Forensic Email Collector 4.0 Release Notes

FEC has finally made it to v4 with some long-awaited new features! Here is a quick walkthrough of what’s new and exciting. :grin:

Direct Drive Acquisitions

In addition to targeting Google Drive attachments (and revisions) of emails, FEC can now target Google Drive directly. In other words, you can now acquire Drive items without even setting up an email acquisition at all. :muscle:t2:

As usual, FEC brings to the table In-place Search, enterprise authentication, and Differential Acquisition capabilities. For instance, you can perform Drive acquisitions from a target organization using domain-wide delegation of authority or Remote Authentication, and narrow the Drive data down using detailed In-place Searches.

Here is how Direct Drive looks on the folder tree:

As seen in the screenshot above, FEC also supports shared Drives!

Google Takeout

We introduced Local Vault exports as an acquisition provider in FEC v3.89. FEC 4 takes this a step further by adding support for Google Takeout exports.

Similar to the Local Vault Export workflow, FEC’s Takeout workflow allows label-based foldering, EML / MSG / PST output, Inline Search, Differential Acquisition, and decryption.

Enhancements to Local Vault

We have improved FEC’s Local Vault acquisitions by adding support for the error.csv file exported by Vault and with a new option to Explore Mailboxes.

Support for error.csv allows passthrough exception reporting. In other words, if Vault failed to export a file and reported errors about it, FEC passes that information through to its own Exception Log.

The Explore Mailboxes user interface quickly scans the Vault export for a list of targets, and allows configuring batch acquisitions.

Embedded Modern Authentication Webview

FEC now provides the option to use an embedded browser for modern authentication to improve cookie isolation. This can be activated from FEC’s preferences:

When activated, FEC will no longer launch the system web browser to authenticate with Microsoft or Yahoo / AOL via OAuth. For Microsoft, the embedded webview looks as follows:

Other Notable Improvements

With v4, FEC switched to .Net 8 and now brings its dependencies to the target system (i.e., no separate .Net Framework installation is needed). The switch to .Net 8 also brings significant performance improvements per se.

FEC’s user interface received a refresh. Particularly, the in-app help bubbles are now easier to use and can provide detailed information beyond plain text.

If you would like to learn more, you can watch our FEC 4 Technology Showcase here:

For a complete list of changes, please refer to our changelog . You can grab the installer :lock: here .