X-Ways Forensics 13.7 Log Out | Topics | Search
Moderators | Edit Profile

X-Ways Forum » Public Announcements » X-Ways Forensics 13.7 « Previous Next »

Author Message
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Friday, Dec 29, 2006 - 0:35:   

A preview version of X-Ways Forensics 13.7 is now available. The download link can be retrieved by querying one's license status. How to install: Copy all files into a directory of your choice and run X-Ways Forensics from there.

What's new?

* On Chinese Windows systems, X-Ways Forensics can now be run with a Chinese user interface. The translation is not 100% complete and an ongoing effort.

* The gallery is now considerably faster. Loading large pictures for preview or full window view is faster, too.

* The check for skin colors and black-and-white pictures is now faster and more stable when dealing with corrupt pictures. The computed skin color percentages may differ slightly when compared to earlier versions of X-Ways Forensics.

* Ability to export search hit offsets and search hits from search hit lists. Ability to export the hits with context previews of an arbitrary length. This works for search hits in both ASCII and Unicode, for both ASCII and Unicode output text files (unless of course search hits are in non-trivial Unicode and the chosen output format is ASCII).

* All improvements and fixes of v13.6 SR-6.

* Several minor improvements.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Friday, Dec 29, 2006 - 19:53:   

Preview 2:

* An additional sortable column for search hit lists was introduced that describes for each search hit whether it is an ASCII or Unicode search hit, whether references the decoded version of a file, and whether the search hit is in a file's slack (only for search hits gathered with v13.7 and later). The latter allows to systematically copy the file slack off an image with the Recover/Copy command for all search hits that are not in the logical part of a file.

* Ability to save index search hits permanently, without marking them as notable, under a dedicated keyword item in the keyword list.

* Better compatibility with unusual sector sizes on fixed media.

* Files on NTFS volumes for which no file contents are known (only metadata available) are now opened/copied with a size of 0 bytes instead of not opened/copied at all.

* The "1st cluster" column was replaced with a "1st sector" column. This allows X-Ways Forensics 1) to make better targeted jumps to resident files on NTFS volumes, 2) to display this information for fictitious files in special file system areas, and 3) to more successfully prevent duplicate files found by header signature (e.g. if run repeatedly) if they start at mere sector, not cluster boundaries. Also this allows the user to tell more easily which files are affected by bad sectors (after converting number ranges of bad sectors on physical disks to logical sector numbers on the partition). The improved precision for files that do not start at cluster boundaries is available only for newly taken volume snapshots.

* Ability to manually shorten the path that can be optionally output as a header when printing documents, by holding the Shift key when sending the print job. Useful as the viewer component truncates very long path always at the end, which may not be desirable.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Saturday, Dec 30, 2006 - 3:05:   

Preview 3:

* "File Recovery by Name" is no longer available. The more flexible substitute is to recover files selectively from the directory browser, with the Recover/Copy command. To achieve the same effect as with "File Recovery by Name", explore the root directory recursively, optionally activate a filter like the filename filter, and then select all. Unlike "File Recovery by Name", this works with all supported file systems, recovers directories, and all filters are available, not just a filename filter. The ability to explore directories or an entire volume recursively is available for the first time now to owners of personal and professional licenses.

* The selection statistics and the logical search progress indicator now take into account that files do not necessarily have any data attached to them (where metadata is known only) and thus are opened with a size of 0 bytes.

* There is now a progress indicator for the Recover/Copy command.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Sunday, Dec 31, 2006 - 13:39:   

Preview 4:

* Ability to search for non Latin-1/Western European language (e.g. Cyrillic, Greek, Chinese, ...) 8-bit characters in an explicitly specifiable code page, in addition to 16-bit Unicode, with the physical & logical simultaneous search.

* Progress indicator for filling evidence file containers with selected files.

* Some fixes.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Thursday, Jan 4, 2007 - 16:53:   

Beta 1:

* When copying files off an evidence object and the output path is too long, the omitted files are now added to a dedicated report table so that they can easily be addressed separately later, e.g. copied again without path.

* Separate icon for deleted e-mail messages with attachments. (also to be included in v13.6 SR-7)

* Windows installation dates as recorded in the registry of Windows 95/98/Me are no longer incorrectly converted when creating the registry report. (also to be fixed with v13.6 SR-7)

* Search hit context export increased to 240 bytes at most (120 left, 120 right).
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Saturday, Jan 6, 2007 - 18:18:   

Beta 2:

* An error was fixed that under certain circumstances (many report table associations) caused an exception when saving the case. Also to be fixed with v13.6 SR-7.

* Some v13.7-related fixes.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Tuesday, Jan 9, 2007 - 1:06:   

Beta 3:

* Deals more gracefully with garbage .gz files found through signature search.

* Index search terms are now logged.

* It is now possible to start indexing for all evidence objects from the case root window. The optional optimization step is now executed only after all evidence objects have been indexed.

* Reduced the amount of output to the messages window.

* In certain scenarios with repartitioned or reformatted NTFS volumes, previously existing files could cause an infinite loop during indexing. This was fixed. (Also to be fixed with v13.6 SR-7.)
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Wednesday, Jan 10, 2007 - 17:44:   

Beta 4:

* Run-length encoded bitmaps can be displayed correctly again.

* Fixed temporarily existing dongle detection problem.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Friday, Jan 12, 2007 - 20:47:   

v13.7 was released today.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Tuesday, Jan 16, 2007 - 11:57:   

SR-1:

* Ability to automatically power down the computer after successfully creating a disk image.

* Possibly error prevented that could occur in v13.7 when refining the volume snapshot with skin tone detection and check for embedded pictures enabled.

Please note that if you have problems with processing pictures or the display of pictures, it might help to return to the picture viewing capability of earlier versions by checking Options | Viewer Programs | [x] Use alternative picture display library.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Thursday, Jan 18, 2007 - 20:10:   

SR-2:

* Stability and speed of picture processing and display further improved.

* Error in ExecuteScript script command fixed.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Monday, Jan 22, 2007 - 13:28:   

SR-3:

* Fixed an exception error that could occur during a NTFS thorough file system data structure search.

* Fixed an exception error that could occur when reviewing search hit lists.

* Characters in the text column are now usually correctly displayed in double-byte code pages such as Simplified Chinese (if active) even when a block or a bookmark is defined in a line.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Tuesday, Jan 23, 2007 - 23:31:   

SR-4:

* Fixed another exception error that could occur during an NTFS thorough file system data structure search, when dealing with certain corrupt FILE records.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Thursday, Jan 25, 2007 - 22:50:   

SR-5:

* Instability issue in the new JPEG loading functions fixed.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Monday, Jan 29, 2007 - 21:59:   

SR-6:

* Minor fixes and improvements.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Wednesday, Feb 7, 2007 - 14:11:   

SR-7:

* Minor fixes and improvements, including the Recover/Copy command.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Monday, Feb 12, 2007 - 16:47:   

SR-8:

* Fixed instability issue with extremely long filename extensions (more than 127 characters) in text decoding option.

* "Internal search term list inconsistent" error fixed.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Saturday, Sep 1, 2007 - 14:55:   

SR-9:

* Some of the fixes introduced in later versions. Final release.

Add Your Message Here
Post:
Username: Posting Information:
Only registered users may post messages here, i.e. you need to have a profile.
Password:
Options: Enable HTML code in message
Automatically activate URLs in message
Action:
Forum operated by X-Ways Software Technology AG.