Download the latest version of software below.

RECON LAB Version 1.5.6 (A4)

Release Notes:

RECON LAB has been updated to version 1.5.6 (A4). Check out some of the updates below!

Enhanced Time Machine Backup Support
RECON LAB can now load both physical and logical forensic images taken of a Time Machine drive:
 After adding your image of the Time Machine Backup drive, just right click on the source to choose what snapshots to process.
 RECON LAB will then tell you the difference between the snapshots you select. The application will break down which files have been deleted between the 2 snapshots, as well as which files had been modified: 

Need help or want to chat about these new features? We’re happy to talk to you!

Email: Phone: +1 302.570.0015

RECON LAB Version 1.5.0 (A1)

Release Notes:

  • macOS 12 Monterey Support is here!

The latest version of RECON LAB includes support for the latest release of macOS, Monterey!

RECON LAB 1.4.9 (A2) adds support for both ingesting images of macOS 12 and taking advantage of the performance enhancements of the operating system during processing!

  • Updated ‘Add Source Menu’ As part of our mission to improve the user experience of our tools, we’ve recently overhauled the ‘Add Source’ menu to make it more user-friendly!
Examiners will now see that the source menu is organized by the types of evidence you’re looking to add and organize them by how they were acquired and what formats they’re using.

RECON LAB now includes the ability to export case information and view it in a RECON CASE READER for simple review in the Windows environment!

Simply press the new Export Case button at the top of RECON LAB’s interface to export either a quick case containing preset artifacts and paths or a custom case to export tags and bookmarks!

  • Updated Support for AFF4 Images 

AFF4 images now have increased support in RECON LAB, allowing examiners to take full advantage of our suite’s advanced analysis and reporting features!

  • Unencrypted Cellebrite .Tar iOS Extraction Support

RECON LAB can now ingest unencrypted .tar extractions for analysis. Utilize RECON LAB’s macOS native plugins and reporting features for enhanced

  • Advanced Search Features for Email FilesAfter parsing files with email files, navigate to the Email Files section, and you’ll see the new Advanced Search window, allowing you to filter by subject, attachment, recipients, and more.
  • Advanced Search Features for Email Files

Examiners can now export Wi-Fi Location Artifacts as KML reports to import into a KML viewer of their choice.

  • Plugin Performance Enhancements
    • Mail
    • Outlook
    • Domain User Support
    • Brave Browser
    • Android Thumbnails
    • Music Library
    • Login Startup Items
    • SSH
    • Apple Dock
    • Installed Hardware
    • IOS Backup
    • Keyboard Shortcuts
    • Launchpad
    • Bash History
    • Connected iOS Devices
    • Printer Spool
    • Printer and Scanner
    • Network Interface
    • WiFi Locations
    • Music
    • Airport Wireless Network
    • Apple Installed Applications
    • Maps
    • Notifications
    • Reminder
    • Spotlight Settings
    • Screen Time
    • Time Machine
    • Escalated Privileges
    • Recent Items
    • Quarantine Events

Need help or want to chat about these new features? We’re happy to talk to you!

Email: Phone: +1 302.570.0015