Release 5.0

• Added the ability to investigate, extract, and report on Microsoft client email formats including Outlook and Outlook Express.
• Added the ability to read and ad E01 (Expert Witness) Formatted images.
• Added UNICODE support and localization for Japanese and Chinese character sets.
• Improved Microsoft Vista support for remote agent and client.
• Improved overall file I/O and Hashing performance.
• Fixed issue with random crash during content searches of specifically formatted images.
• Fixed long path issue effecting extraction of very long path items of interest from images.

Release 4.89

• Added a virtual “All Selected Files” folder in content view to show all currently selected items in a single view.
• Corrected “Daylight Saving Times” setting issue within user preferences.
  • MAC times are displayed based on the following scenarios.
    • When System's DST is ON and ProDiscover's DST is ON, the times will be the same as in Windows explorer.
    • When System's DST is ON and ProDiscover's DST is OFF, the times will be reported reduced by 1 hour to what in Windows explorer.
    • When System's DST is OFF and ProDiscover's DST is ON, the times will be displayed increased by 1 hour to what in Windows explorer.
    • When System's DST is OFF and ProDiscover's DST is OFF, the times will be displayed the same as in Windows explorer.
  • Note: The times displayed in the report are based on the times when the files are selected as EOI.
• Fixed Content – View *.* issue.
• Fixed MAC Time sort-by-date issue.

Release 4.8

• Content View items can now be sorted by “selected” tag in all views.
• Fixed issue with UnCompress.
• Fixed Copy Disk physical disk to physical disk image issue (destination too small)
• Fixed Copy Disk loop issue.
• Date Sort in Content view is now a true data sort.
• Fixed issue where batch calculate hash would fail.
• Fixed Menu View Report issue.
• Fixed issue where clear recent projects would fail.
• Fixed issue where all files view would fail to display MFT modified dates.
• Added the ability to concatenate hash export files.
• Added ProScript API’s Version 1.4
• Fixed issue causing ProScript raw reading file API’s to fail.
• Added the ability to image physical BIOS.
• Added the ability for ProDiscover to automatically start the remote system registry service is not already running during remote agent push. This service is required for remote agent push.
• Changed PSOpen() ProScript API to no longer need the second “IsDeleted” parameter.
• Fixed Issue with PSCreateImage() and PSCreateProject() API’s.
• ProDiscover will now remove any Prefech files created by Windows XP/2003 when removing the remote agent.
• Added support for VMWare allowing ProDiscover to create all image and support files needed to boot the imaged system in VMWare 5.0 and above.
• Added the ability to create or convert images to ISO format.
• Fixed an issue with long path names in internet history.
• Fixed an issue preventing certain HPA areas from being displayed.

Release 4.55

• MFT entry modified time has been removed from FAT Volumes.
• Added disk size to imaging dialog drop down .
• Wipe Disk Fails to stop when choosing “Close”
• Fixed an issue where content search would fail on local drives.
• Added the ability to query remote agent version via ProScript API.
• Fixed an issue where Filter By Hash set would fail to mark items selected until Find Suspect Files process was run first.

Release 4.54

• Added a work area field chooser allowing users to choose column order and which columns are in view. The field chooser is available by right-clicking over any column header in the content view work area.
• Each hashing algorithm now has its own column in the work area.
• Increased performance in content-view folder display.
• Added MFT entry modified times to the project report as "MFT STANDARD INFO entry modified:" and "MFT FILE NAME entry modified:"

Release 4.5

• Added a sortable hash column to the work area for all files.
• Added EXIF Metadata display for JIFF formatted images.
• Added a horizontal scroll bar for the project report.
• Added the ability for all wipe disk functions to be stopped by user.
• Changed project report format for clusters of interest to separate out clusters and sectors to avoid confusion.
• Fixed an issue where ADS files in the root of a disk would not display in the work area.
• Fixed an issue where cluster view would not be available for some physical disk.
• Fixed an issue where the PDServer remote agent would stop on small business editions of Windows Server 2003 when using ProDiscover GUI Push.
• Open project dialog box only allows project function to be selected once on start.
• Fixed an issue where the project report was not updated after clearing open ports information for remote systems.
• Fixed an issue where thumb drives could not be securely wiped with physical disk pattern method.
• Fixed an issue where remote thumb drives formatted fat32 would fail to view in content view.
• Fixed an issue where wipe disk partition progress would not be updated during wiping operations.

Release 4.4

• Added ProScript API’s for PSGetVersionInfo() to retrieve file version information and PSGetWorkingFolder() to retrieve the user preferences setting for the ProDiscover working folder.
• Now using the Microsoft GDI + functions for graphics thumbnail rendering for overall performance and stability increase while rendering graphics.
• Corrected an issue where ProDiscover would not allow restoring of split image files to disks.
• Corrected an issue where ProDiscover would crash when unable to retrieve the message Dll for Event Log processing.
• Corrected an issue where ProDiscover would not allow the selection of all deleted items folder as evidence of interest.
• Corrected an issue where ProDiscover would hang or crash while processing corrupted EXIF information in recovered jpg images.
• Corrected an issue where remote server disk creation would fail from menu option.
• Corrected an issue where gallery view would fail to render thumbnails on a logical partition image.
• Corrected an issue where network image capturing would fail if level 1 logging is enabled.
• Corrected a typo in find suspect files right-click menu option.

Release 4.31

• Changed to dynamic loading of the ActiveState Perl DLL Causing an increase in overall performance and stability.
• Changed the text of the check box in Event Log search from "Search in selected keys" to "Search in selected items".
• Corrected a typo in Appearances tab of Preferences dialog box.
• Changed support logging to log to a folder in split file segments rather than a single file.
• Fixed an issue where ProDiscover would not display all files from a directory when an unusually large number of files were recently deleted while in content view.
• Corrected a crash associated with the OS Info function on certain platforms.
• Corrected various typos in the manual and help file.

Release 4.2

• Added Data Carving Features to ProScript API
• Added two new ProScript API's for Auditing
• Updated CarvPrintArtifacts.pl script
• Added CarvJpgArtifacts.pl script
• Added example scripts for data carving and auditing API's
• Fixed an issue where crashes when selecting a cluster returned by a search
• Fixed an issue ProDiscover fails to search clusters on some physical thumb drive images
• Fixed an issue where ProDiscover would not show the file system of a thumb drive attached to a remote system
• Fixed an issue where ProDiscover for Windows and ProDiscover Forensics edition would attempt to listen on port 6518
• Removed "Find Suspected Files" right-click menu option seen in ProDiscover for Windows and ProDiscover Forensics editions
• Fixed a recursive folder display issue found on some remote systems in content view
• Fixed an issue where project files would now save images added associated with offline project mode

Release 4.0

• Added the ProScript API and ActivePerl to provide users unlimited extensibility and customization.
• Added the Windows Event Log Viewer.
• Added the ability to search Windows Event Logs.
• Added display of Last Accessed times for Windows Registry keys.
• Added the ability to right-click and extract selected fragments from Evidence of Interest.
• Added the ability to right-click and copy file and directory information to the clipboard.
• Fixed crash associated with Windows Server 2003 Dynamic Disks.
• Requires PDServer 2.4 or higher to connect to remote machine.
• Added an “All Files” virtual directory to the root of each partition in content-view allowing users to list and sort all files on the disk in a single view.
• Added the ability to view and add files Access Control Lists (ACL) to the project reports.
• Added IP information to the Windows Remote Agent window in addition to the title bar display.
• Added gallery view display capabilities to the search results window.
• Remote disk folders are now cached for faster browsing. Click on a folder performs folder update.
• The virtual “Deleted Files” folder containing recoverable deleted files in NTFS is now cached.
• Internet History can now be added to the project report.
• New menu option available under Network allows for simplified installation and removal of the PDServer Remote Agent.
• The remote agent process can no longer be killed by remote users when installed as a service.
• The remote agent is now protected from brute force password attempts.
• ProDiscover expects the command line like this:
• ProDiscover can now be launched from the command line with the following parameters .
• Report items can be copied to the clipboard.
• The Secure Wipe tool has been updated to allow user specified patterns on physical disk wiping.
• Fixed an issue where long image numbers would overwrite the password entry in image headers.

Release 3.83

• Issue with incomplete population of User profiles in registry editor in systems where ntuser.dat has become highly fragmented.
• ProDiscover crashes upon EOI selection in selected image files.
• Corrected Boolean logic cluster search.
• Add support for SHA256 hashing.
• New dialog box in PDServer help menu.
• Users are no longer prevented from copying to PhysicalDisk0.
• Add subsets – error searching tree.
• ProDiscover crashes while searching selected compressed images. vProDiscover crashes on searching for matched files selected compressed images.
• One registry entry has been changed. This registry entry used to store the hash type selected in Preferences. The name was “Preferences Dialog” with an integer value set to represent the type of hash using. It has been changed to “ChecksumType”. This holds a string value and contains the hash name. The old registry value will be deleted automatically on first use and the new value will be created.
• Added brute force password attempt lockout feature to PDServer.
• The ProDiscover Image data header format has been changed to accommodate SHA-256 checksum to be stored.
• ProDiscover version 3.83 requires PDServer 2.1 or higher to connect to remote machine.

Release 3.8

• Remote Agent Password is now encrypted when installed in stealth mode.
• Added Disk Label to image capture dialog box disk selection menu.
• Changed the Connect To… PDServer (password protected) dialog box text
• Added hashing progress bar.
• Resolved Registry Search stability issue on selected Windows XP installations.
• Fixed issue where ProDiscover would crash when accessing a compressed image of UFS file systems from x86 versions of Solaris.
• Fixed issue where ProDiscover would crash when attempting gallery view of the “deleted files folder” when graphic files were only partially recoverable.
• Fixed issue where saving a new project file over an existing project file would corrupt the original file.
• Fixed issue where physical memory capture would silently fail if the “add” tree-view item is expanded.
• fixed issue where using explorer to open a project file would cause volumes to be labeled x, y, z rather than c, d, e.
• Fixed issue where after opening a project file containing search results using “file open” the listed number of search results is the number of actual search results multiplied by the number of partitions in that image
• Fixed issue where ProDiscover would allow users to UnCompress an image file which was not compressed thereby expanding the image beyond its actual size.
• Added support for multiple overlaid file systems within a partition.
• Added a remote process explorer function to ProDiscover IR allowing drill-down and evidence selection of dependant dlls.
• Added a remote volatile system state capture capability to ProDiscover IR allowing investigators to capture ARP cache, route tables, open files, mounted drives and more.
• Fixed an issue where ProDiscover would crash when selecting “search terms” Drop Down when the search returned no results.
• Fixed several issues related to dynamic disks on Windows Server 2003 platform.
• Increased performance while selecting very large files.
• Changed report format for cluster chain data.
• Added the ability to include or not include cluster chain data in project report from user preferences dialog box.
• Added .dd as a pre-filtered image file extension when choosing to add images to the current project.
• Added hash sets containing over 1000 windows keystroke logger files in SHA1 and MD5.
• Fixed the crash when content search is performed on UFS volumes.
• Fixed an issue with searching all *.jpg files created between a particular dates.
• Fixed an issue preventing data display of $MFT meta file on NTFS volumes.
• Note: remote agents for Windows Platforms have been updated to new versions.

Release 3.7

• Fixed issue where ProDiscover crashes when connected to PDServer is running on Windows 98 and choosing Find Unseen Processes.
• Fixed issue where the cluster search results are not being properly filtered when a cluster search is conducted using more than one pattern. When the first pattern occurs more than once in the same cluster is being listed even when filtered on the second pattern.
• Fixed issue where after searching all files of type *.gif in a Solaris disk, ProDiscover displayed all gif files as expected but the results cannot be selected or content shown.
• Fixed buffering issue when hashing small files (< 100 bytes) in NTFS file systems.
• Added the ability to capture raw physical memory on local or remote live image acquisitions.
• Added the ability to flag files using “shift + right-click” then right click. Once files are flagged then can all be selected as evidence of interest using the right-click | flagged items pop-up menu option.
• Fixed issue related to recursively selecting all deleted files when the deleted folder contains in excess of 10,000 files.
• Added the string "Copy0_" to the beginning of each duplicated recovered item from the deleted files folder.
• Find unseen processes now displays the “system idle” and system process in the report.
• Added the ability to search the windows registry of images and live systems.
• Changed the Connect To… dialog box to provide optional network browsing of windows domains.
• Reworded several dialog boxes and alerts to provide better clarity.
• Fixed issue where ProDiscover would not launch on current patch level Windows Server 2003.
• Note: all remote agents and the Linux boot CD have been updated to new versions.

Release 3.6

• Added the ability to filter out search results from view in the search results window.
• Added the ability to find files from the cluster search results window.
• Added the ability to export any items marked evidence of interest in hashkeeper file format. This feature allows users to quickly create hash databases.
• Added cluster chain information to report for all evidence of interest.
• Added the ability to search only in unallocated clusters when conducting a cluster search.
• Added Adobe Acrobat Reader installation files for users without the reader installed.
• Fixed issue preventing data view area from being populated when reading early versions of NTFS. This issue also caused unpredictable results when selecting some NTFS meta files.
• Fixed issue where thumbnail index would be off when in gallery view for a directory which all graphics files could not be displayed.
• Fixed issue causing ProDiscover to not display the second partition of a remote disk that contained a hidden partition.
• Fixed issue causing ProDiscover to crash when users selected the first registry hive “HK_CLASSES_ROOT” in registry view on some systems.
• Fixed issue where ProDiscover would fail to display data view on compressed FAT32 images.

Release 3.5

• Added the ability to add comments to each entry of evidence of interest in the project report.
• Added the ability to add sub-sets of evidence of interest to the project report in RAW or ASCII/HEX view.
• Added a Windows registry viewer for Win9x, W2k and XP registries.
• Added the ability to display, extract and add to the project report EXIF meta data from Jpg and Tif graphic files.
• Added thumbnail gallery view option when viewing directories containing graphics files.
• Added the ability for users to add preview image to report in evidence of interest.
• Added the ability to display allocated and unallocated clusters for UFS and Ext 2/3 file systems.
• Added estimated time to completion to status bar during imaging operations.
• Added an alert dialog notifying users that a project must be open to add local or remote disks for preview.
• Added support for Linux Ext 2/3 file systems
• Added remote agent for Linux
• Added Linux boot disk with remote agent for system-at-rest imaging such as hard to get at notebook hard disks.
• Added 256 Bit AES encryption option to remote agent data stream in Investigator and Incident Response versions.
• Changes headdersig.txt file format to accept file extensions with or without “.”
• Fixed German language localization issue.
• Fixed FAT 32 Disk Label file hiding issue reported by Brian Carrier on CFTT List Server.
• Fixed issue where FAT 32 clusters would incorrectly be reported as unused.
• Fixed issue where PDServer remote agent would not run on Windows NT 4.0 and below systems.
• Fixed an issue where ProDiscover would appear to hang when selecting the NTFS root directory meta file $BadClus:$Bad. This file maps to the entire volume and therefore appears to hang ProDiscover. Users now have an option of only displaying the first 100 MB when selecting the $BadClus:$Bad meta file.
• Under certain configurations a Windows Server would attempt to install the digitally signed paremove driver as a service through the PDServer remote agent. PDServer now prohibits a local Windows Server from attempting to install the signed paremove.sys driver.
• Fixed an issue where ProDiscover would crash and/or not display the contents of an illegally named file in Windows file systems. Specifically a file with only a file extension and no name.
• TCP/IP performance tweaks for Windows 2000 and XP systems are now automatically made to the registry during product installation in Investigator and Incident Response versions.

Release 3.2

• Added the ability to create initial image in UNIX style ‘dd’ format or ProDiscover meta format.
• Added the ability to read split ‘dd’ images.
• Added Solaris X86 remote agent.
• Added known-bad hash file entries.
• Added Windows XP style right-click menus
• Added increased error checking when reading NTFS MFT data runs.
• Fixed issue where an extra \ was added to the default temporary path when changing ProDiscover temporary folder.
• Fixed issue in baseline and compare where some baseline files contained an extra \ in the definitions section.
• Fixed an issue in baseline compare operation where in limited circumstances some Program Files folder directories were missed in the compare operation.
• Fixed Remote Agent DLL entry point issue on Windows NT 4.0 platforms.
• Fixed issue where searching for “files named” would fail on Solaris UFS.
• Implemented find unseen files for Solaris
• Updated hash database of known-bad files (Trojans and Rootkits).
• Updated Documentation (help file and manual)

Release 3.0

• Added the ability to export evidence of interest or clusters of interest to XML formatted file.
• Added the ability to create a remote server agent from the Tools menu.
• Added the ability to create images which are split into many files for archival.
• Added the ability to add split "dd" images to a project.
• Added IR menu to ProDiscover IR version.
• Added the ability to find unseen processes running on local or remote systems with ProDiscover IR version.
• Added the ability to quickly find unseen files or remote systems with ProDiscover IR version.
• Added the ability for ProDiscover IR version to create and compare file baselines using hash values.
• Added the ability to select or unselect "all" files from search results.
• Improved file selection performance.
• Added the ability for ProDiscover IR to more quickly find suspect files based on hash value database.
• Added File system support for Sun Solaris UFS.
• Windows versions of HPA Device driver and PDserver.exe are now cryptographically signed and verifiable through the Thawte CA.
• Added Sun Solaris version of PDServer Remote Agent.
• Changed Software copy protection system to provide more flexibility.
• Updated hash database of known-bad files (Trojans and Rootkits).
• Updated Documentation (help file and manual)
• Fixed File Menu Print option failure.
• Fixed issue where ProDiscover image verification would fail to correctly validate images hashed with SHA1 algorithm.
• Fixed Image conversion to dd format utility.

Release 2.8

• Changed Project file’s XML Schema to support separate fields for Modified, Accessed, and Created time values.
• Added the ability to save a projects search results from session to session.
• Added the ability to select groups of, or individual clusters as evidence of interest.
• Added updated scripts to install PDServer as a service. Once installed the scripts will automatically start the service.
• Fixed an issue where PDServer would not return to normal mode (window shown) after switching to stealth mode.
• Fixed an issue where cluster searches of compressed FAT32 images using early image header design would fail.
• Added full Boolean (AND, OR, NOT) capabilities to search terms.
• Changed sector location reporting format to include Hex and Binary location values in the following format: “HEX (Binary)”.
• Fixed an issue related to 16 – 32 bit thunking which caused false positive search returns on Win98 SE platforms.
• Added the ability to load search strings from a text file with (.sts) file extension.
• Added a large group of pre-defined search term sets.
• All cluster search results are now returned as objects in a “Cluster Search Results” tree-view item with the search term highlighted.
• All Content search results are now returned as objects in a “Content Search Results” tree-view item with the search term highlighted.
• Fixed an issue where selecting “View | Startup Dialog” when the startup dialog was enabled would crash ProDiscover.
• Fixed an issue where ProDiscover would crash if the user attempted to access a remote disk which the server connection had been manually disconnected.

Release 2.6

• Added full dynamic disk support for windows NTFS to include RAID 0, 5 and spanned volumes.
• Added the ability to manually adjust the number of auto retries on network timeouts when using the PDServer™ Remote Agent.
• Increased preview performance over the WAN when using the PDServer™ Remote Agent.
• Increased imaging performance over the WAN when using the PDServer™ Remote Agent.
• Added the ability to correct for daylight savings times calculation errors in Windows NTFS file systems (submitted by Brian Carrier on the CFTT Listserv)
• Improved preferences dialog box layout to accommodate user adjusted time zone settings.
• Corrected an issue where the "List of words found:" section of search results in report was truncated by one character.
• Added the ability to read partition-only dd images.
• Removed the ability to add the same physical disk more than once.
• Corrected an issue where ProDiscover would crash when adding remote images with UNC (\\MachineName\directory) paths.
• NTFS Metafiles are no longer hashed when using “filter by hash set”.
• Fixed issue where in some cases ProDiscover would warn users "Source is larger than 4Gb..." when the actual source size was smaller than 4GB. In all test cases ProDiscover would image correctly and without error after displaying the error.

Release 2.44

• Added the ability to read multiple extended DOS partitions (submitted by Brian Carrier on the CFTT Listserv)
• Added the ability for users to set unique file type display color.
• Added the ability to display and analyze NTFS $ metafiles.
• Added the ability to include NTFS $ metafiles in content searches.
• Added extended disk information to the project report.
• Added the ability to recover sectors from remote disks.
• Fixed individual file hashing errors.
• Improved PDServer network performance over WANs and busy LANs.
• Added the ability to inventory remote disks.
• Added the ability to read and analyze NTFS dynamic disk.
• Tree-view items are now expanded on program load.
• Added a “Connect To…” button on the button bar.
• Fixed an issue where choosing the View -> Report menu item would cause a program crash in some situations.
• Fixed SHA1 hashing algorithm implementation issue.
• Added the ability to add disk with multiple primary partitions to a project.
• Added system bound IP address to the PDServer title bar.
• Added registry tweak file for improving ProDiscover IR performance over network on Windows XP and Windows 2000 systems running ProDiscover IR client.
• Added “known-Bad” hash files in hashkeeper format. Files contain known Trojan and rootkit hashes in MD5 and SHA1.
• Added NIST RDS Hash subsets to the “hash sets” directory.
• Implemented the ability to analyze NTFS software RAID level 1.

Release 2.2

• Added the ability for PDServer to pass Hardware Protected Area information to The ProDiscover® client. This addition allows for remote imaging and analysis to now include protected areas implemented with the ATA specification HPA (PARITES). This feature is currently available only on systems running Windows XP and Windows 2000 prior to service pack 3 installed. Microsoft changed security settings in Service pack 3 which prohibit the PARemove.sys driver from dynamically loading. We are currently looking into a resolution to this issue. Windows 98 SE architecture prohibits dynamically loading the PARemove.sys device driver.
• Added disks volume serial number to the ProDiscover® report.
• Added the ability to automatically extract any resulting clusters from a cluster search.
• Added the “Preferences” setting to adjust network timeout when connecting to a remote system with PDServer. This setting is useful on busy LANs or when connecting to PDServer’s over long distances.
• Enhanced error recovery when examining Windows XP NTFS formatted disk with corrupted Master File Tables (MFT).
• Added the ability to choose “none” for hashing algorithm to allow the creation of evidence of interest indexes with out hash value.
• Added batch hash calculation to add hash values to evidence of interest without prior hash calculation
• Fixed issue causing crash when using “File | Save As” to save project reports under a new name.
• Fixed issue where the ProDiscover® report was not showing all project information.
• Fixed an issue where ProDiscover® would allow users to select the ProDiscover “Working Folder” as evidence of interest, effectively creating temporary file recursion.
• Fixed incorrect icon for disks in remotely connected disks.
• Fixed issue where using Content Search with “Select All Matches” and “Search for files Named” successfully returns a list of search term files but fails to mark search results as “selected”.
• Fixed issue where ProDiscover® Crashes when selecting signature matching and the physical drive is selected in Content view rather than a partition.
• Fixed issue where ProDiscover® would miss imaging some slack sectors at the end of certain hard disks.
• Fixed an issue where some Windows 98 SE users would receive an error in “netapi32.dll” on ProDiscover® program launch.

Release 2.1

• Preview live systems remotely bypassing all file security.
• Choice of Clear and TwoFish encrypted data channel.
• Stealth Mode for covert imaging and analysis of live systems.
• Configurable port settings.
• Server is read only protecting data. Note: Stealth mode requires one-step installation.
• Secure client/server connection allowing only one connection.
• Conduct Searches, hash comparisons and deleted file recovery remotely.
• Run PDServer from a floppy, CD or USB drive.
• Connect to PDServer over high-speed Corporate LANs and WANs

Release 2.0

• Fix for the delay in UI after the OK button is clicked in Capture dialog box.
• Fix for the image being captured to FAT disk: A warning message is now provided to the user when the source is more than 4GB and the destination is FAT disk.
• Fix for the error "Capture interrupted" during opening of the compressed image files.
• Fix for Compression Header.
• Fix for corrupt compressed image files in certain circumstances. Now using 64 bit image file addressing.
• Fix for incorrect processing of image files in content-view that contain the string “PhysicalDrive” in the image name.
• Fix to no longer treat letter case as significant during file sort in content-view.
• Fix for when using Filter by Hashset, with Compare Recursively set to off, no files are selected even the user chooses any of the Select all matches or Select all non-matches option under file selection.
• Project files are now in XML format allowing easy parsing and integration with many reporting tools.
• Added a new tool for converting project files. See the menu item “Tools | Convert Project File”
• Reports can now be exported in RTF format as well as TXT format.
• Added the OSInfo feature to detect OS by parsing registry and file identification.
• Added the ability to right-click on files from content-view to locate a specific file’s cluster locations. Double-clicking on location will change window focus to the selected cluster view grid location.
• Added the ability to right-click on clusters from cluster-view to locate any associated files.
• Changed default cluster-view navigation to hex values.
• Added the display of extended ASCII characters in cluster-view.
• Export cluster data now allows users to choose binary as an export format.

Release 1.62

• Greatly improved directory listing speed in content view for directories with large numbers of files.
• Added the ability to recursivly unselect files in content view.

Release 1.60

• Added a Disk Inventory feature which will add the total file and folder count to a project report for both a physical drives and an images.
• Added new icons for deleted folders and files.
• Added the ability to mark files as evidence of interest as the results of a content search.
• Added an image format conversion utility to Tools menu to create a UNIX “dd” format image from any ProDiscover created image. Converting images to "dd" format is useful when the user desires to analyze evidence with one of the many tools which support the "dd" format.
• Added Hard Disk manufacture information to image information area.
• Added Image File Dialog Box information caching feature allowing investigators to create multiple images more quickly.
• Fixed an issue where not all files are displayed in content view when a deleted directory of the same name exists.
• Fixed an issue where ProDiscover would crash when immediately choosing “Tools->Copy Selected Files” after opening a previously created project.
• Fixed file size being reported incorrectly for very large files on NTFS volumes.
• Fixed issue where HPA Scan from within cluster view would report incorrect file system.
• Fixed issue where ProDiscover^® would crash during file signature compare of “corrupt” files in FAT32 volumes.
• Updated the help file.

Release 1.54

• Includes a fix for silent failure to copy disk in certain situations.
• Includes added sector location information to status bar in cluster view.
• Includes the ability to extract unallocated space and disk slack as a single file or multiple files with click-n-drag.
• Includes a Windows device driver allowing users to non-destructively detect and analyze the Hardware Protected Area from within Windows.

Release 1.44

• Includes a fix for missed sectors during some floppy cluster searches.
• Includes an updated help file.
• Includes a fix FAT tables not being included in report sector count.

Release 1.42

• Includes the ability to add compressed images to a working project.
• Includes added status bar information during operations.

Release 1.39

• Includes a new File Signature Mismatch feature to compare file signatures against file extensions.
• Includes the ability to set the ProDiscover temporary directory from the preferences dialog.
• Includes an updated help file.
• Includes image file compression enhancements.

Release 1.35

• Includes fix for adding large image files to projects.
• Includes fix for error reporting.

Release 1.34

• Includes fix for Windows 98 direct physical disk access issues.
• Includes the ability to restore an image to a physical disk.
• Includes an updated help file.

Release 1.30

• Fix for cluster search radio button
• Updated help file.

Release 1.29

• Support for recursively comparing files against hashkeeper checksums. Batch file transfers of evidence of interest.
• Bates numbering of files during batch transfer.
• The ability to search only files marked “Evidence of Interest”.
• Several minor bug fixes and performance enhancements.
• Updated help file.

Release 1.16

• Support for UNIX “DD” images of all Windows file formats.
  
• MAC times are now added to the report for all evidence of interest.
  
• Fix for hot key functionality.
  
• Fix for ProDiscover crashes when attempting to print with no printer installed.
  
• Fix for improper imaging of floppy disks in some versions of Windows 98.
  
• Fix for imaging disk slack space.