PassMark OSForensics Professional 2.1 Build 1000 Final

Indexing changes;
Will now process e-mail headers
Added .zipx extension in filetypes to be recognized, handled as "Binary (filename only)"
Added handling of ZIPX as "Binary (filename only)"
Added checkbox to scan attachments in e-mails to advanced template configuration window
Added Volume shadow copies support to the File System Browser. Currently considers a file is a shadow if the modified time of file is different from the current volume file. Steps to use this feature are,
Add Disk Image OR Drive in forensics mode OR Disk to case
Add subsequent Volume Shadows for just added device.
Load File system browser and enable Show shadows under options menu.
Browse (the shadow copy files text/label will be a shade of grey).
Added "Add All" Volume Shadow Copies option to Add Device dialog window.
Added "loading" dialog box when parsing shadow copies.
Shadow copies can now only be loaded for devices that are already added to case.
Improved performance when using shadow copies as a result of caching data in RAM. This should also allow larger drives to be examined in a reasonable amount of time.
Added button to FSB Toolbar that launches a module to perform volume "diffs" for shadow copies, it behaves similarly to the Create/Compare signature function.
Added keyboard shortcuts to Internal file and email viewers.
Raw disk viewer searches are no longer aborted when the search window is hidden.
Made some change to the Chrome download section in recent activity to work with newer chrome versions (26.0.1410.64) as the database structure has changed.
Can now select 'Use entire image file' when selecting a partition from an image file.
Added Loading progress indicator for the advanced EmailViewer
When an error occurs when adding multiple items to case, added a Message Box to prompt if user wants to continue (or quit). This avoids a situation where hundreds of error boxes might otherwise be displayed in a loop.
Raw disk viewer decode window can now identify a dynamic volume as "Windows dynamic volume (LDM)
Can now detect dynamic volumes in dynamic disks (LDM)
In the 'Drive imaging' module, added 'Rebuild RAID' tab for rebuilding a single RAID image from multiple source disk images. Support for auto-detecting Intel Matrix RAID (IMSM) & software RAID was included. Additional auto-detecting features for other RAID formats are expected to be supported in future releases. Added support for manually changing image file offset/size for RAID rebuilding.
Rebuilding RAID images for the following RAID metadata types
SNIA DDFv1
Highpoint v2 RocketRAID
Highpoint v3 RocketRAID
Adaptec HostRAID
Integrated Technology Express RAID
JMicron RAID
LSILogic V2 MegaRAID
LSILogic V3 MegaRAID
nVidia MediaShield
Promise FastTrak
Silicon Image Medley RAID
Silicon Integrated Systems RAID
VIA Tech V-RAID
(Note that not all permutations have been tested)
Added RAID 0+1, RAID1+0, RAID 3, SPANNED rebuilding support
RAID "Info" dialog now shows the metadata for all matching RAID formats
Can select between multiple RAID metadata types if multiple formats detected
Added HPA/DCO imaging. This allows hidden area on the disk to be made accessible for copying. HPA = Host protected area. DCO = Device configuration overlay. Note that on some drives there is locking that will prevent changing the HPA/DCO disk extent limits.
Carved files will now have FILETIME set to Jan 1, 1601 12:00 PM when the real date information is not recoverable.
File Carving percent complete display bug fix.
File Carving put more safety checks when carving Zip / OfficeXML files to prevent crash.
Thumbnail Viewer, fixed a problem with thumbnails without a visible size being drawn as black box
Fixed some potential memory allocation in the internal file viewer issues when viewing buffers. (Which is how deleted files are viewed).
Fixed a crash that could occur in recent activity during the IE URL scan, some URL paths were longer than expected
Added 'Info' button to retrieve and display the RAID metadata from an image file in the Disk Imaging module.
Added ability to open Internet Explorer IE10 history databases and retrieve visited URLs (Vista and newer only). IE10 has a new internal format for storing this data compared to previous releases.
Updated document indexer to handle indexing recursive PST files (PST and MSG files attached to E-mails inside PST files).
Fixed issue where "Add to Case" menu item was enabled when a case is not yet opened.
Fixed some memory leaks when indexing emails and attachments.
Fixed Email Viewer appearing (with no error messages and no emails) when PST file cannot be opened (e.g. because Outlook is open and holding access). It now shows an error message and destroys the Email Viewer window before it displays.
Fixed EmailViewer appearing (with truncated email contents) when user hits "Cancel" during PST loading
Fixed the EMail viewer's handling of embedded emails (.msg files attached to a .msg file) in the EmailViewer.
Made some changes to stop a reported crash in the registry viewer.
Fixed a bug with the Windows Login Password when using "Live acquisition of current machine", a required registry permissions was failing to be set correctly
Old/simple PSTViewer is now restored in project and used when PST file is > 10GB
Changes to try and stop the recent activity/registry viewing crashing in invalid data circumstances (causes by null records in the registry).
Added help context for Volume Shadow Copies.
Help file updates for HPA / DCO hidden areas in Disk Imaging and 'RAID Rebuild' functionality.