsoft Windows Mozilla Firefox News NTFS Offer PFC Release Notes Seagate Search Syntax Timestamps Tools Tutorial

About Us

Digital Detective enhances digital forensic science though cutting edge research and development. We offer a range of products and services for digital forensic analysis and advanced data recovery.

Recent Tweets

Exciting news! Our popular #DataDump tool just got even better with the release of v2.1. Download now for free and experience the difference! #freetool #dataextraction digital-detective.ne…

About 3 weeks ago from Digital Detective's Twitter via Twitter Web App

Nothing seems to have changed in the last 13 years. lbc.co.uk/news/polic…

About 2 months ago from Digital Detective's Twitter via Twitter Web App

This has been a lot of work; hope you like it. NetAnalysis® v3.3 and HstEx® v5.3 have been released. Lots of new functionality! digital-detective.ne…

About 3 months ago from Digital Detective's Twitter via Twitter Web App

Her Majesty The Queen Elizabeth II 1926 - 2022 pic.twitter.com/sWSC…

About 5 months ago from Digital Detective's Twitter via Twitter for iPad

Recovery and analysis of MFT resident Zone.Identifier alternate data streams and how they are helpful in a forensic investigation. #DFIR #DigitalForensics #BrowserForensics #FileSystemAnalysis digital-detective.ne…

About a year ago from Digital Detective's Twitter via Twitter Web App

Follow @DigitalDetectiv

Select Language

Translate our site by selecting your language from the option below.

en English
ar Arabiczh-CN Chinese (Simplified)nl Dutchen Englishfr Frenchde Germanit Italianpt Portugueseru Russianes Spanish

Contact Us

Digital Detective Group
Motis Business Centre
Cheriton High Street
Folkestone
KENT, CT19 4QJ
United Kingdom

///courts.endearing.bulbs
+44 (0) 20 3384 3587

Copyright © 2001 - 2023 Digital Detective Group Limited
  • Facebook
  • Twitter
  • Youtube
  • Mail
  • Home
  • Sitemap
  • Corporate
  • Products
  • Store
  • Blog
  • Contact
Scroll to top

This site uses cookies. By continuing to browse the site, you are agreeing to our use of cookies.

OKLearn more

Cookie and Privacy Settings



How we use cookies

We may request cookies to be set on your device. We use cookies to let us know when you visit our websites, how you interact with us, to enrich your user experience, and to customize your relationship with our website.

Click on the different category headings to find out more. You can also change some of your preferences. Note that blocking some types of cookies may impact your experience on our websites and the services we are able to offer.

Essential Website Cookies

These cookies are strictly necessary to provide you with services available through our website and to use some of its features.

Because these cookies are strictly necessary to deliver the website, refuseing them will have impact how our site functions. You always can block or delete cookies by changing your browser settings and force blocking all cookies on this website. But this will always prompt you to accept/refuse cookies when revisiting our site.

We fully respect if you want to refuse cookies but to avoid asking you again and again kindly allow us to store a cookie for that. You are free to opt out any time or opt in for other cookies to get a better experience. If you refuse cookies we will remove all set cookies in our domain.

We provide you with a list of stored cookies on your computer in our domain so you can check what we stored. Due to security reasons we are not able to show or modify cookies from other domains. You can check these in your browser security settings.

Google Analytics Cookies

These cookies collect information that is used either in aggregate form to help us understand how our website is being used or how effective our marketing campaigns are, or to help us customize our website and application for you in order to enhance your experience.

If you do not want that we track your visit to our site you can disable tracking in your browser here:

Other external services

We also use different external services like Google Webfonts, Google Maps, and external Video providers. Since these providers may collect personal data like your IP address we allow you to block them here. Please be aware that this might heavily reduce the functionality and appearance of our site. Changes will take effect once you reload the page.

Google Webfont Settings:

Google Map Settings:

Google reCaptcha Settings:

Vimeo and Youtube video embeds:

Other cookies

The following cookies are also needed - You can choose if you want to allow them:

Privacy Policy

You can read about our cookies and privacy settings in detail on our Privacy Policy Page.

Privacy Policy
Accept settingsHide notification only