Skip to Store Area:

You're currently on:

BlackLight

BlackLight

Mac OS X  •  iOS  •  Windows


BlackLight is a multi-platform forensic analysis tool that allows examiners to quickly and intuitively analyze digital forensic media. BlackLight is capable of analyzing data from Mac OS X computers, iOS devices (iPhone, iPad, iPod Touch) and Windows computers. It is compatible with all leading logical and physical forensic image formats.

Examiners may use BlackLight as a time-saving data triage tool, or as an advanced forensic examination tool depending on the circumstance. To learn more, please view the quick feature videos to the right, or use the drop down menus below which detail the many BlackLight features.

ADD TO CART REQUEST A QUOTE


Video

Message Analysis by BlackBag Technologies Message Analysis

File Filter by BlackBag Technologies File Filter


BlackLight Software   +$0.00
BlackLight Dongle   +$0.00

* Required Fields

Price as configured: $2,600.00

Add Items to Cart ADD TO CART

 
 
  Features    Latest Release    System Requirements    Subscriptions and Updates    Pricing  

Quickly Acquire a Snapshot of the User's Device

The BlackLight Details view provides a visual device configuration and usage, including:

  • Device type, iOS / OS version, serial number, UDID, and IMEI
  • Artifact summary statistics for documents, emails, movies, calls, voicemail, and more
  • Device user account information and common Internet account information for applications such as Twitter and iCloud
  • Recent usage history, including dialed phone numbers (with associated contact information), last running applications, and most recent web-based location searches.

Efficiently Sift Through Large Data Sets

BlackLight's signature File Filter view includes examiner-defined filter options to quickly pinpoint relevant data within large data sets. Filter criteria include:

  • File name, kind, size, or extension
  • Date created, modified, or accessed
  • Picture metadata attributes, including GPS coordinates and camera (iOS device) type
  • Positive and negative hash set filtering

Examiners may apply any number of filters or inverse filters to quickly isolate important data from system files or base application files. BlackLight ships with several pre-set file filters, including those that filter by file type, file attribute, geolocation coordinates, and source device type.


Find the Picture and Video Evidence You Need

BlackLight's Media view has built-in support for all commonly used picture and video file types, and it includes several helpful and examiner-oriented analysis features, such as:

  • Built-in GPS Mapping:
    • All media files containing GPS data will be identified with a placemark badge
    • Examiners can view media geolocation data on a Mercator map (offline) or using Google Maps (online) directly from the built-in GPS view
  • Proprietary Skin Tone Analysis Algorithm:
    • Sort picture and video files by the skin tone percentage contained in the file
  • Video Frame Analysis:
    • BlackLight initially displays video files as 4x4 frame sequences, allowing examiners to quickly triage multiple video files in order to locate potential evidence


Uncover a Full Account of Social Media Activity

The brand new Social view provides examiners with comprehensive support for the most popular social media applications. As the proliferation of social media has infiltrated popular culture, understanding the data from these apps has become integral to an overwhelming number of investigations. BlackLight will automatically parse and display data from:

  • Facebook
    • Sort through neatly parsed data for the user's profile, friends, messages, posts and comments
  • Twitter
    • Uncover the user's profile info, an archive of their tweets, an archive of the tweets in their news feed, Followers and Following lists, and direct messages
  • LinkedIn
    • Get a quick snapshot of the user's professional history, including profile info, connections, recent updates, invitations, notifications, and messages
  • Foursquare
    • Track recorded movements through an archive of user check-in data, including GPS coordinate data, timestamps, and venue information


Recover Every Message from the Most Common Sources

The Messaging view in BlackLight allows examiners to see messaging threads in their native format with support for data from:

  • SMS
  • MMS
  • Skype
  • iMessage
  • iChat
  • Kik
  • TextPlus
  • TextFree


Get a Comprehensive Look at iPhones and iPads

Along with the messaging, media, and social data noted above, BlackLight exhibits its full support for iOS devices in several other signature BlackLight views:

  • Phone
    • Easily understand all relevant iPhone-specific data, including recent calls, Favorites, voicemail, and voice memos
  • Applications
    • View user-specific app files that are stored within application bundles and examine them using BlackLight's File Content Viewer
  • Contacts
    • Flip through all of the information in the user's Contacts or Address Book applications, displayed natively for intuitive navigation
  • Locations
    • Scroll through a chronological list of all geolocation data stored on a suspect's device, sourced from Google Maps, Apple Maps, Foursquare, Kik, Whatsapp, and Location Services


Customize Your Report

BlackLight is designed to make Reporting incredibly flexible. Examiners may export large data sets parsed in a human-readable format, and export examiner reports in a variety of formats to enable easy information sharing with all interested third parties, both technical and non-technical. With BlackLight's Report view, you can:

  • Easily tag evidence and include any and all relevant metadata in the examiner report
  • Export your report in your choice of formats, including
    • .pdf
    • .html
    • .docx
    • .txt
  • Export eDiscovery data to a generic Concordance load file that is compatible with all major review platforms
  • Mask (blur) sensitive data contained within examiner reports that may be shared with non-authorized third parties


BlackLight 2014 R1 was released February 11, 2014. Listed below are a few of the key new features you'll find in this release:

Unified Messaging View
Using BlackLight's automatic normalization of messaging data, examiners can now simultaneously cull through a unified database of messages from SMS, MMS, Kik, WhatsApp, Textfree, textPlus, and Skype™ as well as direct messaging from social media apps like Facebook and Twitter

Improved SQLite Database Recovery
BlackLight will now display all deleted SQLite database records, including partial record fragments and deleted items from Write Ahead Log (WAL) files

Newly Implemented Rendering and Display of Crushed PNG Files
True to its reputation as being at the forefront of iOS forensics, BlackLight can now display thumbnails of crushed PNG files, commonly found on iPhones and iPads

Updated Compatibility for Mavericks (OS X 10.9)
BlackLight will run as smoothly as ever on the latest Mac operating system, and has already integrated Mavericks hash values into its known hash database

Operating System Specification Mac OS X Lion (10.7.0) or higher and Windows XP (SP3) or higher
Compatibility BlackLight runs on Intel based systems only
BlackLight requires the following additional software:
• iTunes 11.0.1 or newer
• QuickTime 7.6.9 or higher
Minimum Requirements 2.8 GHz Intel Core 2 Duo
4 GB 1067 MHz DDR3 RAM
500 MB Disk Space (Installation Only)
1024 x 768 or higher screen resolution
Optimum Requirements 2.2 GHz Quad-Core Intel i7 or better
16 GB 1333 MHz DDR3 RAM
500 MB Disk Space (Installation Only)
1680 x 1050 or higher screen resolution

Each new BlackLight™ software purchase includes a one-year BlackLight™ License Subscription. During this one-year subscription period, you will have full access to our expert technical support and the right to download and install all BlackLight™ software updates and new releases.

Software bug fixes and updates/upgrades are only available to current BlackLight License Subscription holders. However, we do continue to provide full technical support after the BlackLight License Subscription expires. Be sure to renew your BlackLight™ License Subscriptions annually to continue receiving subscription benefits.

Please contact us at Support with any questions about keeping your BlackLight license up to date, or click here to renew your license subscription.

For detailed software update instructions, please click here.

Note: If you are running BlackLight on non-networked forensic analysis systems, please send an e-mail to support@blackbagtech.com with a request to add you to our BlackLight software update e-mail notification list. These e-mail notifications contain instructions for downloading the BlackLight update install package by logging into your customer web account and selecting the My Downloadable Products page. The install package may be downloaded to a networked machine, and transferred to the non-networked machines.

Thank you!




The initial software license price for BlackLight is $2,600 USD (private sector) and $2,200 USD (government). This entitles license holders to all BlackLight software updates at no additional cost for one year. After the one-year license period has expired, customers may purchase a license subscription for $825 per year to continue receiving all BlackLight software updates at no additional cost during the one-year subscription period.


Initial Renewal
Private Sector $2,600 $825
Government $2,200 $825


There is no software functionality or customer support penalty if a customer does not renew their BlackLight license subscription. Our BlackLight software remains fully functional, and we continue to provide unlimited technical support to our customers even after a BlackLight license expires. However, customers no longer receive all BlackLight software updates at no additional cost once their license expires.