we are used to use XOR or Fileinsight for BUP-Files and are now confronted with the fact that using these tools don´t get us further anymore. The problem is there seems to be a change in how the File_0 file is saved in BUP-File. We do have some findigs today which we would like to clarifiy wether or not there are some false positivs but we can not at this moment due to the given fact we only get "Details" out of a bup file at the moment. This is odd because we did not have any problems in the past with xor or fileinsight in extracting bup.
McAfee Agent: 126.96.36.1990
Can anyone confirm?