New W4 Beta Highlights

[admin]

Do let us know if you want to be one of the first to try the new W4 features. 

W4 1.1.0 Release Highlights

 

Highlights

·         Added recipes functionality. Recipe is a mechanism to configure and run searches based on common case types. W4 comes with several pre-configured recipes that allow to investigate some common cases in one click (such as IP Theft).

·         Added new categories (used in default recipes):

o   Emails and email attachments sent to personal accounts

o   Chat attachments and file transfers.

o   Common websites: webmail, social media, cloud usage, productivity.

o   Network share access.

o   Printed documents.

o   Last day, last week and odd hours activity.

·         Triage features:

o   W4 is now available as a portable app that can be run on any PC without installation.

o   W4 comes with an embedded software license that is valid for 1 year after the release date.

o   Added indexing a live running system (local physical or logical drive).

o   Added optional automatic RAM capture on startup.

o   Added an option to specify the exact categories that need to be processed. That allows to perform a quick scan.

o   Added search profiles. It allows to export all case settings to a template that can later be re-used in a new case. That includes preferences, keyword and hash lists, recipes, source settings, tags, reports.

o   Added triage launcher that allows to index a new PC in one click based on a pre-configured case template.

o   Added Acquisition tab which allows to acquire evidence. Supported evidence types:

§  Memory (RAM)

§  Physical and logical disks (E01, DD or AFF4)

§  Folders (ZIP with preserved locations and timestamps)

§  Common system files (ZIP with preserved locations and timestamps)

·         Added hash lists support (DeNISTing).

·         Thumbnails view improvements: Deduplication, Size filter, Sorting, Thumbnail size.

·         Added indexing AFF4 disk images.

·         Added indexing volume shadow copies.

·         Added indexing Window 10 timeline.

·         Added indexing MRU items (recent documents).

·         Extended keyword list functionality that allows to specify:

o   Where to search: file name only, metadata or metadata and text.

o   Which categories to search in. For example, it will allow to search in browser history only.

For access to the beta please reply to this thread. 

[Brendan Payne]

Would like to be involved in this beta, thanks.