Forensic Email Intelligence v1.5 Release Notes

We have released FEI v1.5 today! Here is a quick overview of what’s new: :smiley:

FEI Decoder

The MIME and Headers tabs in FEI Viewer now have a right-click context menu that can be used to decode data points of interest. FEI Decoder currently supports Base64-encoded strings and timestamps—we will likely expand its functionality to cover many other types of hidden data one can encounter within emails (we are open to suggestions!).

I am particularly excited about the timestamp decoding capability. You can throw just about any timestamp at FEI Decoder and watch it decode it multiple ways with varying Endianness and resolution and show you a list of possibilities sorted by confidence. I’ve found this to be a great way to unearth frequently-overlooked timestamp types.

Here is a quick example:

Any other timestamp types you encounter during email examinations? Let us know! :wink:

Data Exports

It is now possible to export data from FEI’s Intel panels to TSV and CSV formats as well as to the clipboard. You can trigger the export using the button below.

Additional MIME Headers and Insights

We have added numerous MIME header definitions along with associated Insights into FEI. We have also extended FEI’s email client support to include Mozilla Thunderbird Message-ID and MIME boundary values.

You can review FEI’s changelog below for a comprehensive list of the changes and download the installer when you are ready to update.