It’s all about the Objects!

In 2026, it’s still all about the objects.  We have completed our new ability to evaluate data at the objects level.  Not only are we profiling each object with fuzzy patterns, but we are leveraging this ability to identify Trojan Objects and Steganography Objects.  Now, we are updating more file types to apply this method for identifying suspected threats.  These updates also feed into our Dark Carving technology.  When we complete this work on more popular file types, we will be automating the search for threats across all files involved in any investigation.  You can then choose to scan a little slower, with the added ability to catch more dark data.  Dark Data Detective v5.04 is now available!

The screen shot on the right shows some of the benefits from our new upgraded methods for identifying the individual objects in a file, and extracting the fields and metadata inside each object. On the Metadata tab, each metadata field is detailed as to where it was found in an object, and how it is stored.  We also improved the Hex and Text tabs for better useability.

We now bundle the first year of maintenance & support for free with perpetual license purchases.  This lowers the price as much as $50 [Business tier] to $200 [Advanced tier].

 

 

We are preparing to release the new D3 .NET Assemblies as an upgrade to our File Investigator (FI) & File Expander (FE) C Libraries. We are committed to maintaining, supporting and adding file types to FI & FE as long as we have customers renewing their Maintenance & Support on them. So, there is no risk here, of those products ending prematurely.

The upcoming D3 Assemblies release will consist of:

• D3 Carving Engine = New Dark Carving technology [in Alpha]
• D3 Files Engine = Streamlined file identification methods from FI.
• D3 Metadata Engine = Upgraded metadata extraction methods from FI.
• D3 Objects Engine = Upgraded objects extraction from FE.

We will combine all of these assemblies into one Digital Forensics/Electronic Discovery set of APIs, and license them together. The benefits to you will be:

• All 64 bit .NET Managed Code Assemblies.
• Extraction of all Text Content (via D3 Metadata Engine).
• Simple XML based interfaces, consistent across all assemblies and expandable to accommodate new features without breaking backward compatibility.
• One full set of data extraction assemblies from a single source.
• Support for multiple platforms (Windows, MacOS, iOS & Android via .NET).
• Overlap licensing, to support existing FI & FE C libraries still in the field.

If you are interested in the D3 Assemblies, then please provide FEEDBACK to us.  We’d like to hear your thoughts on licensing plans, code interfaces, new feature ideas, and any other input that you may have.

 

 

 

 

 

In 2026 Q3, we are completing our Object Level Metadata Extraction, building on the additional details that we started collecting on each object type in the development of Dark Carving.  This will super charge our ability to collect all of the metadata in each file, as well as detect steganography hidden in Trojan Objects, Object Slack and Field Slack.  Some files contain multiple sets of metadata in different objects.  When metadata from one object is partially missing or manipulated, then it can be compared against the metadata found in other object(s).  The hidden and unused bits and bytes can be used to hide data for criminal and terrorist activity.

Our further development of Dark Carving is continuing along side our expanded Metadata development.  The screen shots (on the right) show successful carving of some file types that we have selected for their differing attributes and structures.  In stage 1 [Matches], we start by scanning for header, body and footer signatures of the objects that act as the building blocks for every computer file.  In stage 2 [Objects], we step through the matches found and build the objects.  In stage 3 [Files], we step through the objects found and build the files.  We expect that parts of many of the objects and files may be missing, which is why we use the more granular method of collecting the objects first.  While in BETA 1, we currently support a small list of file types with complete knowledge of every object and fields (within the object), which empowers us to recover these file types better than any other solution.  For the rest of the 4,900+ file types that we support, we use a brute force method utilizing file header, body and footer signatures along with fuzzy data block matching.  Our methods are far more advanced in comparison to the rest of the industry, and as we add complete knowledge of more file types with each quarterly release we will secure our position as the Best In Class solution for recovering all file types.  We welcome your FEEDBACK of features that you would like us to add.

 

 

 

 

 

In 2025, we completed our Data Carving Engine BETA 1, with native support for 100’s of file types, as well as object edge detection support for thousands more.  The end goal is to increase our file types to 5,000+, all with file identification, objects extraction, upgraded metadata extraction, best in class data carving and malicious objects detection.  Watch out virus scanners, malware detectors, metadata extractors, steganography and data recovery tools.  We’re heading into your domains.

In 2024, we laid the groundwork for our new Data Carving Engine “Dark Carving”, and introduced “Object Carving”. We start by searching for Object Signatures, then index all of the full and partial objects identified. Next, we piece the objects together into full and partial files to be carved. The screen shot (right) shows the Objects tab, as an example of what you would see when carving a Graphics Interchange Format (GIF) image. The Files tab includes the resulting GIF file. The Matches tab shows all signature matches, used and ignored. One challenge in carving at the object level is filtering out the false positives.

We recently wrote the blog post, “The 10 Common Data Carving Approaches“, to provide a base of understanding for us to build upon when we introduce our new methods. While many of the techniques listed are important to include, the current industry solutions implement them like using a sledge hammer to drive in a screw. Just searching for file header and footer signatures, then using trial and error to test the questionable results with interpreters and/or external applications, are blunt instruments. Our methods are more like using surgical instruments to operate around delicate organs. Your data is vital to you, and should be treated delicately as highly valuable assets. Another blog post, detailing Object Carving, will be provided soon.