X-Ways Forensics 13.0 Log Out | Topics | Search
Moderators | Edit Profile

X-Ways User Forum » Public Announcements » X-Ways Forensics 13.0 « Previous Next »

Author Message
Stefan Fleischmann (Admin)
Posted on Friday, Jun 2, 2006 - 0:34:   

X-Ways Forensics 13.0 will be the major update of this year. It incorporates the numerous advances tentatively introduced with v12.95 Preview, and then some. A beta version is now available for owners of a forensic license. The download link can be retrieved by querying one's license status.

What's new?

* A totally new concept for reviewing search hits has been introduced. It supersedes the two main output methods known from logical searches before and combines the best of both worlds:

From the former "List search hits" output option it inherits the ability to see search hit offsets and a context preview, the ability to see more context in the Sectors or File mode by simply clicking the hit, and to specially flag important search hits.

From the former "Table of files with hits" output option it inherits the ability to see all properties of the files that contain the hits (i.e. all columns known from the directory browser), the ability to use a filter in conjunction with the search results, e.g. to view hits in all .doc and .xls files with certain timestamps only, and the ability to copy, view, tag or comment on files.

* The new search hit review concept allows to list search hits based on any position and level in the directory tree, e.g. all search hits in files in \Documents and Settings and subdirectories of the same, and even search hits from all evidence objects of the entire case at the same time, using the case root window!

* Also it's possible to conveniently select one or several search terms for search hit viewing, in the search term list in the Case Data window. Like that it's also an easy task to find out how many search hits there are for any given search term for any hierarchy level in the case tree.

* The new search hit lists are "dynamic" in that they are composed "on the fly" depending on selected search terms, current filter settings etc. and in that they can be non-destructively "thinned out" with the directory browser's context menu such that each file with at least one hit is listed no more than once. This allows to use the search hit list conveniently to copy files to one's own hard disk or to an evidence file container without duplicates.

* Search hits can be marked as notable with the directory browser context menu or by pressing the Space key. With the Space key you may also remove such a mark. The keyword list allows to create a quick overview of all hits marked as notable.

* There is now a true Unicode context preview for search hits.

* Old-styled search hits list can still be displayed by this version (will be phased out sooner or later with future versions), but cannot be produced any more.

* Ability to tag files in a recursively explored case root.

* Several other minor improvements.
Ross@Winpro.net
Posted on Saturday, Jun 3, 2006 - 21:39:   

> * Also it's possible to conveniently select one or several search terms for search hit viewing, in the search term list in the Case Data window.

Sorry, I cannot figure this one out.

In the Case Data window (at the bottom, when Search Hits is enabled), I see:

[Notable hits]
[Index search hits]
-----------

Enter


by selecting [Notable hits] or [Index search hits] and clicking the 'Enter' button, I can see the expected items in the Directory Browser area.

What/where is the the "search term list in the Case Data window"?


And how do I use it to ....

> to conveniently select ... several search terms for search hit viewing

...?


Will this allow to sort in the DB by file to find files that contain the multiple terms?

Sorry if I missed the explanation elsewhere,

Thank you,

Ross@Winpro.net
Stefan Fleischmann (Admin)
Posted on Sunday, Jun 4, 2006 - 2:06:   

The search term list in the Case Data window appears when you click the button with the binoculars and the 4 horizontal lines. It contains one special item in brackets that allows to list hits marked as notable and another special item in brackets that allows to run an index search. Aside from those, the search term list is filled with all search terms ever used in that case for any kind of conventional search (not index searches). Once you have run a search, you will see the search terms there and can conveniently select (click) them for search hit viewing.
Ross@WinPro.net
Posted on Tuesday, Jun 6, 2006 - 19:39:   

13.0 beta 2

in Directory Browser filters and column ... settings

click on "Accessed" to set date range and the entries in the filter box do not appear correct? (e.g. Links, Owner, Attrib.)

Thank you,

Ross@WinPro.net
Stefan Fleischmann (Admin)
Posted on Tuesday, Jun 6, 2006 - 20:48:   

Beta 3:

* Some labels in the user interface fixed.

* Some errors related to the new search hit lists fixed.

* Exception error fixed that could occur during indexing.

* Known problem: Index search hit lists are sometimes incomplete.
Stefan Fleischmann (Admin)
Posted on Wednesday, Jun 7, 2006 - 20:01:   

Beta 4:

* Known index search error fixed.

* Some minor changes.
Stefan Fleischmann (Admin)
Posted on Saturday, Jun 10, 2006 - 0:45:   

Beta 6:

* Some small fixes and improvements. E.g. the directory browser view (current directory, recursion status, sort criteria, selected item) is now restored after refining the volume snapshot and after returning from a search hit list to the standard directory browser.
U. Jaenicke-Rößler
Posted on Monday, Jun 12, 2006 - 11:18:   

Hi,

as v13.0 will enhance the search capabilities, I wonder if it will contain the epsilon tolerance for searching floats (http://www.x-ways.net/winhex/forum/messages/5/1305.html?)

Thanks
Stefan Fleischmann (Admin)
Posted on Monday, Jun 12, 2006 - 11:31:   

No, it won't, but rest assured your suggestion is still on the list of more than 400 items that we consider implementing some time.
Stefan Fleischmann (Admin)
Posted on Tuesday, Jun 13, 2006 - 0:01:   

RC (Release Candidate) 3 now downloadable.

* Ability to disable the secondary sort criterion, by holding the Shift key when clicking on the column header to determine the primary sort criterion. Internally, this selects the internal ID as the secondary sort criterion. This is to ensure that the order of items with identical data for the primary sort criterion is still well defined and reproducible after having sorted by other sort criteria in the meantime.

* Some fixes and minor improvements.
Stefan Fleischmann (Admin)
Posted on Wednesday, Jun 14, 2006 - 18:32:   

v13.0 has been released today.
Richard Andrews
Posted on Thursday, Jun 15, 2006 - 13:48:   

Thanks Stefan, however I have copied the user.txt file to 'program files - winhex folder and I have copied the user details into help, register and it stll comes up as version 12.9 Help please I'm probably doing something wrong.
Ross@WinPro.net
Posted on Thursday, Jun 15, 2006 - 17:24:   

Is there a way to remove search terms from the search term list in the Case Data window?

(e.g. misspelled terms, terms with zero hits, terms with all hits now deleted or wanting/needing to start over all searches completely)

Thank you,

Ross@WinPro.net
Stefan Fleischmann (Admin)
Posted on Thursday, Jun 15, 2006 - 18:43:   

From the program help and user manual: "select the search terms in the search term list and press the Del key"
Stefan Fleischmann (Admin)
Posted on Thursday, Jun 15, 2006 - 21:11:   

SR-1:

* Search hits for evidence objects that don't have a volume snapshot because of their type are now output to the general Position Manager and no longer lost.

* Attempt to prevent a certain exception error.
Stefan Fleischmann (Admin)
Posted on Monday, Jun 26, 2006 - 22:20:   

SR-2:

* Display error fixed that occured when just 1 item was listed in the directory browser.

* Some minor fixes and improvements.
Stefan Fleischmann (Admin)
Posted on Tuesday, Jun 27, 2006 - 20:04:   

SR-3:

* Attempt to prevent fake error message "read error from floppy disk -1".

* Mode buttons freezing error in global case root fixed.

* Fixed an error that prevented reading certain HFS volumes.
Stefan Fleischmann (Admin)
Posted on Friday, Jun 30, 2006 - 0:53:   

SR-4:

* More fixes for HFS file system support. Still some deleted directories seem to be listed as existing.
Stefan Fleischmann (Admin)
Posted on Sunday, Jul 2, 2006 - 22:56:   

SR-5:

* One more fix for HFS file system support.

* Prevents an exeception error in a recursively explored case root under certain circumstances.
Stefan Fleischmann (Admin)
Posted on Wednesday, Jul 5, 2006 - 2:19:   

SR-6:

* Internal ASCII to Unicode conversion improved.

* Error prevented that could occur when searching for thumbnails in certain JPEG files.
Stefan Fleischmann (Admin)
Posted on Thursday, Jul 6, 2006 - 1:04:   

SR-7:

* Fix that prevents an exception error in CDFS support.
Stefan Fleischmann (Admin)
Posted on Friday, Jul 7, 2006 - 0:07:   

SR-8:

* Integration of GREP syntax search in new search concept fixed.

* Overlapping GREP search hits for the same GREP expression prevented.
Stefan Fleischmann (Admin)
Posted on Wednesday, Jul 12, 2006 - 1:53:   

SR-9:

* Fixes an error that previously could lead to crashes when checking for file format specifical encryption. Also requires to download and install the latest revision of the viewer component (completely or just this file).

* Prevents switching to edit mode in File mode, which is not supported.

* Some minor improvements.
Stefan Fleischmann (Admin)
Posted on Thursday, Jul 13, 2006 - 20:26:   

SR-10:

* Fixes exception errors.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Sunday, Jul 23, 2006 - 20:37:   

SR-11:

* Some small fixes and improvements.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Wednesday, Jul 26, 2006 - 13:30:   

SR-12:

* Template editing previously had no effect in in-place mode. This was fixed.

* Erroneous identification of files on NTFS as encrypted (in very specific situations) fixed.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Sunday, Aug 6, 2006 - 20:29:   

SR-13:

* File system compression and encryption attributes of directories previously missing in result of Export List command. Fixed.

* Various minor improvements.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Tuesday, Aug 29, 2006 - 22:13:   

SR-14:

* Some minor fixes.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Saturday, Oct 14, 2006 - 1:27:   

SR-15:

* Some minor fixes and improvements.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Sunday, Dec 17, 2006 - 18:03:   

SR-16:

* Some minor fixes.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Tuesday, Mar 20, 2007 - 21:48:   

SR-17:

* Some of the fixes introduced in later versions. Available to licensed users on request.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Saturday, Sep 1, 2007 - 14:55:   

SR-18:

* Some of the fixes introduced in later versions. Available to licensed users on request.

Add Your Message Here
Post:
Username: Posting Information:
Only registered users may post messages here, i.e. you need to have a profile.
Password:
Options: Enable HTML code in message
Automatically activate URLs in message
Action:
Forum operated by X-Ways Software Technology AG.