WinHex/X-Ways Forensics 13.2 Log Out | Topics | Search
Moderators | Edit Profile

X-Ways User Forum » Public Announcements » WinHex/X-Ways Forensics 13.2 « Previous Next »

Author Message
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Sunday, Jul 23, 2006 - 22:03:   

A beta version of WinHex/X-Ways Forensics 13.2 is now available. The download link for X-Ways Forensics can be retrieved by querying one's license status. The download link for WinHex is on the main WinHex web page.

What's new?

* There are new (optional) quick filter buttons in the directory browser column headers that allow to activate and modify dynamic filter settings more instantly.

* Report tables have evolved from tab-delimited text files that are associated with just one evidence object to virtual, case-wide categories, by which you can dynamically filter or sort, even in the case root, not unlike comments. However, while comments are best for free text, report tables can now serve as convenient user-defined categories such "related to company x", "incriminating pictures", "unjustified expenses". Using report tables that way for filtering instead of keywords in comments can prevent errors due to typos. One file can be part of multiple report tables.

The report tables columns you can select for output to the case report are now the same as for the directory browser. Report tables created and filled by v12.9 and later can be imported by v13.2. Report table titles now use Unicode instead of ASCII. Filenames in report tables are now output to the case report in Unicode.

* Comments now use the Unicode instead of the ASCII character set throughout the user interface and the case report.

* Case titles, case filenames, case descriptions, examiner names, image filenames, evidence object titles, comments, command line parameters, and the case log now all work with Unicode.

* It is now possible to select evidence objects for recursive viewing in the case root.

* Cases last saved by v13.2 cannot be opened any more by earlier versions of X-Ways Forensics. v13.2 won't import certain items from cases saved by earlier versions: search hit lists from v12.9 and earlier; free space, slack space, and text that was captured in a separate file and associated with a case.

* The name of the evidence object that a directory browser item belongs to is now displayed in a separate column. This field is useful in a recursively explored case root and for reports that include the new case-level report tables.

* When associating a hard disk and its partitions with a case as evidence objects, the case tree now lists the partitions as child nodes of the disk. Volumes/partitions are now represented by a different icon in the case tree to better tell them apart from physical media. They no longer employ a separate icon for access to the root directory, but provide access directly. All of this allows to more conveniently handle larger cases that involve many hard disks with many partitions and to utilize screen space more economically.

* The particularly thorough file system data structure search on NTFS volumes with its new second step now usually turns up much more previously existing files than before, files that have been deleted, renamed, or moved. Known earlier names/locations of renamed/moved files will be displayed with new arrow icons. For many of the additionally discovered deleted files, however, only the metadata is available (filename, timestamps, ID, ...), not the file contents.

* Newly created volume snapshots for FAT volumes now identify directory entries that indicate that files have been renamed or moved. They are displayed with an arrow icon as well. Requires a specialist or forensic license.

* Support for multiple sessions on optical media formatted with UDF. The first and the last session will be listed automatically. Additional sessions in the middle can be found through a particular thorough file system structure search.

* Strict drive letter based write protection is now optional (yet still enabled by default) in X-Ways Forensics. See Options | Security.

* All text output in the messages window can now be optionally logged in a file messages.txt. See Options | Security. This file is created in the log subfolder of the case, if a case is active, or else in the installation directory.

* Newly created evidence file containers can now be optimized for better performance if a huge number of files is to be added. All three options related to containers are now presented whenever creating a new container, no longer in Options | Security.

* The Copy/Recover command now offers a convenient option to copy files including their slack or the slack separately. (forensic licenses only)

* X-Ways Forensics now allows to view Windows Event Log files (.evt).

* File Type Signatures.txt: More legitimate extensions per file type supported.

* During the creation of image files, X-Ways Forensics now displays the average data transfer rate in MB per minute and the average compression ratio for compressed evidence files.

* The case report is now more flexible. All components (basic report, report tables, log) are optional. Also you can now optionally omit times from the case log, e.g. if you do wish to pass on the log to someone else, but feel uncomfortable disclosing the pace you worked at.

* The program to view HTML reports (case reports, registry reports, event log conversions) can now be selected in Options | Viewer Programs. MS Word can be more useful than an Internet browser because e.g. it allows to further process the report and can display directly embedded TIF pictures. If no program is specified in that dialog window (like by default), HTML files will be viewed with the default program for that file type in your system.

* When the hash of an evidence object is verified or computed for the first time, the result is added to the technical description of the evidence object.

* The standard extension of template text files has been changed from .txt to .tpl. Like that, templates can be more easily told apart from other text files.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Monday, Jul 24, 2006 - 12:41:   

Beta 2:

* Some fixes.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Sunday, Aug 6, 2006 - 23:42:   

Beta 3:

* The indexing algorithm was revised. Certain worst case data now no longer causes the algorithm to almost freeze. The index file format has changed, so existing indexes created by earlier versions cannot be reused.

* The directory browser options now allow to lock columns on the left, i.e. prevent them from scrolling horizontally.

* Errors in previous beta versions fixed. Do not use them any longer.

Please remember to subscribe to the newsletter if you wish to be notified when the final version 13.2 is out. Thanks.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Wednesday, Aug 9, 2006 - 16:12:   

Beta 4:

* More efficient when dealing with millions of files on a volume.

* Ability to totally disable sorting, to save time when dealing with huge file lists, with a command in the directory browser context menu.

* Some fixes and minor improvements.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Thursday, Aug 10, 2006 - 21:42:   

Beta 5:

* Dialog windows now work again under Windows 2000.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Saturday, Aug 12, 2006 - 22:36:   

Beta 6:

* Lost partitions that were found through a thorough search are now remembered by X-Ways Forensics if the hard disk/hard disk image is associated with a case as an evidence object.

* Auto-save option for cases.

* Some minor fixes and improvements.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Tuesday, Aug 15, 2006 - 15:53:   

Beta 7:

* Indexing now creates much smaller indexes. The file format has changed again, so indexes created earlier cannot be reused.

* Some minor fixes and improvements.
Th. Wuethrich
Username: woodi

Registered: N/A
Posted on Wednesday, Aug 16, 2006 - 23:00:   

Besteht die Möglichkeit, in naher Zukunft die Announcements auch in Deutsch zu veröffentlichen?
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Wednesday, Aug 16, 2006 - 23:06:   

Bedaure, ich glaube das lohnt sich nicht. Es lesen zu wenige deutschsprachige Nutzer hier mit. Im Newsletter bekommen Sie ja am Ende gesammelt alles auf Deutsch.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Monday, Aug 21, 2006 - 1:25:   

v13.2 of WinHex and X-Ways Forensics was released on August 16, 2006.

Known error: In indexing, the option "Exceptions" does not work reliably any more. Will probably be fixed shortly with SR-3.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Tuesday, Aug 22, 2006 - 17:11:   

SR-3:

* An error in indexing was fixed that caused the "Exception" option not to work reliably in earlier releases of v13.2.

* File masks for decoding text in logical searches are now applied to the true file types in addition to the filenames, if signatures have been verified by refining the volume snapshot. It is recommended to apply this text decoding option to RTF and HTML documents depending on the characters used in your search terms, as in these kinds of documents non-7-bit ASCII characters like e.g. German umlauts are typically encoded.

* Some minor fixes and improvements.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Thursday, Aug 24, 2006 - 0:05:   

SR-5:

* Configuration file now user-specific by default, i.e. multiple users sharing the same installation folder (e.g. on a server) will have individual winhex*.cfg files. Details here.

* Archive Case command fixed.

* Incomplete directory tree error after hash computation fixed.

* When reviewing index search hits in Preview mode, you can now use F3 to search for additional hits in the same file in the Preview area.

* Notable search hits are now marked with a flag instead of a paperclip icon, to avoid confusion, as that icon is already used on the button that brings up the Position Manager and bookmarks.

* "Scroll away" bug fixed that could occur when clicking a thumbnail in the gallery under certain circumstances.

* Minor fixes and improvements.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Thursday, Aug 24, 2006 - 14:58:   

SR-6:

* Recover/Copy bug of SR-5 fixed.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Tuesday, Aug 29, 2006 - 16:54:   

SR-7:

* Enhanced compatibility of .e01 evidence files created by X-Ways Forensics.

* Minor fixes and improvements.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Wednesday, Aug 30, 2006 - 23:30:   

SR-8:

* Error fixed that could occur in file path of new individual .cfg files.

* Graphical anomalies under Windows 2000 fixed.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Sunday, Sep 3, 2006 - 11:46:   

SR-9:

* FAT timestamps no longer translated to local time in calendar view.

* Exception fixed that occurred when exiting after running WinHex in certain languages.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Wednesday, Sep 6, 2006 - 1:16:   

SR-10:

* Overlapping GREP search hits for the same GREP expression now prevented for physical searches, too.

* Exception prevented that could occur under certain circumstances when about to image a hard disk.

* Some minor fixes.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Wednesday, Sep 6, 2006 - 22:57:   

SR-11:

* Graphical errors fixed that occurred under certain circumstances when browsing search hit lists.

* Fixed an error that could occur when including the contents of archives in the volume snapshot.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Saturday, Oct 14, 2006 - 1:27:   

SR-12:

* Some minor fixes and improvements.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Saturday, Sep 1, 2007 - 14:55:   

SR-13:

* Some of the fixes introduced in later versions. Final release.

Add Your Message Here
Post:
Username: Posting Information:
Only registered users may post messages here, i.e. you need to have a profile.
Password:
Options: Enable HTML code in message
Automatically activate URLs in message
Action:
Forum operated by X-Ways Software Technology AG.