Artifacts
- Application Activity | Android: Added parsing support for recovering activity and usage information for applications, including screenshots of the UI from the app. [Android 7-8]
- Bluetooth Devices | Android: Added support for recovering information about Bluetooth devices that the user's device connects with, on later versions of Android. [Android 6-8]
- Call Logs | iOS: Updated parsing and carving support to recover group call data from Facetime. [iOS 12]
- Chrome | Android: Updated carving support for Chrome Cache Records to recover cached content and its URLs, as well as first and last visit dates. [59.0.3071.125]
- Chrome | Windows, MacOS: Updated carving support for Carved Web History. [59.3071.125 to 63.0.3239.84]
- Contacts | Android: Updated parsing support to recover postal address and web address information. [Android 7.1.1]
- Gmail Webmail | Windows: Updated RAM carving support to identify if an email was sent using Confidential Mode.
- Google Play | Added support for recovering Google Play information, including Installed Applications, Application Details, and Searches. [Android 6-8]
- KakaoTalk | Android: Updated support for decrypting KakaoTalk messages. [8.1.2]
- KnowledgeC | iOS: Added support for recovering device and application info from knowledgeC.db, which includes historical information such as application usage, lock state, orientation, Safari History, and more. [iOS 11-12]
- Naver Whale | Android: Added support for recovering the browser history from Naver Whale. [8.8.6]
- SMS | Android: Added parsing and carving support to recover the name of the app that generated the SMS message. [Android 6+]
- SMS | Android: Updated carving support to recover SMS messages. [Android 6]
- Screen Time | iOS: Added a Screen Time Usage artifact which contains information about when an app is used and for how long. Usage information is available for the local device as well as remote devices that are connected to the same Apple ID or Family Account. [iOS 12]
- USB Devices | Windows: Updated parsing support to now include data from Storport Driver devices. [Windows 10]
- Videos: Updated carving support for videos to improve both processing performance and the deduplication of carved artifacts.
- Your Phone | Windows: Added parsing and carving support for recovering SMS/MMS and Contacts data that was synced to a computer from a phone using the Your Phone app. [Windows 10]
Bug fixes
- Previously, .opus files recovered in Android WhatsApp messages couldn’t be played in the conversation preview. -TAO-118
- The 'Date Read' and 'Date Delivered' attributes from SMS Messages weren't being converted to Apple nanosecond timestamps. [iOS 11] -TAO-102
