FTK IMAGER 3.0.1
A nice fix:
“Resolved file name issue that caused E01 files that were created in FTK Imager
to fail during import into EnCase. (56047)”
“Improved handling of Apple partition maps (54804)”
Nice to know:
“FTK 3.3 does not carve container files. Safari cache.db files are container files. (54453)”.
“The processing Engine has to be manually stopped on 3.1 before 3.2 can be run and vice-versa. They can be installed at the same time, but only one can run at a time. FTK will get an error in the processing dialog if the wrong DPE is running. (21233)”.
“The Oracle database must be installed on a machine whose name begins with a letter (a-z and A-Z)number”.
“When exporting folders and their contents, you should always select the folder to be exported from the file list view instead of from the explore tree in order to export the contents correctly. (53627)”.
“FTK now carves SQLite databases in order to recover deleted data that they might contain. Due to this change, users will likely see duplicate files if they choose to carve SQLite databases in addition to expanding them. (54453, 55292)”.
“Upon completion of an export job, the export destination folder will now automatically
open up in Windows Explorer to show you the files / folders exported. (55773)”.
“Enhanced export functionality to handle export destination paths of more than 248
characters in length. (54302)”.
“The New Case Wizard and Additional Analysis dialog box now allow the user to “Do not find find deleted items”. Deleted files will be discovered and processed by default. (44322)”.
“At the root of each case folder you will now find a file called EvidenceHistory.log”
“New columns added in the file list view for MS Office metadata properties of “Last SavedBy” and “Author”. (54704)”.
“Case Reviewers are no longer able to see or to know how many items have been marked privileged. (52836)”.
“FTK does not support processing evidence images of HFS+ file systems that have a sector size greater than 512 bytes. (52734)”.