X-Ways Forensics 20.1 Log Out | Topics | Search
Moderators | Edit Profile

X-Ways User Forum » Public Announcements » X-Ways Forensics 20.1 « Previous Next »

Author Message
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Sunday, Aug 30, 2020 - 20:36:   

A preview version of X-Ways Forensics 20.1 is now available. The URL of the download directory for all recent versions can be retrieved by querying one's license status as always.

What's new in v20.1 Preview 1?

* An alternative method to extract data from spreadsheets as text is now available in Options | Viewer Programs. This option is still somewhat experimental. The new method improves the fidelity of the extracted text in terms of cell order and arrangement, normalizes the formatting of date cells in the decoded text to the notation that is active in X-Ways Forensics for more reliable search results, and it reliably includes hidden cells. If you need to preserve characters that your active Windows code page does not support (e.g. Chinese characters on a typical computer in America or Western Europe) because you are going to search for them, you need to check one extra box ("Must support Unicode"), and with that option the new method will require usage of the Windows clipboard.

* Options | Viewer Programs dialog window rearranged.

* More efficient data I/O in usage of viewer component.

* Ability to interpret data as misaligned text in UTF-16 LE as well as misaligned UTF-16 BE in Disk/Partition/Volume and File mode. Misaligned means starting at odd offsets. That makes a difference in non Western European languages and renders text stored in that fashion actually readable.

* 1 additional text column available in Disk/Partition/Volume and File mode, in X-Ways Forensics only.

* The substitute character for non-printable ASCII characters of values below 0x20 in the text columns, selected in Options | General, typically a space or period, can now also be used for high Unicode character values. It's easier on the eye if characters in languages other than your own are not actually displayed, and you can probably afford to not see them if you are not looking for foreign language text (e.g. Chinese, Japanese, Korean) anyway. To see only pure 7-bit ASCII characters (sufficient for English), in ANSI ASCII and all UTF-16 variants, you can apply the substitute character to above 0x0080. To see letters at least from other Western European languages like Spanish, French, German you can apply it to > 0x00FF. To see Eastern European languages, apply it only to > 0x04FF.

* Fixed context preview of misaligned UTF-16 search hits in some rare situations.

* Some minor improvements.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Tuesday, Sep 1, 2020 - 21:44:   

Preview 1b:

* Fixed inability to remove no longer needed additional text columns.

* Minor improvements.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Sunday, Sep 6, 2020 - 20:16:   

Preview 2:

* Fixed a crash that could occur with the 64-bit executable of Preview 1 under certain circumstances when the viewer component was in use.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Tuesday, Sep 15, 2020 - 11:16:   

Preview 3:

* X-Ways Forensics and X-Ways Investigator only: Ability to apply a character adjustment list not only when indexing, but also as part of the Simultaneous Search. This list is expected in a UTF-16 text file now named "Character Adjustment.txt" (previously: "indexsub.txt"). It starts with a little-endian byte order mark and followed by one instruction per line, with an arrow (greater than symbol) in the middle, which maps one character to another. You can edit it as you see fit for searches in your own language.

An example for French language searches: The line
╔>E
means that the letter ╔ in the original data to which the Simultaneous Search is applied (when searching in suitable code pages) will be accepted as a variant of E in your search term. You only need to search for Edith Piaf and will find both Edith Piaf and ╔dith Piaf.

š>c
means that searching for Francois (which you may find preferable if your keyboard cannot easily produce the š character) you can find both Francois (simplified spelling) and Franšois (original French spelling). The other way around can also make sense:
c>š
means that searching for Franšois (which you may prefer if it looks more correct to you) you can find both Franšois and Francois.

Even if you are not interested in matching multiple spelling variants, you could define such substitutions once (e.g. using copy & paste) if you cannot easily produce special letters with your keyboard.

Case insensitivity does not work on top of the character adjustment. So for example with the adjustment Ú>e active, a case-insensitive search for e will find e and Ú as well as E, but not ╔. For that you need to add the adjustment ╔>E. Note that you could theoretically define your own case-insensitivity rules solely using character adjustments. Up to 16 mappings are possible for the same target character. Character adjustments also work in conjunction with GREP syntax (only with target characters that have no special GREP meaning and are not contained in [] sets).

* The cursor position and the defined block in Disk/Partition/Volume or File mode are now remembered in an evidence object when you close it, and automatically restored later.

* Timeouts for loading pictures for picture analysis and processing and for the XWF_GetRasterImage() API function and for the report are now twice as long as the timeouts for loading pictures in the gallery.

* Ability to specify a timeout in milliseconds for thumbnail generation of non-picture files in the report. Please note that timeouts for generation of such thumbnails cannot be strictly applied to all file types.

* Fixed an error in the alternative text decoding option.

* When presenting the logical memory address space of a running process, the Info Pane now shows the exact boundaries and size of the allocation range that the cursor position is located in. The boundary addresses can be copied into the clipboard so that you can quickly jump to these addresses.

* Several minor improvements.

* Same fix level as v20.0 SR-4.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Friday, Sep 18, 2020 - 16:13:   

* The alternative processing variant of "Convert binary storage of numbers/dates in spreadsheets to text" should now be usable with multiple threads.

* Some minor improvements.

Add Your Message Here
Post:
Username: Posting Information:
Only registered users may post messages here, i.e. you need to have a profile.
Password:
Options: Enable HTML code in message
Automatically activate URLs in message
Action:
Forum operated by X-Ways Software Technology AG.