X-Ways Forensics 12.75 Log Out | Topics | Search
Moderators | Edit Profile

X-Ways Forum » Public Announcements » X-Ways Forensics 12.75 « Previous Next »

Author Message
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann (Admin)
Posted on Friday, Dec 30, 2005 - 16:34:   

A preview version of X-Ways Forensics 12.75 is now available for owners of a forensic license. The download link can be retrieved by querying one's license status.

What's new?

* Some processes previously hidden from the RAM editor are now listed.

* It is now possible to fill evidence file containers indirectly. That means, files are copied to the folder for temporary files first, and only then from there to the container. This enables resident virus scanners to check these files and prevent X-Ways Forensics from adding them to the container in case they are infected. An evidence file container filled that way can be reasonably moved to and examined in an environment with a higher sensitivity. (see Security Options)

* It is now possible to recursively explore the evidence object overview at the case root level, that is, list all files from all subdirectories from all evidence objets in a convenient flat view, based on the dynamic filter settings.

* Ability to selectively include certain columns of a report table to the case report. (see Case Properties)
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann (Admin)
Posted on Sunday, Jan 1, 2006 - 16:00:   

A happy new year to all users!

Preview 2:

* X-Ways Forensics can now internally re-assemble hardware RAID level 5 in addition to level 0. The supported striping/parity patterns are:
- backward parity (Adaptec)
- backward parity dynamic (AMI)
- backward parity delayed (Compaq/HP)
- forward parity
One of the RAID component disks is redundant and can be declared missing if not available.

Any confirmation that these patterns work as expected would be much appreciated!

* If a RAID system has been added to a case as an evidence object, it is now easier to replace an image file that is part of that RAID system if its name or location has changed.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann (Admin)
Posted on Monday, Jan 2, 2006 - 11:53:   

Preview 3:

* Some minor improvements and corrections.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann (Admin)
Posted on Tuesday, Jan 3, 2006 - 15:35:   

Preview 4:

* Some minor improvements and corrections.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann (Admin)
Posted on Thursday, Jan 5, 2006 - 15:58:   

Preview 5:

* Some minor improvements and corrections.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann (Admin)
Posted on Friday, Jan 6, 2006 - 15:39:   

v12.75 is out now.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann (Admin)
Posted on Tuesday, Jan 17, 2006 - 16:32:   

SR-1, SR-2:

Some minor improvements and error corrections.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann (Admin)
Posted on Thursday, Jan 19, 2006 - 18:59:   

SR-3:

* Error fixed that in certain situations caused X-Ways Forensics to overlook footers when using File Recovery by Type.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann (Admin)
Posted on Sunday, Jan 29, 2006 - 1:30:   

SR-4:

* Some minor fixes.

* Physical RAM now correctly detected if larger than 2 GB.

* Hash values, corresponding hash sets and categories from the volume snapshot are now optionally reassociated with report tables on loading, as was previously already the case for the tagging status and comments. All of these columns are not present in report tables intrinsically.
Top of pagePrevious messageNext messageBottom of page Link to this message

howard
Posted on Monday, Jan 30, 2006 - 18:32:   

Hi

In v12.6 SR-7:
* Ability to select an internally assembled RAID 0 as a source disk in the Disk Cloning dialog window.


In 12.75 SR3 I can't seem to obtain this function.

Is the ability to use the CTRL button when opening physical disks to allow a assembling a logical drive that spans 2 or more physical disks still functioning?

In the meantime please could you email me v12.6 SR7 as it would help me with my immediate problem.

Many thanks
H
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann (Admin)
Posted on Monday, Jan 30, 2006 - 18:39:   

> In 12.75 SR3 I can't seem to obtain this function.

I checked and confirm it is available in v12.75 SR-3.

> Is the ability to use the CTRL button when opening
> physical disks to allow a assembling a logical drive
> that spans 2 or more physical disks still functioning?

I'm not aware of such an ability. I know that holding the Ctrl key allows you to specifcy another storage location of raw image file segments when interpreting the first segment.
Top of pagePrevious messageNext messageBottom of page Link to this message

howard
Posted on Monday, Jan 30, 2006 - 20:52:   

Ah yes - you are right.

I think I got mixed up between a possible "wish list item" and reality concerning assembling/interpreting a spanned disk.

Thanks Stefan.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann (Admin)
Posted on Monday, Jan 30, 2006 - 23:13:   

SR-5:

* Ability to fuse hash sets when importing an entire folder re-enabled.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann (Admin)
Posted on Tuesday, Jan 31, 2006 - 16:05:   

SR-6:

* Failure to optionally include deleted files in user-created internal hash sets fixed.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann (Admin)
Posted on Sunday, Mar 5, 2006 - 13:58:   

SR-7:

* Some small fixes. Download URL available on request, to licensed users whose update maintenance expired after v12.75.
Forum operated by X-Ways Software Technology AG.