Forensic Email Collector v3.60 Release Notes

Hello, everyone!

We’ve released a new version of FEC today and I thought I would write a quick post to describe what’s new!

Drive Attachment Deduplication

One of the major hurdles to clear during cloud attachment acquisitions is throttling. This is partly because cloud attachments are often larger in size compared to emails, and they tend to trigger API and rate limits very quickly once you start acquiring many of them in quick succession.

In FEC’s previous major release, we added support to acquire contents of entire shared Drive folders, including any subfolders, recursively. As you can imagine, a Drive folder can contain thousands of items, further increasing the chances of throttling.

A common pattern that emerged in our testing is duplication. We have found that within a mailbox, the same Drive items are often referenced multiple times. For instance, imagine that the end-user sent multiple emails to different people sharing the same Drive folder. You would encounter multiple distinct email messages in your acquisition that contain the same Drive attachment. And, since the Drive attachment in this example is a folder, identical items within the folder—and perhaps their revisions depending on your acquisition setup—would be referenced in your acquisition multiple times.

FEC now contains an additional option to collapse duplicate Drive items. If you choose this option, FEC will identify any duplicates by their Drive IDs. A set of duplicate Drive items will be collapsed to one and acquired only once. However, the acquired item will still be output multiple times—at each output location where it is needed.

This way, you would minimize the data you request from Drive API while maintaining the same output contents and structure. This has resulted in significant time savings in our test mailboxes. Excited to hear about your experience!

Additional Sharing Metadata for Drive

FEC’s Downloaded Drive Attachments Log contains metadata acquired from Drive attachments. We have extended the metadata fields to include sharing information. The additional metadata help answer questions such as:

  • Was the file shared?
  • Did the target user receive the file via sharing?
  • Who shared it with them?
  • When?

Improved Project Creation Speed

One of the first things FEC does when you set up a new project is to create a new project file (.FECProj). This happens quite quickly in the background, often in the blink of an eye. However, the amount of time taken to create hundreds of project files—when setting up batch acquisitions—can add up to more than a few seconds. We have done some optimizations so that the additional projects can be created lightning fast!

Server Search Cap Detection

Some email servers can artificially cap in-place search results silently. For example, here is a Microsoft support topic that details an issue in some versions of on-prem Exchange 2013 servers where the server caps the search results at 250 items. According to the article, the issue can be resolved by installing an update and making a configuration change.

FEC now watches out for such artificial search result caps and points them out in its Acquisition Log.

As usual, this new release contains a slew of under-the-hood performance and UI improvements. I hope these help make your life easier! :smiley:

We have added/updated the following support articles in connection with this release:

:link: Acquiring Google Drive Attachments of Emails