Paraben s DS 7.5 Release Notes

Paraben s DS 7.5 Release Notes

Welcome to Paraben s DS Mobile Forensic Solution! DS is designed to allow investigators to acquire the data contained on mobile phones, smartphones, tablets, GPS, and PDA devices in the most forensically sound manner possible. Since 2001 Paraben s mobile tools have been acquiring and analyzing data from devices. DS employs different techniques with each type of device. In most cases, images are created both logically and physically. This gives the examiner the maximum access to data that includes information such as phone numbers, dates, times, pictures, and call history for both active and deleted data. There are many unique analysis functions as well that come with the powerful DS acquisition engines to include bookmarking, advanced searching, importing of backup data, and case data comparisons. DS supports over 22,000 device profiles and the list growing with each release. DS is a must-have tool for any lab. DS has some additional functionality that makes it the ideal analysis engine. For data associated with GPS coordinates or Call Detail Records (CDR) that might be included with the case, you can import this information into Google Earth directly through DS. In addition to importing data, DS contains the only case comparison functionality to allow for continued review of case data against the original acquisition. This functionality is crucial to compare a device after both sides have done examinations to insure changes have not occurred. DS was designed with forensic examiner s needs in mind. This document allows you to get more information about DS 7.5 features and changes.

What s new in DS 7.5! New Functionality: The acquisition of Android backup data during logical acquisition of Android devices has been added. Now you can acquire a part of file system of devices running Android OS 4.0 and higher from automatically created Android backup file in case the full logical acquisition of the device cannot be performed. New App Support: Parsing of Tinder and Snapchat application data for Android devices has been added. Parsing of Tinder, Yik Yak, application data for ios devices has been added. New Support for Drone Data: DJI Go Drone App supported for ios devices. New Device Support: Support of logical acquisition of devices with ios 9.3.2 has been added. Support of physical acquisition of devices with Tizen OS 2.4 has been added. Solved Issues and Improvements: Speed of acquisition of Android and ios devices has been improved. Now the acquisition of Android devices is performed up to three times faster and the acquisitions of jailbroken ios devices is performed up to eleven times faster. Parsing of Safari browser data for ios has been improved. Now the Safari suspended state data also includes information on private mode tabs. Possible problems with generation of PDF Investigative, HTML Investigative, and HTML Timeline reports have been solved. The performance of search has been improved. The work with navigation in search results has been improved. Overall stability has been improved.

Application Data Parsing Application ios Android BlackBerry 10 Backup BB Messenger Chrome DJI Go (Drone) Evernote Facebook Facebook Messenger (ios 7.x and higher) Gmail Google Maps Jott Messenger KIK LinkedIn Mail.ru Pinger Skype Snapchat TextFree TextPlus Tinder Twitter Vkontakte VoiceMail WhatsApp Whisper WeChat Yik Yak Additional App parsing is being done with each new release. If there is an App of interest, please email us for review in a future release.

Android OS App Parsing Support by Versions Application Deleted Data Recovery Supported Versions Highest Supported OS Version Facebook 76.0.0.24.67, 72.0.0.22.69, 52.0.0.12.18, 50.0.0.10.54, 4.4.4 50.0.0.10.54, 48.0.0.28.137, 36.0.0.39.166, 34.0.0.43.267, 33.0.0.45.19, 29.0.0.23.13, 27.0.0.24.15, 26.0.0.22.16, 24.0.0.30.15, 14.0.0.17.1, 13.0.0.13.14, 9.0.0.26.28, 8.0.0.26.24, 3.9 Facebook 71.0.0.10.65, 70.0.0.12.68, 69.0.0.14.70, 66.0.0.13.69, 4.4.4 Messenger 46.0.0.10.18, 45.0.0.7.61, 44.0.0.8.52, 42.0.0.17.137, 34.0.0.43.267, 30.0.0.33.174, 30.0.0.19.17, 27.0.0.48.14, 26.0.0.22.16, 24.0.0.17.13, 22.0.0.19.14, 20.0.0.19.13, 19.0.0.19.42, 18.0.0.27.14, 8.0.0.20.14, 5.7.6.4338, 5.0.0.25.1, 4.0.1.13.1 Google 50.0.2661.89, 49.0.2623.105, 46.0.2490.76, 4.4.4 Chrome 45.0.2454.94, 43.0.2357.93, 43.0.2357.92, 42.0.2311.111, 41.0.2272.96, 40.0.2214.109, 40.0.2214.89, 39.0.2171.93 Jott 1.1.5.1, 1.1.5.0, 1.1.4.0, 1.0.25, 1.0.22 4.4.4 Messenger KIK 10.4.0.6032, 10.3.0.5822, 10.2.0.5569, 8.10.0.2824, 8.9.0.2484, 8.8.1.2261, 8.7.0.1643, 8.5.0.1164, 4.4.4 8.3.0.678, 8.1.0.4, 8.3.0.628, 8.1.0.4, 8.0.0.188, 7.10.1.176, 7.9.0.143, 7.3.1.111, 7.2.2.99, 7.2.1.96, 7.1.0.83, 6.1.0.20 LinkedIn 4.0.42.1, 4.0.40, 4.0.37, 3.5.4, 3.5.3, 3.5.1 4.4.4 Skype 6.34.0.715, 6.34.0.710, 6.33.0.575, 6.32.0.570, 4.4.4-6.31.0.709, 6.29.0.758, 6.8.0.590, 6.7.0.460, 6.5.0.351, 5.4.0.5871, 5.4.0.5191, 5.3.0.65524, 5.3.0.65246, 5.2.0.62296, 5.2.0.61097, 5.1.0.59677, 5.1.0.58677, 5.0.0.49715, 4.9.0.45564 Snapchat 9.30.0.0 4.4.4 Text 6.0.0, 5.9.9, 5.9.8, 5.9.7, 5.9.6, 5.7.6.4838 4.4.4 TextFree 5.14, 5.10.1, 5.9, 5.8, 3.0.2, 2.2.1, 1.0.2 4.4.4 Tinder 5.0.5 4.4.4 VK 4.0.1, 3.15.2, 3.15, 3.14.2, 3.12, 3.11, 3.10, 3.10.1, 4.4.4 3.7.1, 3.6, 1.0.2

Application Deleted Data Recovery Supported Versions Highest Supported OS Version WhatsApp 2.16.89, 2.16.79, 2.16.70, 2.16.64, 2.16.35, 2.16.25, 4.4.4 2.16.2, 2.12.317, 2.12.250, 2.12.176, 2.12.158, 2.12.84, 2.12.5, 2.11.528, 2.11.522, 2.11.505, 2.11.476 Whisper 5.9.11, 4.6.6, 4.6.5, 4.6.3, 4.5.15 4.4.4 ios App Parsing Support by Versions Application Deleted Data Recovery Supported App Versions Highest Supported OS Version DJI GO - 2.8.1 9.3.2 Evernote 7.13.1, 7.13, 7.8.1,7.7.10, 7.7.8, 7.7.0, 7.6.5, 7.6.3, 9.3.2 7.4.0, 7.3.5, 7.2, 7.0, 5.4.6, 5.4.3, 4.3.4 Facebook - 33.0, 27.0, 22.0 8.2 Facebook 18.0 8.0.2 - Messenger Gmail 4.0, 3.1415926, 3.0.2, 2.71828 8.2 Google 50.0.2661.95, 50.2661.77, 43.2357.61, 41.2272.58, 9.3.2 Chrome 42.2311.47, 39.2171.50 Google Maps - 4.18.0, 4.17.0, 4.11.68024, 4.11.0 9.3.2 Jott 2.4.1, 2.3.0, 1.7.8 9.3.2 Messenger KIK 10.3.0, 10.2.0, 8.10.0, 8.7.0, 8.5.1, 8.1.0, 7.7.1, 7.2.1, 9.3.2 7.1.0, 6.6.0 LinkedIn - 9.0.18, 9.0.13, 8.8.3 9.3.1 Mail.ru 4.3.4, 4.0.1, 4.0, 3.1.1 8.0.2 6.13, 6.12, 6.11, 6.10, 6.9.1, 6.8.1, 6.8, 6.7, 6.6, 8.2 (nonjailbroken) Skype - 6.5.152, 5.14.72, 5.13.496, 5.11.429, 5.9.774 6.15, 6.14, 6.13, 6.12, 6.11, 6.10, 6.9.1, 6.8.1, 6.8, 9.3.2 6.7, 6.6, 6.5.152, 5.14.72, 5.13.496, 5.11.429, 5.9.774 (jailbroken) Text - 5.6.11, 5.6.10, 5.6, 5.6.5, 5.6.4, 5.6.2, 5.4.0, 4.9.5 8.2 TextFree 9.0.15, 9.0.12, 8.1.10, 8.1.4, 8.0.4, 8.0.3, 8.0.1, 8.0, 9.3.2-7.2, 7.1.1, 7.0, 6.0.5, 1.3 Tinder 5.0.1 9.3.1 Twitter - 6.27, 6.24.5, 6.24.1, 6.19.1 8.2 VK - 2.2, 2.1, 2.0 8.2

WhatsApp 2.16.2, 2.12.9, 2.12.5, 2.12.3, 2.12.2, 2.11.16, 9.3.1 2.11.14 Whisper 6.0.1, 5.9.5, 4.6.6, 4.6.4, 4.6.0, 4.5.4 9.3.2 Yik Yak - 3.4.1 9.3.2 BlackBerry App Parsing Support by Versions Application Deleted Data Recovery Supported Versions Highest Supported OS Version BB 10.9.3.20, 10.8.3.21, 10.8.6.15, 10.7.3.21, 10.6.3.10 10.3.1 Messenger Skype - 6.1.0.16424, 4.9.507.46973, 4.9.507.46970 10.3.1 WhatsApp 2.16.18, 2.12.243.2, 2.12.9.2, 2.11.12.1.2, 10.3.1 2.11.1201.2, 2.11.840.1 Evernote - 5.8.1.1123, 5.6.0.816, 5.5.3.590, 5.2.2.718 10.3.1 WeChat 3.0.1.1 10.3.1 Cloud Data Import Support Facebook Gmail Google Drive Google Locations Service Additional services will be added in future releases.

DS Smartphone Support Android Devices Logical Support Physical Support Cupcake (1.5) Doughnut (1.6) Éclair (2.0 2.1) Froyo (2.2 2.2.3) Gingerbread (2.3 2.3.7) Honeycomb (3.0 3.2.6) - Ice Cream Sandwich (4.0 4.0.4) Jelly Bean (4.1) Jelly Bean (4.2 4.3) KitKat (4.4 4.4.4) Lollipop (5.0 5.1.1) Partially BlackBerry Devices Logical Support Physical Support 1.0 3.6 4.x 5.0-6.0-7.0-7.1-10.x - - Logical Support Physical Support * ios Apple Devices 1.x 2.x 3.x 4.x 5.x 6.x 7.0.x 7.1 7.1.1 8.0.x 8.1.x 8.2.x 8.3 8.4 9.0-9.1-9.2-9.2.1-9.3-9.3.1-9.3.2 -

Windows Phone Logical Support Physical Support 7.0 N/A 8.0 N/A 8.1 N/A * Physical support is determined based on hardware. See the chart below. ios Device Hardware Logical Physical 1G - 2G - 3G 3GS 4G 4S (Jailbroken only) 5 (Jailbroken via TaiG only) 5C (Jailbroken via TaiG only) 5S (Jailbroken via TaiG only) 6 (Jailbroken via TaiG only) 6 Plus (Jailbroken via TaiG only) 6s - 6s Plus - ipad 1st Gen ipad 2nd Gen - ipad 3rd Gen - ipad 4th Gen - ipad Air - ipad Mini 1st Gen - ipad Mini 2nd Gen - ipod Touch 1st Gen - ipod Touch 2nd Gen - ipod Touch 3d Gen ipod Touch 4th Gen ipod Touch 5th Gen -

DS Key Features General Features: - More than 50 plug-ins for working with more than 25 types of devices including: -Cell phones -Smartphones (iphones, Androids, BlackBerry, and Tizens) -Smartwatches (Androids and Tizens) -Windows Phones & Portable devices -PDAs -Tablets (ipads/ipod Touches and Android tablets) -Media Devices (ipods and ereaders) -GPS devices -Media cards - Device autodetection during acquisition with possibility of logical or physical acquisition - Support of more than 12,000 device profiles - USB, serial, and Bluetooth (Limited) support - Verification of acquired case data integrity via acquired data hash code validation - Deleted data recovery on all types of devices - Encrypted image files to guarantee image integrity - Google Earth integration - Database driven case format for secure data storage and large volume storage Bonus Features: - Includes a free 1 year subscription with purchase - Includes license to Link2 for full link analysis chart capabilities - Includes comprehensive cable kit GUI Features: - Special Hex and Text viewers for viewing data in hex and text representation - Timestamp viewer for viewing possible timestamps encoded in hex data - Image viewer for convenient viewing of all types of images - File viewer for viewing files of different types (*.html, *.doc, etc.) - Grid viewer for an easy-to-read format of SMS, Phonebook, Calendar, etc. - Data Sorter function for sorting thousands files from the acquired data by file types - EIF data viewer for graphic files including adding EIF data to reports - Attached Data viewer for viewing data attached to grid records - Quick export functions for exporting media file types from case data - Bookmarking for easy navigation and review of data Plug-in Features: - Comprehensive data acquisition of text messages, address books, call logs, and more - Built-in recovery of a variety of passwords from devices - Portable Device Plug-in for Windows 8 and all devices that mount as media devices - Windows CE registry viewer - Acquisition of complete GSM and CDMA SIM card information including deleted data - Full flash download for certain models of cell phones, PDAs, and smartphones - SIM Cards cloner - Parsed data viewer for smartphone Application data

Other Features: - Exporting of the acquired data to the PC - Search within the acquired data including file search, Hex, Text (including Unicode), and MD5 (file duplicate search) searches - Import of data from cloud-based services - Import of databases acquired with CSI Stick and Deployable Device Seizure - Import of other desktop data: -RIM BlackBerry Backup (IPD & BBB) including BlackBerry 10 -Apple iphone Backup (including encrypted back-ups) with parsing of ios keychain files -KLM and GPS maps - Import of data from other tools -Cellebrite cases -Tarantula back-ups (Chinese Phone Support) - Viewing acquired data with external viewers - Comprehensive HTML, Text, CSV, LS, and PDF reporting, including Timeline report - Case Comparer compares two databases to verify differences in their structure with bookmarks creation and quick reporting - Data saving to CD/DVD. You can easily take your case with you without using any external applications - Cell Tower Import for viewing call locations within Google Maps