CacheBack Changelog

What's new in CacheBack 2.8.4 Beta

Feb 5, 2010
  • We’ve added new colored tabs to the interface to give a more intuitive look and feel.
  • The bottom status bar has been expanded to include more “state” details relating to Filters, Bookmarks, Host Filtering, and the Active (current) Query.
  • The Feature Panes (top left) now contains the “Home” tab which contains quick links to information to help users get the most out of the software.
  • Users can now organize URLs into one or more custom bookmark folders which are accessed via the new Bookmarks tab, situated in the Features Pane.
  • Bookmarked records now appear in the Table with a pink background color.
  • Table records can be excluded (from view) via the right-mouse-click context (popup) menu.
  • Records that have been excluded can also be set to “show excluded rows”.
  • We’ve retooled the Gallery routines to render thumbnails of web pages and pictures much more
  • quickly.
  • The “Query Tab” has been replaced with the new Query Manager window which is accessed from the Toolbar. We’ve also added the “Query History” tab so users can quickly see which queries have already been run in their case. There is also a new “Import Keyword List” feature on the Query Builder tab to make it easier than ever to create complex, custom queries.
  • We’ve re-tooled the Import Wizard to make it easier and quicker to import cache and history
  • files from a logical volume. This includes the introduction of the CacheGrab Import (.CGI) file
  • which is created by the Windows and the EnScript version of CacheGrab.
  • The .CGI file is intended to preserve the “original metadata” about a source file (e.g., File Created, Original Path, etc.) and decrease the duplicate validation that was required in previous versions of CacheBack.
  • The CacheGrab data mining tool that accompanies CacheBack has undergone some major improvements to support more artifacts, as well as, Vista and Windows 7 file paths.

New in CacheBack 2.8.3 RC3 (Feb 3, 2010)

  • We’ve added new colored tabs to the interface to give a more intuitive look and feel.
  • The bottom status bar has been expanded to include more “state” details relating to Filters, Bookmarks, Host Filtering, and the Active (current) Query.
  • The Feature Panes (top left) now contains the “Home” tab which contains quick links to information to help users get the most out of the software.
  • Users can now organize URLs into one or more custom bookmark folders which are accessed via the new Bookmarks tab, situated in the Features Pane. Bookmarked records now appear in the Table with a pink background color.
  • Table records can be excluded (from view) via the right-mouse-click context (popup) menu. Records that have been excluded can also be set to “show excluded rows”.
  • We’ve retooled the Gallery routines to render thumbnails of web pages and pictures much more quickly.
  • The “Query Tab” has been replaced with the new Query Manager window which is accessed from the Toolbar. We’ve also added the “Query History” tab so users can quickly see which queries have already been run in their case. There is also a new “Import Keyword List” feature on the Query Builder tab to make it easier than ever to create complex, custom queries.
  • We’ve re-tooled the Import Wizard to make it easier and quicker to import cache and history files from a logical volume. This includes the introduction of the CacheGrab Import (.CGI) file which is created by the Windows and the EnScript version of CacheGrab.
  • The .CGI file is intended to preserve the “original metadata” about a source file (e.g., File Created, Original Path, etc.) and decrease the duplicate validation that was required in previous versions of CacheBack.
  • The CacheGrab data mining tool that accompanies CacheBack has undergone some major improvements to support more artifacts, as well as, Vista and Windows 7 file paths.

New in CacheBack 2.8 RC 2 (Jan 4, 2010)

  • Now supports Chrome Versions 1, 2 3 and 4
  • Greatly enhanced Gallery view of records (as thumbnails) using new Photographic Aspect Ratio Differential (PARD) filtering techniques
  • Create custom Bookmarks and Bookmark Folders (with Copy and Paste options)
  • New Time Chart Analysis reporting to show monthly view of user activity (by the hour)
  • New Query Builder makes it even easier to build compound queries to speed examinations
  • Now offering a 3-day instructor led course on "Advanced Internet Browser Forensics Using CacheBack 2" forensic course (call for dates and locations or to arrange one in your area)

New in CacheBack 2.7.4 (Aug 27, 2009)

  • New consolidated thumbnail Gallery viewer displays thumbnails of cached web pages AND pictures!
  • Accurately rebuilds cached web pages for all five top browsers in just seconds!
  • CacheBack currently supports IE (5-8), Firefox (2-3), Opera (9), Safari (3) and Google Chrome (1).
  • Produce compelling, rich HTML reports for rebuilt web pages, and pictures, complete with thumbnails and metadata.
  • Rebuild lost web pages from Unallocated Clusters using new Templates feature!! (coming soon).
  • Import older NetAnalysis project files and leverage the superior reporting features in CacheBack.
  • Supports importing of NetAnalysis' Hist-Ex URL recovery tool (for IE).
  • Expedite case examinations using the CacheGrab® EnScripts for EnCase V5 and V6.
  • Comes with our CacheGrab® (for Windows) tool to quickly collect history and cache artifacts from any local drive (or VFS) and make them ready for import by CacheBack.
  • Displays timestamps in any time zone using Coordinated Universal Time (UTC). Accurately applies Daylight Savings (DST) changes to "each individual timestamp" (for the selected time zone option). This is extremely important if an investigator's place of origin (city, country) is observing DST WHEN the actual timestamp evidence originated outside of DST!!
  • Fully integrated SQLite3 database support for examining browser history files for Firefox 3 and Google Chrome!
  • Supports the extraction of GNU Zip (GZip) compressed data found in browser cache data files.
  • Uses a proprietary Photographic Aspect Ratio Differential value to dramatically create smaller, more relevant picture galleries for investigations involving child exploitation! (or any other picture-based investigations)
  • UTC option takes into account new DST rules and Southern hemisphere differences (eg: Australia).
  • System-clock-independent, multiple Time Zone and customizable timestamp formatting options for accurate timeline analysis.
  • Powerful Link Analysis to identify matches between history URLs and hyperlinks found in web pages (eg: which links might have been clicked or visited).
  • Familiar user interface similar to Windows Explorer or Outlook provides a consistent user experience for forensic investigators.
  • Each URL is extracted and broken down into multiple artifacts (metadata) which can then be used within custom queries to create finer (smaller) results sets.
  • Filter results based on file type, file extension, domain/host name.
  • Create user-defined SQL queries and save them for future use.
  • Pre-defined queries now available for common type investigations (eg: Child Exploitation, Web Mail, Social Networks, etc).
  • New Quick Queries makes it easier to filter out specific data types (eg: Show Only Web Pages, Show Only History, Show Activity for Last Month, etc).
  • Built-in offline browser to view web pages with convenient context (right-mouse-click) menu to access common IE browser features (eg: Print, View Source, etc).
  • Rebuilds web pages on the fly without altering the original files. Ingredient files stored back inside database so that web pages only need to be rebuilt once!
  • Project files (.CBP) use the Microsoft Access database engine. This allows examiners the flexibility of using Microsoft Access and Microsoft Excel to leverage custom reporting features and data formatting, outside of CacheBack!
  • Export TableView columns as plain text files.
  • Built-in picture viewer with new Zoom In/Out and Print functionality.
  • Multiple tabbed views of the same evidence (Browser, Text, Hex, Picture, Audit and Links).
  • Comes with a 200+ page, comprehensive and fully illustrated User Reference Manual. This guide will certainly round-out any examiner's experience working with Internet cache and history artifacts.

New in CacheBack 2.7.3 (Jul 20, 2009)

  • Supports all five (5) top browsers and is the first software product to provide Internet cache and history analysis for IE, Firefox, Safari, Opera and Google Chrome.

New in CacheBack 2.5.3 (Oct 8, 2008)

  • Resolved a "The field is too small..." error that was sometimes encountered when parsing the INDEX.DAT file from IE Temporary Internet Files. This usually only occurred when CacheBack encountered an incomplete or corrupted URL record.
  • Added a "Lock" tab feature to keep only the preferred viewing pane visible.