Forensic Email Collector 4.0.110 Release Notes

We have released a new version of FEC 4 this week. This update improves FEC’s Direct Drive acquisition workflow and adds a few quality of life improvements :grin:

Fetch Only the Latest Revision before Target Date

Acquiring a specific Drive revision is key when working with modern attachments. We have added the same capability to Direct Drive acquisitions so that you can now supply a target date for all or some of the Drive items, and request that the latest revision before that date be acquired.

The Target Date is supplied via a Differential Acquisition in Inclusion Mode. You can read more about this here. You are able to supply precise dates, including time zone information.

Flat Folder Structure for Direct Drive

We have added an option to output acquired Direct Drive items in a flat folder structure instead of a folder structure that reflects the original folder path for each Drive item. When this option is selected, the Drive item will be named after its Drive Service ID.

New Drive Metadata Fields

FEC now captures over 10 new metadata fields during Drive Attachment and Direct Drive acquisitions. The additional metadata is included in FEC’s Downloaded Drive Items Log.

Google Granular Consent

I previously mentioned that Granular Consent was coming up for Google. We have added support for this new modern authentication workflow in FEC so that you are not caught by surprise.

Post-Acquisition PST Split

It is now possible to change output PST split settings post acquisition. This helps in scenarios where PST output options were not specified in the first place, or when project parameters change after the fact.

IMAP ID Support

We recently became aware that 163.com requires IMAP ID and (improperly) throws the following error in its absence:

EXAMINE Unsafe Login. Please contact kefu@188.com for help (NO).

Although this signals an incorrect implementation of the IMAP ID extension by that provider, we added IMAP ID support to FEC to enable acquisitions from 163.com, and any other providers that may choose the same path.

For a complete list of changes, please refer to our changelog . You can grab the installer :lock: here .