CCL has launched RabbitHole v4, introducing support for three new data formats, enhanced SQLite forensics and improved analysis tools to help digital forensic investigators uncover valuable evidence more efficiently.
CCL Solutions Group has released version 4 of its digital forensics data viewer RabbitHole.
With the addition of RealmDB, MMKV and Mozilla IndexedDB, the data viewer now supports 45 different datatypes in a single tool. Version 4 also builds on advanced SQLite forensics features, with new timestamp decoding and Insight features.
RabbitHole is continually developed to help analysts get more from the data they examine. This release combines planned enhancements with new functionality requested by users, reinforcing its role as an indispensable part of the modern-day DF toolkit.
A key focus remains SQLite, one of the most widely encountered database formats in digital forensics. Building on the deleted-data recovery added in version 3, version 4 adds inline timestamp decoding, allowing analysts to interpret timestamps directly within database tables without writing queries. A new Insights tab highlights table relationships, potential gaps in record sequences and missing tail records, helping analysts identify areas for further investigation.
Support for three additional formats has also been included, taking the total to a class-leading 45 data types:
Further enhancements include improved Protocol Buffer interpretation, a new Strings tab in Hex View, synchronised tree and text views for binary property lists, and wider performance and usability improvements.
CCL Principal Analyst and RabbitHole creator, Alex Caithness, comments:
“RabbitHole has always been about helping analysts get more from the data in front of them – and making it quicker and easier to do so. That means we're always working to improve on its established capabilities, adding support for new formats and listening to users about how we can make things better. Version 4 brings those strands together, expanding SQLite forensics functionality while introducing new ways to examine data and making improvements throughout the tool.”
RabbitHole continues to deliver on its promise to “pick up where other tools leave off”, helping analysts uncover potentially significant artefacts within a familiar, continually evolving environment.
Existing users can upgrade to version 4 for free. New users can explore RabbitHole with a free 30-day trial.
Find out more and sign up at RabbitHole.
Our experts are on hand to learn about your organisation and suggest the best approach to meet your needs. Contact an expert today.
Get in touch
