X-Ways Forensics 13.3 Log Out | Topics | Search
Moderators | Edit Profile

X-Ways User Forum » Public Announcements » X-Ways Forensics 13.3 « Previous Next »

Author Message
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Sunday, Aug 27, 2006 - 18:35:   

A beta version of X-Ways Forensics 13.3 is now available. The download link can be retrieved by querying one's license status.

What's new?

* Support for GUID partition tables (GPT) as created by Intel Macs and (if specially selected) by Windows Vista. Requires a specialist or forensic license. Ability to automatically and manually find deleted partitions same as for conventional partition tables.

* Partitioned media such as hard disks now have a directory browser that lists the partitions. (Internally, a kind of volume snapshot is used for that.) Supersedes the Access button menu (the popup menu that appears when clicking the button with the big black arrow pointing down), which will soon be removed for physical media. Allows to easily access partition start sectors, optionally with templates, and all unpartitioned areas. Also allows to include all unpartitioned areas in a global Logical Search run from the case root. Reveals the partitioning type (MBR, GPT, dynamic, Apple, floppy/superfloppy) and the partitions' file systems. Allows to sort the partition listing by physical location, file system, and partition size.

* Ability to index all evidence objects with volume snapshots in a case in a single step.

* Ability to search the indexes of all evidence objects in a case at the same time if they are open and have been indexed, from within the case root.

* Support for distributed indexing, to accelerate index creation in time-critical cases. If n computers participate in indexing the same evidence object, each computer can index approx. 1/n of the total data (may vary depending on the size of very large files within the volume snapshot). If all resulting index files (.xfi files) are created or eventually collected in the same metadata folder, they are treated exactly like an index created by just one computer. To ensure that no part of the volume snapshot is indexed twice or accidentally left out, all participants need to agree on the same index settings and get unique numbers assigned. E.g. if 9 computers are involved, each of the numbers 1...9 needs to be specified for indexing exactly once.

* When archiving a case, index files can be optionally excluded.

* Enhanced compatibility of .e01 evidence files created by X-Ways Forensics.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Tuesday, Aug 29, 2006 - 16:56:   

Beta 2:

* Ability to extract information about hardware devices from Windows 2000/XP registry files ("SYSTEM") when creating the registry report.

* The registry report definition file Reg Report Keys.txt now supports multiple wildcards in registry paths.

* Minor fixes and improvements.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Wednesday, Sep 6, 2006 - 1:15:   

Beta 3:

* Reg Report Keys.txt now supports the specification of registry branches that are Windows version independent. E.g. application program settings no longer need to be specified twice, but only once, with ?? as the OS identifier instead of NT and/or 9x.

* Overlapping GREP search hits for the same GREP expression now prevented for physical searches, too.

* Several fixes that improve stability. It is highly recommended you do not use the previous beta versions any more.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Friday, Sep 8, 2006 - 0:35:   

Beta 4:

* Specialist | Gather Text is now considerably faster. Unicode text is converted to ASCII text.

* With identical settings, indexing is now somewhat faster than before.

* Analogously to the Logical Search command, indexing can now cover the encoded, compressed or otherwise garbled text in PDF, WordPerfect, RTF, HTML and other documents.

* Search hit preview improved for very long matches for GREP expressions.

* Various error corrections.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Monday, Sep 11, 2006 - 20:45:   

RC 1:

* A few bug fixes.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Wednesday, Sep 13, 2006 - 16:27:   

v13.3 was just released.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Thursday, Sep 21, 2006 - 21:09:   

SR-2:

* Some fixes and minor improvements.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Tuesday, Sep 26, 2006 - 13:34:   

SR-3:

* Changing font size error fixed that could occur in conjunction with Calendar mode under certain circumstances.

* Number of screenshot files in the case log previously incorrectly displayed, since v13.2. This was fixed.

* Ability to suppress the notice about how many files have been hidden.

* Fixed command "Hide duplicates in directory browser."
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Thursday, Oct 5, 2006 - 15:53:   

SR-4:

* Some fixes.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Sunday, Dec 17, 2006 - 18:03:   

SR-5:

* Some minor fixes.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Saturday, Sep 1, 2007 - 14:55:   

SR-6:

* Some of the fixes introduced in later versions. Final release.

Add Your Message Here
Post:
Username: Posting Information:
Only registered users may post messages here, i.e. you need to have a profile.
Password:
Options: Enable HTML code in message
Automatically activate URLs in message
Action:
Forum operated by X-Ways Software Technology AG.