Insights Blog

Tagging Improvements as easy as 1-2-3 with BlackLight 2018 R4

This year BlackBag has been releasing new features and user suggested improvements at a rapid pace.  From our industry-leading APFS support to simplified reporting, we’ve been busy providing you a tool that meets today’s needs.  Our latest release, BlackLight 2018 R4, includes several updates to support devices released this fall as well as the new picture and video formats examiners are encountering more frequently.  Based on user feedback, we’ve also included significant improvements to users ability to tag files that we will cover in more detail below.

Updated Support

Starting with BlackLight 2018 R4 we now support the following new device and artifacts

  • Apple’s latest picture and video formats (HEIC/HEVC) support
  • iPhone XS, XR, and iPad Pro device support
  • Parsing “Recent Items” on macOS 10.13

Starting with this release, BlackLight is now distributed exclusively as a 64-bit application.  Using a 64-bit application on a 64-bit system will result in improved performance as BlackLight can take advantage of additional memory usage.

Tagging Improvements

As examiners work their case, they have asked for more flexibility in what items to include in the report and an easier way to see items tagged for reporting.  We’ve added three major improvements to BlackLight to help make this process easier.

Tag Column

In most views in BlackLight, examiners will have a new column that will show if a file or item has been marked by any of the current case tags.  This column allows examiners to see at a glance if a file is included in the report.  The Tag column and the Evidence reference number are both fixed to the left-hand side of the table.

Tag Column

The Tag Column is always displayed in the far left of the table.

Viewing Tags for an Item

In any view, the examiner can sort by the tag column to group the tagged items at the top of the view.  In addition to displaying that an item has been tagged, examiners can also see which tags have been applied; including if a file is marked with multiple tags.

Tag Column Sorted

Sorting the Tag Column will group tagged items together.

Removing a Tag

Whether an examiner inadvertently tagged a file or the file is unable to be included in the report, users can choose to now remove one or more tag groups using the right-click contextual menu.  To clear all applied tags select All Evidence Tags from the Remove options.

Remove File Tag

Examiners can right-click and select to Remove Tags from a file. If multiple tags are applied they can clear each one or all.

Want to Learn More about Apple Changes in 2018?

BlackLight is proud of the new features and enhancements we’ve made this year. If you want to hear a discussion of some of the Apple changes this year you can also view our OnDemand webinar. Happy Holidays!

Ashley Hernandez

Ashley believes digital forensics provides law enforcement, government, and corporations the crucial ability to determine facts pertinent to solving criminal and civil matters and to examine security incidents.With over 15 years’ experience in the field, she has taught and certified investigators in digital forensics and security topics; including speaking at many digital forensics and law enforcement conferences.She holds a Bachelor of Science in Computer Science from Sonoma State University.
Ashley Hernandez