X-Ways Forensics 13.9 Log Out | Topics | Search
Moderators | Edit Profile

X-Ways User Forum » Public Announcements » X-Ways Forensics 13.9 « Previous Next »

Author Message
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Thursday, Feb 22, 2007 - 22:36:   

A beta version of X-Ways Forensics 13.9 is now available (Beta 2). The download link can be retrieved by querying one's license status.

What's new?

* Forensic licenses only: Ability to open remote network drives at a logical level, if a drive letter has been assigned locally. The directory browser, File mode, Preview mode, Gallery mode, and Calendar mode are all available. A volume snapshot can be taken and refined (not with the options that require sector access), filters can be used, keyword searches can be run. On the other hand, sectors, free space, slack space, deleted files, alternate data streams, owner SIDs etc. cannot be displayed. Very useful to preview remote network drives on site and e.g. search/copy relevant documents if no physical access to certain computers on a network is available. Another benefit is that NTFS-encrypted files (EFS) to which the currently logged-on user has access can be opened and processed as if they were not encrypted.

* Forensic licenses only: Ability to open local drive letters without administrator rights. The same limitations apply.

* Support for the Ext4 file system (specialist and forensic licenses only).

* X-Ways Forensics now warns when opening a case if that case has already been opened by someone else (if not in read-only mode).

* When decoding the text in PDF, HTML, RTF, StarOffice, WordPerfect, etc. files for logical searches and indexing, the result is now optionally buffered (can be disabled in Options | Viewer Programs). As the decoding is relatively slow, the benefits of the buffer are that further searches will run noticebably faster if there are many such files and that there can now be context previews even for search hits in the decoded version of files! This renders examining search hit lists much more convenient. Decoded text output is now either ASCII or Unicode on a per-file basis, depending on the nature of the characters in the text.

* The Print command in the directory browser context menu is now more flexible in that it allows to print files with the help of the viewer component either with or without its own cover page. As a new third option it is now possible now have X-Ways Forensics print the filename and path itself, on the first page. This option is not bound by the same path length limitations as the header printed by the viewer component. To avoid that the path is printed twice on the first page, have either X-Ways Forensics or the viewer component print it, not both.

* It's easier now to identify the evidence object in the Case Data window that is represented by the active data window, as all the other evidence objects, including their directory trees, are displayed in gray.

* Changes among physical disks (e.g. newly attached external USB hard disks) are now detected without having to restart the program.

* File containers now optionally have an internal designation (the XWFS volume label). Useful as another means to identify to which case/suspect a container belongs since the filename might be too generic (used similarly in different cases) or could be accidentally changed.

* A new switch "+19" in investigator.ini allows to keep users of X-Ways Investigator from opening images/containers that are not located in the default path for images/containers. Useful if the default path is externally controlled and users must not inadvertently add images from unrelated cases.

* Several other minor improvements.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Sunday, Mar 4, 2007 - 12:24:   

Beta 3:

* Ability to optionally filter directories based on names in addition to files.

* Minor improvements.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Friday, Mar 9, 2007 - 13:52:   

Beta 4:

* Changes of v13.8 SR-5 and other minor improvements.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Thursday, Mar 15, 2007 - 5:16:   

Beta 5:

* Some fixes.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Tuesday, Mar 20, 2007 - 5:58:   

Beta 6:

* If in the new Print command the printer resolution cannot be automatically detected, the user now has the option to specify it manually to get a correct print result.

* "-19" option in investigator.ini now has the desired effect.

* Each evidence object now remembers the last 16 files that were viewed in Preview mode. Press Shift+Ctrl+F7 to see the list of internal IDs. Useful e.g. if you forgot where to stopped your work the other day or based on what sort criteria you viewed the files (to recreate the same order). Preliminary implementation, not documented in program help or user manual, subject to change.

* Some other minor improvements.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Friday, Mar 23, 2007 - 0:32:   

v13.9 was just released.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Friday, Mar 30, 2007 - 1:55:   

SR-1:

* Ability to automatically detect deleted partitions with 1 MB partition gaps as typically created by Windows Vista.

* The filename extensions .whs and .whx are no longer automatically associated with X-Ways Forensics in the system registry.

* Improvements for running WinHex/X-Ways Forensics under Windows Vista:

Resolved problems:
- Text column visual character alignment problems with various characters fixed.
- Icons in registry viewer fixed.

Slight improvements:
- Encryted parts of BitLocker volumes are now represented by a virtual file that has the encryption attribute.

Unresolved or unresolvable problems:
- Writing sectors on certain disk areas fails with "access denied". To be resolved for most cases with v14.0.
- Prevented opening physical RAM on Vista as it does not work any more.
- Colored path feature in Case Data window not available.

The recommended platform for WinHex/X-Ways Forensics continues to be Windows XP. Under Windows Vista, please remember to install WinHlp32.exe for the program help.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Thursday, Apr 5, 2007 - 17:21:   

SR-2:

* The filename extension .xfc is now automatically associated with X-Ways Forensics in the system registry only if X-Ways Forensics was installed with the setup program. This is so that avoidable changes to the registry are not made when executing X-Ways Forensics on a live system without having installed it. (Note that the viewer component still writes to the registry if loaded by X-Ways Forensics.)

* Exception error prevented that could occur under certain circumstances after deleting search hits.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Sunday, Apr 15, 2007 - 12:00:   

SR-3:

* Fixed an error that could prevent running a simultaneous search for search terms with an opening parenthesis.

* Minor improvements.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Saturday, Sep 1, 2007 - 14:55:   

SR-4:

* Some of the fixes introduced in later versions. Final release.

Add Your Message Here
Post:
Username: Posting Information:
Only registered users may post messages here, i.e. you need to have a profile.
Password:
Options: Enable HTML code in message
Automatically activate URLs in message
Action:
Forum operated by X-Ways Software Technology AG.