New updates and improvements to Forensic Email Intelligence

  1. 1.7.8166


    ✔ FEI now supports ingesting, rendering, and examining additional MAPI item types such as calendar events, tasks, contacts, sticky notes, and RSS feeds.

    ✔ It is now possible to export a subset of the ingested data both as loose files and as MAPI containers where applicable.

    ✔ Added the option to include an export manifest with data exports.

    ✔ Added new Insight for MIME items with deferred delivery.

    ✔ Added definitions for various MAPI enumerations.

    ✔ Introduced the option to skip batch Insight Score calculation during ingestion.

    ✔ Improved the performance of bulk tagging a large number of items on the Evidence Grid.

    ✔ Added in-place help system to decribe the functionality of certain features within the software.

    ✔ Various performance and user interface improvements.

  2. 1.6.8147


    ✔ FEI can now export evidence items from the Evidence Grid. It is possible to export the selected items, or all visible items on the grid based on any filters that were applied.

    ✔ Added a new MAPI insight for messages that were sent using the Delay Delivery option in Outlook.

    ✔ Various other performance and user interface improvements.

  3. 1.5.8130


    ✔ Introduced the ability to export data from FEI's Intel panels such as Entities, Timestamps, and Attachments in multiple formats.

    ✔ Introduced FEI Decoder to decode timestamps and Base64-encoded strings via the right click context menu. More decoding options will be added as needed.

    ✔ It is now possible to navigate to the previous/next item in the Evidence Grid when FEI Viewer is in focus. The global shortcut for navigation is CTRL+Up or CTRL+Down.

    ✔ Added support for Mozilla Thunderbird Message-ID and MIME boundary values.

    ✔ Added definitions for various MIME headers.

    ✔ Added insights based on the newly-added Exchange header definitions.

    ✔ Extracted entities are now sorted alphabetically where applicable.

    ✔ Improved the resilience of MAPI header parsing against invalid headers.

    ✔ Improved PDF printouts from Render view to reduce unnecessary pagination.

    ✔ Improved the visibility of hyperlink previews in Render View in dark mode.

    ✔ Resolved an issue where certain Evidence Grid search and sort operations could cause unexpected behavior.

    ✔ Numerous other performance and user interface improvements.


  4. 1.4.8084


    ✔ Improvements to URL Intel GUI and performance.

    ✔ Added In-Reply-To and References headers to the Evidence Grid.

    ✔ Timestamps view and automated analysis now include timestamps of non-attachment MIME entities that have timestamps.

    ✔ Added an additional insight and associated Red Flag about Postfix Authenticated User.

    ✔ Added an additional insight about messages that contain quoted message bodies but no References or In-Reply-To fields.

    ✔ Improved detection of Outlook quote stings.

    ✔ Changed formatting of MAPI property tag display to follow Microsoft's documentation more closely.

    ✔ Fixed an issue where double-clicking an item on the Evidence Grid while FEI Viewer is open could behave unexpectedly.

    ✔ Attachments tab in MAPI view is now only displayed when needed.

    ✔ Numerous minor performance and visual improvements.


  5. 1.4.8077


    ✔ Introduced urlscan integration for URL intelligence.

    ✔ Introduced local diff tool integration for item comparisons.

    ✔ Expanded MAPI support to include two additional tabs: Recipients and Attachments

    ✔ Improved resolution of certain enum MAPI properties to provide information in addition to the raw MAPI data.

    ✔ Increased color contrast in dark mode for improved visibility of certain elements.

    ✔ Improved handling of items with no body text.

    ✔ Improved support for MIME items with an invalid first line.

    ✔ FEI Viewer now automatically adjusts its size and position at launch on smaller screens.

    ✔ SecurityTrails API credentials are now validated against the API, and the remaining quota is displayed.

    ✔ It is now possible to batch-export email attachments. FEI automatically names the exported attachments to avoid collisions if needed.

    ✔ Improved the scroll experience in attachments view.

    ✔ Improved the performance of domain intelligence.

    ✔ Certain export processes such as exporting attachments and PDF printouts of emails now display a button to open the exported file directly upon completion.

    ✔ Improved the performance of transport header extraction from MAPI items and made it more resilient to invalid MIME headers.

    ✔ Content-length checks are now applied to messages in bulk, and a corresponding red flag is included in the Red Flags column in grid view.

    ✔ FEI now parses the individual Gmail labels in Grid View and provides the option to filter for them. This makes it easier to get a tally of which labels are present in a collection (e.g., a Takeout import or an FEC project import).

    ✔ Improved the visual design of subdomain intelligence and made it possible to copy individual subdomains to the clipboard.

    ✔ Numerous minor performance and visual improvements.


  6. 1.3.8049


    ✔ Fixed a rare issue that prevented messages from being rendered in certain time zones.


  7. 1.3.8046


    ✔ Added new insight for messages missing DKIM signatures. Only applies when a message was expected to have a DKIM signature due to its sender and timing information.

    ✔ Added new insight for removed email attachments.

    ✔ It is now possible to filter the Evidence Grid by the red flags of each message.

    ✔ Insight Score is now represented with a corresponding color in the Evidence Grid for improved visual identification.

    ✔ Folder tree now contains the item counts for each subnode.

    ✔ It is now possible to import / export the layout of the Evidence Grid—including any active filters. When FEI is launched, it remembers your last layout automatically.

    ✔ Built-in Evidence Grid layout templates introduced to make it easy to switch between different layouts for different types of email evidence (MAPI, MIME, compact, etc.)

    ✔ It is now possible to copy only the value of a single Evidence Grid cell. This makes it easier to pivot on that value and use it as a filter.

    ✔ Performance improvements to folder tree creation.

    ✔ FEI now checks the version of the project database being opened and reports back if it is incompatible with the version of the software that is being used to open it.

    ✔ Improved handling of failed DNS lookups when verifying DKIM/ARC signatures while batch Insight scoring during ingestion.

    ✔ Improved MIME header parsing from MAPI items.

    ✔ Improved resource management during navigation among multiple MAPI stores via the Evidence Grid.

    ✔ Path of the MAPI container being ingested is now displayed during ingestion.

    ✔ Clearer representation of MAPI items missing transport headers.

    ✔ Extended timestamps and insights for MAPI items with data points extracted from MIME headers.

    ✔ Fixed an issue where context switching between reviewing a container's contents in the Evidence Grid and reviewing a loose item dragged and dropped from the outside onto FEI Viewer did not behave as expected.

    ✔ Presence of DKIM/ARC signatures and the Content-Length header field value can now be queried for MAPI items even when those data points cannot be leveraged due to the underlying MIME data being unavailable.

    ✔ Numerous minor performance, stability, and GUI improvements.


  8. 1.2.8021


    ✔ Added attachment count and list of attachment names to Evidence Grid.

    ✔ FEI now remembers your timestamp sort preference (chronological vs. reverse chronological order) between messages and between sessions.


    Option for Timestamps to be chronological

    In the Timestamps sub-menu of the Viewer, the Timestamp (UTC) column always defaults to reverse chronological sorting. Please offer an option in the Settings to default to chronological sorting. Alternatively, you could have this sub-menu's column sorting state retained between launches of FEI. Either way, I would like to be able to view the timeline chronologically (oldest events first) all of the time. Currently, I have to re-sort the Timestamp column as the first part of my workflow, every single time I open this sub-menu.

    Michael Y


    ✔ Resolved a dongle issue that manifested itself on VirtualBox.

    ✔ FEI now remembers your last input folder.

    ✔ It is now possible to select a subset of the evidence grid and copy it to the clipboard, including the header row. The resultant data can easily be pasted into Excel to create a small spreadsheet.

    ✔ It is now possible to select an individual cell on the Evidence Grid and copy its value (without the corresponding header row) to the clipboard. This can be used to quickly filter by that value.

    ✔ FEI now displays the version of the software that was used to create the FEI project that is open.

    ✔ Optimizations to startup time.

    Important Note: Due to significant changes to the project structure, this version of FEI cannot open FEI projects that were created using earlier versions of the software.


  9. 1.2.8012


    ✔ Added MAPI EntryID and Message Class data points to the evidence grid.

    ✔ Switched the default filtering mechanism for some grid columns from "Begins with" to "Contains".

    ✔ FEI Viewer no longer displays the message drop target if a side panel is open. This is so that the opened side panel is not obscured by the drop target.


    Check for Updates button broken in standalone viewer

    In the latest release, in the stand alone viewer with no email loaded you can open the Updates sub-menu on the right but the "Check for Updates" button does not do anything.

    Michael Y


  10. 1.2.8011


    ✔ Improved the responsiveness of folder tree view.

    ✔ It is now possible to search the folder tree to locate a specific node.

    ✔ Menu items in FEI Viewer that do not require a message to have been loaded are now enabled by default.


    Intel buttons should be accessible in the standalone viewer without an email loaded.

    When launching FEI and choosing to Launch Viewer, it would be nice to have access to the 4 Intel buttons (IP Intel, Domain Intel, Email Intel, and URL Intel) without loading an email. Currently they are grayed out be default. Basically, I would like to be able to use FEI to access these various APIs for things other than email investigation. FEI can currently do this but I have to load a dummy email before getting access to those features.

    Michael Y


    ✔ Improved logging of project details and evidence items that were added to a project during ingestion.

    ✔ During ingestion setup, FEI now automatically suggests a randomized evidence identifier for new evidence items to speed up project setup.

    ✔ Ingestion page now displays a brief summary of the active project as well as a hyperlink to access ingestion logs.

    ✔ FEI's title bar now reflects a brief summary of the active project.

    ✔ Numerous minor performance and GUI improvements.