Forensic Email Collector v3.14 Released

FEC v3.14 just dropped! The main new feature introduced in this version is the ability to limit Google Drive revision acquisition to the latest revision before the sent date of the parent email :+1:t2:

This came as a feature request from many of you as soon as we announced Drive attachment acquisition capabilities last year. As you can imagine, files that are stored on Drive are live and can continue to be modified after an email referencing the Drive files as attachments is sent. In a nutshell, this feature allows you to, in a way, roll back the time and get the latest version of the Drive file before the email was sent, to the extent it is available.

A couple of interesting notes:

  1. In order to acquire Drive revisions, you also need to acquire Drive attachments. The standard Drive attachment acquisition will give you the latest (i.e., current at the time of acquisition) version of the Drive attachment. So, if you use the new functionality, you would get the latest version of the Drive attachment as part of the Drive attachment acquisition, and the latest revision before the sent date of the email as part of the revision acquisition.

  2. If multiple messages reference the same Drive attachment, a different Drive revision may be acquired for each parent message as the revision acquisition is a function of the sent date of the parent message when this new option is selected.

Needless to say, if you uncheck the “Fetch Only the Latest Revision Before Parent was Sent” option, FEC will function as it did previously and acquire all of the Drive revisions.

You can find the complete list of changes in FEC’s changelog. The download links in the community have been updated to point to the latest version.

2 Likes

We have updated the following articles to reflect the new changes:

Acquiring Google Drive Attachments of Emails
Using The Unified Query Builder

Hí Arman!
Thank you for your work and the new π version. :slight_smile:
All the best:
Z :slight_smile:

1 Like