X-Ways Forensics 13.4 Log Out | Topics | Search
Moderators | Edit Profile

X-Ways Forum » Public Announcements » X-Ways Forensics 13.4 « Previous Next »

Author Message
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Wednesday, Sep 27, 2006 - 0:23:   

A preview version of X-Ways Forensics 13.4 is now available. The download link can be retrieved by querying one's license status.

What's new?

* Ability to assign one or several files to multiple report tables in a single step. Ability to create new report tables, rename and delete existing ones directly in the same dialog window.

* The filename of the case report is now freely selectable. When files in report tables are to be included in the report, they are now extracted from the evidence object (copied to a subdirectory) only when the report is created. That way it is easier to distinguish between multiple reports that consist of different report tables and to distinguish between their corresponding subdirectories and files, e.g. if different reports are created for different recipients, where each recipient should only be provided with the files he/she needs to see.

* Report tables in case reports can now be considerably condensed in that multiple items can now be output in the same line. E.g. you could select a small thumbnail size for pictures and save a lot paper or screen space by grouping 4 pictures per line in the report.

* Ability to filter out items that already belong to a report table ("NOT" operator) in order to concentrate on those that may still need to be associated with such a table.

* Ability to export items in the directory browser in exactly the same format and columns as displayed in the program. Unlike before, the names of matching hash sets and associated report tables are exported as are free text comments. Columns are selectable. The output text file can be either Unicode or ASCII. As the descriptive icons cannot be seen in the exported list, an additional optional column has been introduced that provides a textual description of exported items (indicating whether they are existing files or deleted directories etc.).

* Ability to wipe hard disk space with pseudo-random data that looks like highly encrypted data (quite fast). Ability to wipe with cryptographically secure pseudo-random numbers (very slow). The data transfer rate is now displayed in the progress indicator window.

* Because of its minor significance, the command to add individual files to the case by default is not available in the directory browser's context menu any more, only if you hold the Shift key when right-clicking.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Friday, Sep 29, 2006 - 14:19:   

Preview 2:

* A new version of the viewer component is available for download. Works with earlier versions of X-Ways Forensics as well. For details please see the change log at the bottom of this page.

* Supported number of RAID component disks increased from 5 to 10.

* Ability to execute WinHex/X-Ways Forensics in a path with true Unicode characters. Various directories such as the folder for image files and for temporary files may now contain true Unicode characters in the path (still testing). However, the viewer component does not accept such paths for temporary files.

* StrToInt script commands now supports integer values larger than 4 billion (32-bit unsigned).

* File signature and type definitions for MS Office 2007 and OpenOffice.org 2 added.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Thursday, Oct 5, 2006 - 2:26:   

Beta:

* Some fixes and minor improvements.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Thursday, Oct 5, 2006 - 15:40:   

Beta 2:

* New association with report tables can now either replace the previous association or be cumulative.

* Some fixes.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Friday, Oct 6, 2006 - 12:23:   

Beta 3:

* Earlier beta versions had a memory leak. This was fixed.

* Ability to cope with date formats set in the Windows Control Panel that do not end with either month, day or year, but with a closing special character such as another period. That character is omitted from the display in X-Ways Forensics, but the order of month, day, and year is adapted correctly.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Sunday, Oct 8, 2006 - 18:43:   

Beta 4:

* File type filter accelerated.

* When multiple examiners share the same image file, yet each work with their own case files because they examine different aspects of the same case simultaneously, or when providing non-IT examiners with evidence file containers and pre-compiled search indexes, or when using the distributed indexing feature to accelerate index creation, there is now the option to have a common metadata subdirectory with the search index, which saves drive space, accelerates access because of improved Windows file buffering, and facilitates handling of the search index files.

Such a shared metadata directory for search index file (.xfi files) is used for both index creation and index search, however only if it is specifically created by the user, i.e. if it exists when needed. It is expected as a subdirectory of the directory where the image file is located, with the same base name as the image file, without extension, and the suffix " Metadata". If you prefer to store the index files on a different drive for performance reason, simply create the metadata directory as an NTFS reparse point that redirects to a different drive, but this and whether this feature is used at all is at the user's discretion.

* The same generic metadata subdirectory is now used when creating an evidence file container, if individual comments about files are to be passed on with that container, which is a new option for newly created containers. The recipient of the container will see those comments if he/she is not only provided with the container, but also with the metadata subdirectory of that container. Useful to not only forward a collection of files to other investigators as before, but also customized information and preliminary findings. E.g. computer specialists could add the name of the owner of a file for non-IT examiners to see, or the reason why a file was selected for inclusion in the container.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Thursday, Oct 12, 2006 - 11:56:   

v13.4 was just released.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Tuesday, Oct 17, 2006 - 22:16:   

SR-1:

* When imaging media, a log about the operation is now created as a text file and automatically opened after completion so that it can be viewed and printed (forensic licenses only).

* The gallery did not work correctly for pictures in evidence file containers in a recursive view in the global case root window. This was fixed.

* Ability to copy/recover multiple selected files from the directory browser in a single step for non-forensic licenses, as already available in earlier versions.

* Some minor improvements.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Friday, Oct 20, 2006 - 0:19:   

SR-2:

* Distributed indexing: Duplicate .xfi filenames avoided.

* Error fixed that in v13.2 through v13.4 under certain circumstances caused the logical search not to turn up any search results at all.

* Error fixed that when deleting a report table may have caused X-Ways Forensics to lose unrelated report table associations.

* Error fixed that occurred when renaming hash sets in the internal database with v13.4 and v13.4 SR-1.

* Error in creation of new image log file of v13.4 SR-1 fixed. Warnings about bad sectors are now included in that log file.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Friday, Oct 20, 2006 - 21:55:   

SR-3:

* .xfi index files were lacking their extension in SR-2. That was fixed.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Thursday, Oct 26, 2006 - 2:11:   

SR-4:

* Some minor improvements, some exception errors prevented.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Thursday, Oct 26, 2006 - 15:47:   

SR-5:

* Some text strings in Windows registry files were previously truncated at null characters. This was improved.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Sunday, Dec 17, 2006 - 18:03:   

SR-6:

* Some minor fixes.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Saturday, Sep 1, 2007 - 14:55:   

SR-7:

* Some of the fixes introduced in later versions. Final release.

Add Your Message Here
Post:
Username: Posting Information:
Only registered users may post messages here, i.e. you need to have a profile.
Password:
Options: Enable HTML code in message
Automatically activate URLs in message
Action:
Forum operated by X-Ways Software Technology AG.