X-Ways Forensics 12.8 Log Out | Topics | Search
Moderators | Edit Profile

X-Ways Forum » Public Announcements » X-Ways Forensics 12.8 « Previous Next »

Author Message
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann (Admin)
Posted on Thursday, Jan 19, 2006 - 18:19:   

An early debug preview version of X-Ways Forensics 12.8 is now available for owners of a forensic license. The download link can be retrieved by querying one's license status.

What's new?

* Support for the HFS file system.

* WinHex can now often display the context of search hits for which no physical offset is known (e.g. because the hit is in an NTFS-compressed file).

* The internal ID that files and directories have in the internal volume snapshot can now be seen in an optional column in the directory browser. Sorting by that internal ID can help you easily identifying those files that have been added last to a volume snapshot when you use Specialist | Refine Volume Snapshot.

* While it is not possible to remove files or directories from an evidence file container, you can now belatedly suppress items (e.g. if they were added accidentally). This is how: Open the container and interpret it like a regular image file, hide the items, and then deactivate them with the Specialist | Evidence File Container menu. Unlike hiding, this is a permanent change in the container. Again, this operation does not physically remove items from a container.

* The volume slack (an area on a partition that was formerly called logical surplus sectors in WinHex) is now easily viewable and searchable in newly created volume snapshots as another fictitious file in the root directory.

* On NTFS volumes, the MFT's bitmap is now easily viewable in newly created volume snapshots as another system file stream in the root directory. In that bitmap you can see which FILE records are marked as in use and which ones are unused.

* Improvements in UFS file system support.

* Support for NTFS volumes with extreme $MFT fragmentation improved.

* The mouse wheel now generally scrolls in the window that the mouse cursor currently hovers over, not the window that is active (i.e. has the input focus). The mouse wheel now also works in templates.

* Statistics on total number of items and number of tagged and hidden items in a volume snapshot, available in the Refine Volume Snapshot dialog window. Ability to hide all tagged files on a volume with a single command in the directory browser context menu, in addition to "Hide all untagged items".

* Fictitious items are now counted as files or directories in the directory browser header line.

* Free space and slack space are now highlighted in two different colors.

* Several other minor improvements.

* The Create Drive Contents Table command has been removed from the menu, but before it will be fully removed, it is still available via the Shift+F10 keyboard shortcut. The Create Drive Contents Table command has been superseded by the volume snapshot concept in conjunction with dynamic filters.
Top of pagePrevious messageNext messageBottom of page Link to this message

Jimmy Weg (Jw)
Posted on Friday, Jan 20, 2006 - 17:44:   

Thanks, Stefan, the evolution is certainly impressive. I can't get the preview at the moment. I'll admit to falling behind in studying the snapshot vs. DCT concepts. Now, I leap to the DCT frequently to use a mask to quickly pull up certain files. Perhaps I should wait until I can open the link for .8, but in looking at 12.75 now, could I produce a browser window that reveals all *.jpg;*.avi, etc., without using the DCT. Thanks.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann (Admin)
Posted on Friday, Jan 20, 2006 - 19:43:   

> Perhaps I should wait until I can open the link for .8

No, has nothing to do with the new version.

> could I produce a browser window that reveals all
> *.jpg;*.avi, etc.

Since the introduction of volume snapshots and dynamic filters in v12.6 in September 2005, in a fraction of a second, much faster than creating a drive contents table, yes. Simply right-click the root directory in the directory tree and apply the filter "*.jpg;*.avi" in the directory browser options.
Top of pagePrevious messageNext messageBottom of page Link to this message

Jimmy Weg (Jw)
Posted on Friday, Jan 20, 2006 - 21:34:   

Yes, it's much faster! Right click brings up all files and then right-click the field for the filter box. I think I'll be able to wean myself from the DCT, albeit slowly (hence your kindly allowing the Shift-F10 for a while). A couple things I thought of while trying this, is perhaps a user selectable option to bring up the DB options immediately on right-clicking a folder in the tree. Secondly, perhaps a button to toggle the filter, instead of having to reopen the options and select/deselect the last chosen filter. It's still pretty quick as it is. Thanks for your patience.
Top of pagePrevious messageNext messageBottom of page Link to this message

Ross@WinPro.net
Posted on Sunday, Jan 22, 2006 - 0:39:   

Found while testing "12.8 debug":

Using two image sets (of partitions) that work AOK in 12.75 ....

created a case and added the two image sets (each interpreted as HD), no other efforts yet (e.g. no Refined Volume Snapshot yet) ...

The Case Data windows displays the correct root folders but none with the '+' that 12.75 has

Also there is one addtional folder in the Case Data window for each partition; '.'

'Path unknown' folder is also added to the partitions immediately (in 12.75, P2 does not have the folder).

In the Case Data window, clicking any folder (except Path unknown) results in an empty DB. The same effort in 12.75 displays the folder contents.

clicking 'Path unknown' displays all the files and folders for the partition.

Right clickng displays all the files and makes the appropriate 'recursive' icon for the folder in Case Data.

Summary: in 12.8, for two imaged partitions added to a case without further refining, the 'Path unknown' folder contains all the content below the root level. The remaining root level folders are empty. Whereas 12.75 accesses the same images correctly.

Thank you,

Ross@WinPro.net
Top of pagePrevious messageNext messageBottom of page Link to this message

Ross@WinPro.net
Posted on Sunday, Jan 22, 2006 - 1:43:   

PS to the above:

both partitions are NTFS

The same thing happens even without a case. In other words, just open the image and interpret as an HD, there is a '.' and 'Path unknown' folder in the DB, along with all the other folders at the root level. 'Exploring' reveals any folder as empty (excep 'Path unknown').

I will test further on another system and image set.

--------------------

Thank you for adding the mouse hover/scroll-wheel action, it works very well.

Perhaps when over the Case Data window it could scroll left/right when there is only a left/right scroll bar (i.e. no up/down scroll bar)?.

---------------------

Sorry, but I need clarification of the obvious: the 12.8 'HFS' support is new? In addition to the already exisiting 'HFS+"?

--------------------

Another clarification re:
>WinHex can now often display the context of search hits for which no physical offset is known (e.g. because the hit is in an NTFS-compressed file).

Will this just be from NTFS-compressed existing files? And perhaps NTFS-compressed deleted files and others (e.g. orphaned) as they are added via the Refined Volume Snapshot? Not compressed free space?

Recap; basicaly, only from (found by any method)intact NTFS-Compressed files?

-----------------------------

Thank you for:

> * Free space and slack space are now highlighted in two different colors.

(Wish for a fictitious 'Slack Space' item as a viewable and searchable in a newly created volume snapshots.)

--------------------------

timeout for congrats:

Thank you for the continuing fantastic advancements in WinHex.

In an already powerful but comapact software package you have added features that formerly required many purchases from other vendors.

Plus, no other venodor is even close to your fast reponse time; which is often a software alteration (Service Release) in minutes (not the industry typical "next year's suite, maybe").

You could triple your price and I would still save money.

Thank you again for the years of great software,

Ross@WinPro.net
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann (Admin)
Posted on Sunday, Jan 29, 2006 - 1:49:   

> the 12.8 'HFS' support is new?

Yes, it is.

> Will this just be from NTFS-compressed existing files?

No. I was referring to files on NTFS volumes that X-Ways Forensics knows are compressed at the file system level, whether they are still active in the file system or not.

> Not compressed free space?

If free space contains compressed data otherwise, X-Ways Forensics does not care about it.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann (Admin)
Posted on Sunday, Jan 29, 2006 - 1:57:   

12.8 Beta

* Failure of original preview version to correctly read Windows NT 4.0 and Windows 2000 NTFS volumes fixed.

* Some more errors from original preview version fixed.

* Handling of incomplete .e01 evidence files improved.

* Fixes and improvements added with v12.7 SR-4.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann (Admin)
Posted on Tuesday, Jan 31, 2006 - 16:04:   

12.8 Beta 2:

* Improvements in HFS support.

* When hiding duplicate files based on identical hash values, a comment is now left with both duplicate items so you can later easily locate the respective other item if necessary, e.g. when you later find out that these items are relevant and need to know the name, path or timestamps of the hidden duplicate.

* When searching logically in a recursive view in the case root window, it is now possible to output search hit lists.

* Less deleted garbage files in "Path unknown" on Ext3 volumes.

* In the directory browser you can now press the Backspace key to move to the parent directory.

* When searching logically and outputtig the results as a table of files with hits, the progress indicator window now keeps you updated on the total number of files added to that table.

* Fixes and improvements added with v12.7 SR-6.
Top of pagePrevious messageNext messageBottom of page Link to this message

Ross@WinPro.net
Posted on Tuesday, Jan 31, 2006 - 21:06:   

12.8 beta 2

source= open logical HFS+ on physical HD

Recovery by type (from any space)

byte level

An exception error occurred atoffset 00517E37 ...

--------------------------------------------

(sector level & cluster level AOK)

Thank you,

Ross@WinPro.net
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann (Admin)
Posted on Wednesday, Feb 1, 2006 - 22:16:   

Beta 3:

* Improvements and fixes in HFS support.

* Exception during File Recovery by Type at byte level fixed. (see above)

* MFT auto coloring feature available (see General Options). Automatically highlights the elements of NTFS FILE records. (specialist and forensic licenses only)

* When refining the volume snapshot, there is now the ability to search for files by header signature in used drive space in addition to free space.

* Files found with the aforementioned method are included in the volume snapshot only if no other file in the snapshot already starts at the same cluster or if they are not aligned at cluster boundaries. That means that volume snapshots newly created by v12.8 Beta 3 and later will list less duplicates.

* Ability to carve out files with the Ext2/Ext3 block logic that exceed the size of available main memory.

* Ability to export file lists from the directory browser to a tab-delimited text file even for volumes that are not associated as evidence objects or when not working with a case, as a substitute for the Create Drive/Directory Contents Table command.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann (Admin)
Posted on Thursday, Feb 2, 2006 - 2:49:   

> Refined Volume Snapshots. Any atttempt finishes almost instantly

Will be fixed with Beta 4. I found out that this happens when the directly preceding operation (any kind of operation) was aborted (progress indicator closed or Esc pressed).
Top of pagePrevious messageNext messageBottom of page Link to this message

Ross@WinPro.net
Posted on Thursday, Feb 2, 2006 - 19:19:   

12.8 beta 3

Very minor issue to report (but could have repercussions elsewhere? So, here it is):

In some tools WinHex may be using an object's sector total as the value of the last sector (rather than one less, as when sector counts start with zero).

Try this to confirm:
Sync and compare two identical objects, place the cursor at offset zero in both windows, then use the black right arrow to find the next difference. The search completes OK (no differences found) but the 'Messages' box contains a message that states:

Cannot read from [file.001], Sector xxxx does not exist.

The sector number listed in the message is one sector higher than the last sector of both objects (i.e. it is the total number of sectors, and these objects are identical in content and size.)

This post is an FYI just in case.

If this becomes a confirmed WinHex issue, it may explain some other recent very minor (and not reported) end of object errors, (such as a searches [that include the end of an object] finishing with an error message regarding being unable to read one sector beyond the last, etc...)

Thank you,

Ross@WinPro.net
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann (Admin)
Posted on Friday, Feb 3, 2006 - 1:00:   

Beta 4:

* Unless already in a recursive view and directories are output, the selection statistics now works recursively. That means, when you select a directory in the directory browser, all items in that directory and all its subdirectories are counted, plus the total size of all these items is displayed.

* Knowing the total recursive size of the selection, X-Ways Forensics now displays the overall progress in the progress indicator window when searching logically.


--

> Sector xxxx does not exist

Some functions may try to read past the end of a disk. This is not intended, and will be corrected when examined, thanks for the pointer. It is reported in the 12.8 beta version and was not reported in other versions. It is not the result of X-Ways Forensics not knowing its own sector numbering.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann (Admin)
Posted on Saturday, Feb 4, 2006 - 2:05:   

Beta 5:

* The selection statistics now distinguish between files and directories, and they respect filters. More horizontal space for the selection statistics if the Details Panel is displayed on the right-hand side.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann (Admin)
Posted on Sunday, Feb 5, 2006 - 21:36:   

Beta 6:

* Fixed an error that prevented the use of "Synchronize & Compare" with interpreted evidence files.

* Time zone concept.

The following applies to WinHex and X-Ways Forensics when operated with a specialist or forensic license.

v12.8 Beta 6 and later no longer employ Windows' logic for converting UTC to local filetimes. They display timestamps independently of the time zone selected in the examiner's system's Control Panel. When working with a case, the time zone selected for that case applies globally to the entire program (selectable in the Case Properties dialog or the General Options dialog), otherwise the one selected in the General Options dialog. When working with a case, optionally it is possible to specify different time zones per evidence object, so that you can always see local filetimes even for media that were used in different time zones, if preferable. Note that the timestamps are converted for display only. That means, sorting is based on absolute UTC timestamps, which in some cases can yield surprising results in a recursive view in the case root that covers multiple media set to different time zones. Optionally, the actually used conversion bias can be displayed in the directory browser columns as well (see directory browser options).

Timestamps on FAT volumes are never converted as they are not available in UTC, but in one or several unknown local time zones.

For reasons of convenience, report tables and export lists are output in local time, depending on the time zone active in X-Ways Forensics, and they are internally converted back to UTC when being imported/read. They remember based on which time zone they were output, so importing them yields correct timestamps even if you had changed the time zone for that evidence object or the entire case in the meantime. Report tables created by earlier versions of X-Ways Forensics, on the other hand, are imported assuming they were created in the time zone selected in the examiner's system's Control Panel, which is consistent behavior.

The time zone definitions can be adjusted, if necessary. Please note that changing these definitions in any dialog window affects the definition of time zones throughout the program.

The standard Windows conversion technique, which depends on the time zone selected in the user's system's Control Panel, is still employed...
• in File | Properties, where the timestamps of files on the user's own system can be accessed/changed,
• for its case logging feature,
• generally when operated without a specialist or forensic license, and
• when operated without the file “timezone.dat”.

You can tell that either of the latter two is true if the "Display time zone" button in the General Options dialog is grayed out or not visible.
Top of pagePrevious messageNext messageBottom of page Link to this message

Ross@WinPro.net
Posted on Monday, Feb 6, 2006 - 8:55:   

12.8 beta 6

> * In the directory browser you can now press the Backspace key to move to the parent directory.

I love this new feature, thank you, sometimes the simple things are best.

-------------

However, using backspace on a folder at the root level causes an exception error.

I know, I know ... who would try and use the backspace at the root level to go the parent folder? Don't ask, just sending an FYI.

----------------------

BTW, I also love the new scroll wheel function ...

> * The mouse wheel now generally scrolls in the window that the mouse cursor currently hovers over, not the window that is active (i.e. has the input focus)

However, if the mouse should happen to be over an entry on a column that is not wide enough, then the yellow text box pops up (expanding the hidden text). When this happens the mouse wheel stops scrolling until the mouse is moved to a new location that does not expand. Would it be possible to allow the wheel to continue scrolling after a yellow text box has popped up under the mouse pointer?

Thank you,

Ross@WinPro.net
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann (Admin)
Posted on Monday, Feb 6, 2006 - 19:27:   

Beta 7:

* Backspace exception error fixed.

* Error in timezone conversion fixed.
Top of pagePrevious messageNext messageBottom of page Link to this message

Ross@WinPro.net
Posted on Tuesday, Feb 7, 2006 - 3:49:   

12.8 beta 7 (also earlier, I forgot to let you know).

Gallery View enabled, a picture selected ...

the Page-up & Page-down opens the Save As dialogue box instead of doing a page up or down (like I think they used to?)

Thank you,

Ross@WinPro.net
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann (Admin)
Posted on Tuesday, Feb 7, 2006 - 18:32:   

Fixed now with Beta 8, thanks.
Top of pagePrevious messageNext messageBottom of page Link to this message

Jimmy Weg (Jw)
Posted on Thursday, Feb 9, 2006 - 0:52:   

>* MFT auto coloring feature available (see General
>Options). Automatically highlights the elements of NTFS
>FILE records.

Just a note to say how much I enjoy this feature, which I first used today. It saved what would have been, for me, a lot of time in finding the file creation date/time in the Filename attribute. Thanks!
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann (Admin)
Posted on Thursday, Feb 9, 2006 - 1:00:   

Glad to hear that. Please note that you may prefer to look up the file creation date and time in the 0x10 $STANDARD_INFORMATION attribute, which is the principal source of time stamp metadata. The timestamps in the 0x30 $FILE_NAME attribute may be outdated. They are updated only when the filename is changed.
Top of pagePrevious messageNext messageBottom of page Link to this message

Jimmy Weg (Jw)
Posted on Thursday, Feb 9, 2006 - 1:33:   

Thanks, Stefan, I realize that. We had an issue concerning when a file was actually created on a volume. The file came from a camera and carried over the creation date from the camera's flash card. That creation date was very inaccurate, based on the camera's date setting. As the creation date in the 0x30 attribute is rarely updated (I think by name changes and perhaps a couple of other things), it can provide a good indication of when the file was actually first created on the volume. The 0x10 creation date naturally matched the incorrect date that was carried over from the flash card.

The 0x30 creation date/time also matched the 0x10 last modified date/time, which was evidently updated when the file was copied from the flash card to the drive folder. We later noted that, when copying data from the flash card through the Windows Removable Disk/Copy Pictures dialog box, creation dates were not updated as they were when copied in Explorer.
Top of pagePrevious messageNext messageBottom of page Link to this message

david gelkin
Posted on Thursday, Feb 9, 2006 - 1:54:   

Hi,

I've been testing xwforensics 12.8 Beta 8 on an NTFS file system (ms windows 2000) the deletion of a file and looking at the timestamp registered for the deletion with the Calendar view.

My time zone is +0200 and the timestamp of the files are listed incorrectly in the calender table, the tool tip is off by +0200. The directory view is reporting the correct times how ever.

--
David Gelkin
http://www.dataprey.com
Tekniikantie 21
02150 Espoo Finland
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann (Admin)
Posted on Thursday, Feb 9, 2006 - 12:53:   

Thank you very much for testing. The calendar view will be fixed and comply with the new time zone concept in the final version 12.8.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann (Admin)
Posted on Thursday, Feb 9, 2006 - 19:03:   

WinHex 12.8 and X-Ways Forensics 12.8 were just released.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann (Admin)
Posted on Friday, Feb 10, 2006 - 22:55:   

SR-1:

* Clarified that timestamp filters now have to be specified in UTC.

SR-2:

* Support for HFS+ volumes with heavy catalog file fragmentation improved.

* Inability to close case file fixed when case was protected from modification with password and opened as read-only.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann (Admin)
Posted on Saturday, Feb 11, 2006 - 14:08:   

> Would it be possible to allow the wheel to continue
> scrolling after a yellow text box has popped up under
> the mouse pointer?

Should be possible meanwhile.
Top of pagePrevious messageNext messageBottom of page Link to this message

Ross@WinPro.net
Posted on Sunday, Feb 12, 2006 - 6:45:   

WinHex 12.8 SR-2

Host W2K

source = HFS+ (image)

Using the Specialist menu ...

'Gather Slack Space' does not seem to be available for HFS+. It is available when viewing the host NTFS system.

I have checked the help file and have not been able to find a switch or explanation that fits, sorry (e.g. the files are not encrypted or compressed).


PS & FYI, this option works AOK for the source in question:
• Files can optionally be opened and searched via the directory browser including their slack (available for FAT, NTFS, Ext2/Ext3, ReiserFS, Reiser4, and HFS+).

Another PS, 'Gather Free Space' also is not available.

Any help appreciated,

Thank you,

Ross@WinPro.net
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann (Admin)
Posted on Sunday, Feb 12, 2006 - 12:03:   

Yes, not available because not implemented for HFS+. As a substitute for "Gather Free Space" you can copy the fictitious "Free space" file, of course.
Top of pagePrevious messageNext messageBottom of page Link to this message

Ross@WinPro.net
Posted on Sunday, Feb 12, 2006 - 16:44:   

> Yes, not available because not implemented for HFS+.

Sorry, I did not see that anywhere. I am very grateful that you offer this forum and the quick response, thank you.

Will 'Gather Slack Space' eventually be implemented?

If not (or a long wait), I will need to start writing a script to do so, (I think I can see the possibilities for in the script commands for this task).

Thank you,

Ross@WinPro.net


PS
> As a substitute for "Gather Free Space" you can copy the fictitious "Free space" file, of course.

FTROY
Then split the copied "Free Space" file with 'File Tools -> Split', to fully simulate "Gather Free Space", of course.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann (Admin)
Posted on Thursday, Feb 16, 2006 - 18:30:   

SR-3:

* Some minor improvements and fixes.


> Will 'Gather Slack Space' eventually be implemented?

I think so, but not planned for any time soon.
Top of pagePrevious messageNext messageBottom of page Link to this message

Ross@WinPro.net
Posted on Saturday, Feb 18, 2006 - 18:28:   

FYI

As of

Feb 18th 2006, 17:22:24 CET

Using the Online Upgrade method (email) "To query your license status"

X-Ways Forensics 12.8 SR-2 (not SR-3) still downloading from your site.

(BTW WinHex 12.8 SR-3 is downloading)

Thank you,

Ross@WinPro.net
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann (Admin)
Posted on Saturday, Feb 18, 2006 - 18:35:   

Thanks, fixed.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann (Admin)
Posted on Monday, Feb 20, 2006 - 19:03:   

SR-4:

* "Block only" option in File Recovery by Type fixed.

* Some minor improvements and fixes.
Top of pagePrevious messageNext messageBottom of page Link to this message

Ross@WinPro.net
Posted on Tuesday, Feb 21, 2006 - 18:36:   

USB Port & free space

12.8 SR-4 (maybe others)

HOST = W2k or W98

Source = any USB port attached drive (IDE HD or memory card, with various FATs. [Have not yet tested NTFS]).

1. Open a USB logical drive,

2. Click on the 'Free Space' object in the Directory Browser to see the beginning content in the Hex View window (take note of the content).

3. Now 'open' the 'Free Space' object,

The 'open' window's displayed data is not from the same LBA location (I do not yet see a complete pattern for determining this source location, but it has always been an LBA from the same drive but not the same LBA displayed in Hex View in number "2." above).

If the small amount of displayed content in both locations happens to be zero, then all appears to be AOK, but display more or ...

If in doubt, edit, in Hex View #2 above, the first few bytes of free space with a known pattern and save, then perform the above test.

I am not sure but I beleive the 'Open' window is not 100% accurate 'Free Space'? It could be both? This needs confirming. Any serious work recently done using the 'Open' 'Free Space' object (via USB) may be in question, though the difference may be minimal?. (Take note for forensic work).

Can anyone confirm the above? If yes, how many versions back does this go?

Thank you,

Ross@WinPro.net
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann (Admin)
Posted on Tuesday, Feb 21, 2006 - 19:40:   

SR-5:

* In all releases of v12.8 up to SR-4, the fictitious Free Space file on FAT volumes did not have the correct contents, i.e. it covered clusters that were not actually free and missed clusters that were free. This was fixed now. Other file systems and versions prior to v12.8 are not affected.
Top of pagePrevious messageNext messageBottom of page Link to this message

Ross@WinPro.net
Posted on Thursday, Feb 23, 2006 - 0:54:   

SR-5

possible issue, needs to be verified.

HOST = w2k
source= 74gb image set of an NTFS with about 64GB free


Open the 'Free Space' object (64GB),

do a "Find Text" (also happens with generating MD-5)

Error #2 happens quickly Cannot read"[e:\image.001], partition 2"

this happens on every try (even after reboot)

try the same search on the open partition with the cursor positioned at the first byte of 'Free Space' and everything proceeds AOK (i.e. no error).

Have not yet taken time to test on other systems or images, but though I would pass along the FYI.

Could be the size of the Free Space object?

Thank you for now,

Ross@WinPro.net
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann (Admin)
Posted on Friday, Feb 24, 2006 - 17:30:   

I cannot confirm such an error, regardless of the size.

SR-6:

* Right-clicking a file in the directory browser now updates the Preview area.

* .tif pictures now included directly in the case report, not as a link, as they can be displayed by Firefox.

* Unicode substitute character changed from "?" to "×".

* When adding files to containers with the indirect method, the name of the externally output file is now checked better for compliance with Windows filename restrictions.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann (Admin)
Posted on Friday, Mar 3, 2006 - 14:45:   

SR-8:

* An error was fixed that on some partitions prevented the fictitious "Free space" file from being read.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann (Admin)
Posted on Monday, Mar 6, 2006 - 19:54:   

SR-9:

* An error was fixed that in some situations prevented the prompt for an output filename when exporting a file list from a recursively explored Case Root window.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann (Admin)
Posted on Thursday, Mar 30, 2006 - 21:57:   

SR-10:

* Some small fixes and improvements. Download URL available on request to licensed users.
Forum operated by X-Ways Software Technology AG.