X-Ways Forensics 20.0 Log Out | Topics | Search
Moderators | Edit Profile

X-Ways User Forum » Public Announcements » X-Ways Forensics 20.0 « Previous Next »

Author Message
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Monday, Feb 10, 2020 - 11:33:   

A preview version of X-Ways Forensics 20.0 is now available. The URL of the download directory for all recent versions can be retrieved by querying one's license status as always.

What's new in v20.0 Preview 1?

* APFS: Supports new Catalog ID structure as created by Mac OS Catalina.

* Technical Details Report/evidence object properties now show details of MacOS X Installations on HFS+ or APFS volumes: Exact OS X version, timezone, the system's network and display names.

* UFS support has been revised. Significantly more UFS variants are now understood.

* JPEG screenshot identification now based on generating device recognition.

* Improved classification of pictures based on pixel dimensions.

* X-Ways Forensics now knows an additional 5000 devices to better identify the origins of JPEG pictures.

* Simplified output of "Quality" in the summary table for JPEG files. It can assume one of the values High, Medium, Low and Very low. It is based on the lossy compression percentage of the DQT segment.

* Additional test in the check for camera originals based on whether the EXIF tags are sorted or not.

* Output of GPS coordinates with up to 6 digits after the decimal point. This is useful because of the habit of newer Samsung device models to specify more decimals and indirectly express the precision of the value by that, contrary to the convention to use the GPS Error tag for that information, unlike Apple and older Samsung models.

* If the GPS format encountered is "unexpected" based on the assumed source of the JPEG file, that is brought to the user's attention in Details mode. The GPS format will be shown as "unknown" if it is not used in camera original pictures (for example the format of the Geosetter application).

* Generally improved GPS format consistency tests.

* Various minor improvements.

* Fixes of v19.9 SR-4 all included.
Stefan Fleischmann (Admin)
Username: Admin

Registered: 1-2001
Posted on Thursday, Mar 19, 2020 - 21:38:   

Preview 2:

* Support for much more deeply nested subdirectories in XFS volumes.

* Fixed an error in the disk I/O X-Tension API.

* General option to open volumes including the slack that doesn't add to another cluster just like when opening an entire partition. The data in that area, aside from a potential NTFS backup boot sector, does not belong to that volume logically and was stored there before the volume was created. It is not needed to parse the file system or to mount the volume (though some tools may output an error message if it's not included). Including such data in a volume image can be an IT security leak if only the regularly accessible part of the volume had been sanitized before usage.

* Two additional status values for JPEG files. All JPEG files are now presented with such a status. The modification status "scaled" means that a picture was created with a content management system such as WordPress, TYPO3, Drupal. Such a picture can be considered publicized, with a reduced intelligence value. The modification status "undefined" means that the status cannot be determined. Practically such pictures cannot be regarded as documents.

* Revised and more thorough metadata extraction from HTML files. In particular, "Open Graph" metadata is now extracted.

* Video signature table updated.

* Reduced false positive rate when detecting scanned documents.

* Support for certain copy-protected PDF documents from X-Ways.

* Some general improvements.

* Fixes of v19.9 SR-5 included.

Add Your Message Here
Username: Posting Information:
Only registered users may post messages here, i.e. you need to have a profile.
Options: Enable HTML code in message
Automatically activate URLs in message
Forum operated by X-Ways Software Technology AG.