New MetaDiver Beta for your MetaData pleasure!

After a lot of hard work the new beta of MetaDiver is available!  download

Many changes to talk about but to remain brief I have listed a few below. Hope you enjoy MetaDiver and send feedback!

What’s New – Release 1.1

• PDF XMP MetaData is extracted as well as more information for Windows Shortcuts, and URL files.
• Nearly total rewrite for parallel threading making it much faster!
• User Interface has been improved.
• Option only extract Shell meta-data.
• File hashing has been added for MD5 and SHA1.
• XML and JSON export formats added.
• You can review before exporting using the “Review” button or just auto export.
• Option to show only certain file type by extension.
• A predefined list of fields (over 300) now set allowing for re-ordering columns and assigning to certain file types in the future, etc...
• Check for new release in the About window.
• Some logging added.
• Lots of bug files.

In the works

• A professional paid version with features an Enterprise user or Examiner expect such as case information, reports, database output as well as user support.
• Continue to expand the meta-data that can be recovered for file types by writing parsing libraries to include additional forensically relevant information.
• GPS location information for Images.
• Option to skip shell extraction and go with 3rd party libs only.
• Enhance the way you choose file types to use.
• Exclude columns.

New look! New Features!

   

 

 

Enjoy!

What's going on @ easymetadata.com

It's been almost a month since my last post so I feel I should put an update together to talk about what has been happening!Around Dec 18th I put out a version of MetaDiver that shouldn't require .Net to be installed which I feel should be beneficial for environments that are locked down or on server's where you may not want to have .Net Framework installed for various reasons! In the future I will probably provide a version that requires .Net and another that does not.

In general a lot is going on behind the scenes. I am working on restructuring the code for MetaDiver so I can put out a command line version and a new graphical version with more features! Additionally I am trying to implement parallel processing for what I think will be massive speed improvements for large datasets! Very exciting. There is more that would be fun to talk about but I'll save it for another time. The holidays have made it hard to think about work or work..and the Gym is calling. 

Also I'm also revisiting ShadowKit which has hasn't had an update in about a year. I have received interest from person's looking to use it to recover their files in Windows 7 and Windows 8. Apparently from what I am being told it is harder to recover previous version of files in Windows 8 through explorer than Windows 7. This is where ShadowKit comes in, it's easy with this tool! So I'm working on adding drag and drop, making it more novice friendly and restructuring the code to add some of the speed I can achieve with Metadiver. All this of course takes time so it could be a while.

I should have a new version of MetaDiver coming out around the end of January, hopefully earlier that will be pretty cool.  Folks in e-discovery, forensics and InfoSec, or just interested in meta-data in general should find it useful.

The website
I have easymetadata.com up and running with some simple templates. Download links have been updated and Shadowkit and MetaDiver have been consolidated to www.easymetadata.com! I'm guessing you sense a theme.

Keep checking back for updates!
David

New MetaDiver beta is out!

  Well there has been a lot happening on the project and otherwise the past few weeks and I'm really excited that the new beta has been released!

Beta v1.0.8 - Release notes

  This release has a lot of improvements. A few are: processing time, PDF's metadata is extracted, error handling is better, and the column's order a bit better so it doesn't look like like a complete mess.

  The code is in place to handle PDF's (you read that right). It's still needs some more testing with it improving each day but so far it seems pretty solid!

Go get it

Requirements: You'll need at least the .Net Framework 4.0 and Windows 7 or later to run it.

You can grab the latest version at easymetadata.com/Downloads.

Enjoy!

Notes

  I have started working on a website to house my various projects. You can check it out at www.easymetadata.com. It's just a simple site right now for something fancier later.

  On some system's Excel claims the xlsx output is corrupt but the data seems fine. If you have problems just use a different output. There are minor UI tweaks, an About screen and a lot of plumbing you don't see.

  Still no install package. Microsoft did away with the simple Setup projects after VS2010 and went to Wix Toolset which I am having to learn. It looks powerful but more work (aka, distraction) than I had planned on. If you are interested in learning more I am planning on putting together a post on Wix once I have a handle on it.

Feedback

*Please send or post Feedback if you find this tool useful, have issues running it or feature requests! Post your feedback to twitter #MetaDiver.

MetaDiver update and next steps

  Let's talk about what's been happening since my first post about MetaDiver. I've been excited to see the views to the blog since the MetaDiver post and that has me feeling there could be a lot of interest in this project.

Headache's  w/PDF

  I've been been putting a lot of testing and research into Shell32's PDF handling. Unfortunately I found that Ad*b* reader's pdfshell.dll is broken or unreliable on 64 bit OS. I know it worked on my two computers until recently so something has changed. I've tried every scenario I could find or think of to no avail to make the 32bit dll work properly with Shell... My takeaway is it's clear that we can't depend on Ad*b*'s dll with Shell32. To avoid this issue altogether I'm pulling the PDF meta-data outside Shell. Below you can see the meta-data I am able to pull so far. Not bad!


 

 For those that would like to see PDF details in Shell and Property->Details in Explorer there is a solid product available. It's trial-ware with a $40 cost to purchase after 30 days. If you are cool with that then go that route, it works very well. It's called PDF-ShellTools you can find it here.

Here's the project status so far!

 Going Forward

  I may only provide the Shell version for free and a Pro version with all the extra work included as a 30 day time based Beta. This is evolving and ongoing so we will see. I want to make sure that the base version of MetaDiver is very functional, reliable and add's value to many people and organizations while remaining simple and strait forward.

Here's where it's at

Working on Website and Wiki for MetaDiver.  <-- Domain and hosting package purchased
Working on Exception logging so I can give you a Manifest success and failures.  <-- ETA is Soon
Working on Bug squashing and speed improvements. <-- ETA is on going.
Working on Exif GPS parsing and decoding using.  
Requested - XML output.
Ability to specify a matter name for organizing information. <-- ETA is Soon

Other features that may or may not be part of a buy up/donate version

Working on Testing PDF handling with library outside shell. <-- ETA is Soon
Database support via ODBC and/or SQLite/OLEDB database table
Other file formats.
Requested - Profile's allowing you to only pull the Field Column's you want.
Column reordering.
Requested - Windows placement memory.

 

Wrapping up

  As you can see a lot is going on. For those interested in a super duper MetaDiver version stay tuned!

New Beta this Friday.

Keep coding

Introducing MetaDiver!

I'm pleased to share a program I have been working on for the past few months. MetaDiver extracts metadata from known files such as Office Docs and PDF's using the Windows Shell. Really anything Shell has a dll registered for in theory... It spits out a nice spreadsheet or delimited document with the attributes you are interested in. With more features planned in future releases I'm really excited about the simplicity and power of this product! This isn't a forensic tool in that it doesn't parse the file but it's a great way to take metadata that is a pain to review in most Forensic and IR tools and make it much easier to work with. It's also a great sanity check against your tools. You should be able to mount an image with your favorite tool and point this guy to the files your are interested in. However I have only tested against data on my hard drives that has already been exported using my favorite forensic tools. If it's more than 10-20 documents it could take a while to finish which it percolates so just be patient, grab a beer or coffee and give it time to get through everything. It will tell you when it's done!



Download v1.0.7 or click here.

Info: Right now it's just zipped up without an installer, I hope to add one soon. Just download, unzip and keep the files in the directory with the exe.

Requirements: Windows 7 or later and .NET 4.0.

Please send feedback if you like it, hate it, whatever.

Enjoy!
ddym@redrocktx.com