Do let us know if you want to be one of the first to try the new W4 features.
W4 1.1.0 Release Highlights
· Added recipes functionality. Recipe is a mechanism to configure and run searches based on common case types. W4 comes with several pre-configured recipes that allow to investigate some common cases in one click (such as IP Theft).
· Added new categories (used in default recipes):
o Emails and email attachments sent to personal accounts
o Chat attachments and file transfers.
o Common websites: webmail, social media, cloud usage, productivity.
o Network share access.
o Printed documents.
o Last day, last week and odd hours activity.
· Triage features:
o W4 is now available as a portable app that can be run on any PC without installation.
o W4 comes with an embedded software license that is valid for 1 year after the release date.
o Added indexing a live running system (local physical or logical drive).
o Added optional automatic RAM capture on startup.
o Added an option to specify the exact categories that need to be processed. That allows to perform a quick scan.
o Added search profiles. It allows to export all case settings to a template that can later be re-used in a new case. That includes preferences, keyword and hash lists, recipes, source settings, tags, reports.
o Added triage launcher that allows to index a new PC in one click based on a pre-configured case template.
o Added Acquisition tab which allows to acquire evidence. Supported evidence types:
§ Memory (RAM)
§ Physical and logical disks (E01, DD or AFF4)
§ Folders (ZIP with preserved locations and timestamps)
§ Common system files (ZIP with preserved locations and timestamps)
· Added hash lists support (DeNISTing).
· Thumbnails view improvements: Deduplication, Size filter, Sorting, Thumbnail size.
· Added indexing AFF4 disk images.
· Added indexing volume shadow copies.
· Added indexing Window 10 timeline.
· Added indexing MRU items (recent documents).
· Extended keyword list functionality that allows to specify:
o Where to search: file name only, metadata or metadata and text.
o Which categories to search in. For example, it will allow to search in browser history only.
For access to the beta please reply to this thread.