Stefan Fleischmann (Admin)
|Posted on Saturday, Aug 28, 2004 - 2:37: |
A beta version of X-Ways Forensics 11.7 is now available for owners of a forensic license. The download link can be retrieved by querying your license status.
* File | Make Disk Backup can now create raw images, split them into segments of a user-defined size and calculate a hash while creating the image. (any kind of license)
* The same command can now also create compressed evidence files that include hashes and can later be interpreted like the original disks. (forensic license only)
* Restoring compressed WinHex backups (.whx) is now between 10 and 20% faster.
* The contents of ZIP and RAR archives can be examined right within the directory browser like the contents of a directory by applying the "View" command to such an archive. The gallery view works on files inside such archives, and any such file can be extracted, viewed or opened individually. Also files inside archives can optionally be included and examined in a drive contents table like normal uncompressed files. All of this only applies to archives that are not encrypted. (forensic license only)
* After loading Windows registry files into the registry viewer (applying the View command to such files in the directory browser), you may now use the automated report feature (in the context menu) to examine interesting sections of the registry and list them in a report. So far works on Windows NT/2000/XP registry files only.
* It is now possible to rename drive contents tables associated with an evidence objects and to import drive contents tables. (since v11.65 SR-2)
* GIF, JPEG, and PNG files that have been added to a case are now displayed in the HTML report directly. (since v11.65 SR-2)
* The last modification date and time of Windows NT/2000/XP registry keys are now displayed in the registry viewer. (since v11.65 SR-7).
* Several other minor improvements.
Please report errors by e-mail. Thank you.