X-Ways Forensics 20.7 Log Out | Topics | Search
Moderators | Edit Profile

X-Ways User Forum » Public Announcements » X-Ways Forensics 20.7 « Previous Next »

Author Message
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Sunday, Sep 18, 2022 - 17:22:   

A preview version of X-Ways Forensics 20.7 is now available. The URL of the download directory for all recent versions can be retrieved by querying one's license status as always.

What's new in v20.7 Preview 1?

* 5% more definitions of photo generating devices.

* Front camera recognition improved, especially for Samsung, also for Xiaomi and Apple smartphones.

* Improved grouping of small pictures without metadata when sorting by relevance.

* The Summary table for JPEG pictures has a new entry called "software class", which aggregates information previously spread across various other metadata details. The following values are possible: Adobe, Facebook/Instagram, Whatsapp, Twitter, Google/Picasa, Windows, Android, Firmware, Apple, Social media, Editor, General, Beautifier

* The old Bates numbering function now supports Unicode filenames.

* All fixes of v20.6 SR-3 included.

* Several minor improvements.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Tuesday, Sep 27, 2022 - 16:52:   

Preview 2:

* The option to display offsets in either hexadecimal or decimal has been moved to the Notation settings. As such, you can have for example hexadecimal offsets in the GUI when using the application, but decimal offsets for example when exporting data from the directory browser for external use.

* Hexadecimal numbers and code can now optionally be written with lower-case letters from a through f. This affects hexadecimal offsets, the hex column, hash value display and more, and this is another option in the Notation settings.

* Relevance computation revised. The number of bits per pixel in a JPEG picture now has an effect on the computed relevance so that rather monotonous and blurred pictures get a lower score.

* The average number of bits per pixel in an actual JPEG picture in Details mode is now accompanied by the known median value of bits per pixel for the same generator signature to put it into perspective.

* Several minor improvements.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Tuesday, Oct 11, 2022 - 19:12:   

Preview 3:

* Same fix level as v20.6 SR-4.

* Some minor improvements.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Thursday, Nov 3, 2022 - 16:12:   

Beta:

* Filtering for a particular event ID in the event description column without hitting on the same number elsewhere in the description is now easy because the event ID is now prepended with the letters "ID" and a space. (In newly refined volume snapshots only.)

* Chinese translation of the user interface updated.

* A new possible condition in the summary table for JPEG files is "cropped". Cropped means that the dimensions of the picture in pixels are not known to be one of the standard dimensions of the generating device. That also means that the picture is not even considered to be potentially "relatively original", and its relevance will be reduced compared to pictures that are considered "relatively original". The dimension will be displayed in blue in such a case.

* The internal graphics display library was updated for the formats PNG, WEBP und PCX.

* Some minor improvements.

* Same fix level as v20.6 SR-5.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Tuesday, Nov 15, 2022 - 20:05:   

v20.7 was just released. Additional changes:

* The functionality of Excire Forensics is now included in X-Ways Forensics 20.7. That means an artificial intelligence can "view" the pictures in your volume snapshots (when refining it from the main menu) and make you aware of identified content via labels, comments, or automatic categorizations as notable or irrelevant based on rules that you can set.

The complete hierarchy of identifiable content can be seen here: https://www.x-ways.net/Excire_Detected_Objects.txt. Download instructions for the Excire Forensics package can be retrieved by querying one's license status. It's simply in the resource directory. By default the additional files will be expected in a subdirectory \Excire in the installation directory, but you can change the path in Options | File Viewing so that multiple installations of X-Ways Forensics can share the same package.

* Report table associations are now called labels for reasons of simplicity and because v20.7 even more so than previous versions can generate a lot of such associations that will not usually become the basis of a report. If all the files with a particular label are output in a report in tabular form, the result of that, however, is still called a report table.

* Option to adjust American spelling to British spelling in most parts of the user interface when setting English as the active language. British spelling is also the default setting now in new installations of WinHex/X-Ways Forensics/X-Ways Investigator if the Windows installation language is UK English, Australian English or New Zealand English.

* An error in XFS processing has been corrected that prevented the reading of certain directory structures if the directory used an EA fork.

* Fixed an exception error that occurred when trying to preview extracted e-mail messages in extracted text mode.

* Several minor improvements.

* Program help and user manual updated for v20.7.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Monday, Nov 28, 2022 - 10:35:   

SR-1:

* Fixed an I/O error that could occur after using the gallery to display files in nested disk images.

* Fixed a memory corruption error that could occur on some machines in the 32-bit edition when trying analyze photos with artificial intelligence.

* Prevented a message box that had to be clicked away when trying to add inaccessible drive letters to the active case through the command line.

* Potentially prevented instabilities with the internal graphics display library.

* Fixed an infinite loop that could occur in v20.6 and the original v20.7 release when uncovering Windows resource data embedded within carved DLLs.

* Several minor improvements.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Thursday, Dec 1, 2022 - 7:21:   

SR-2:

* Fixed inability to run a picture content analysis in v20.7 SR-1.

* Improved treatment of NTFS reparse points.

* Fixed an exception error that could occur in v20.6 and v20.7 when imaging storage devices from the command line.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Friday, Dec 2, 2022 - 12:52:   

The passwords for downloads and protected web pages have changed and can be retrieved by querying one's license status as always (if your licenses have access to updates).
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Monday, Jan 9, 2023 - 3:21:   

SR-3:

* Ability to read uninitialized areas of files before the last defined portion as binary zeroes in Btrfs depending on the corresponding volume snapshot option.

* When reporting a data/parameter/parity inconsistency for newly reconstructed RAIDs, X-Ways Forensics now mentions the offset on the component disks where the problem was first detected. Note that X-Ways Forensics does not check the entire disks, just the first 16 strips (previously 10).

* X-Ways Forensics parsed directory entries in XFS incompletely when unaligned entries were encountered. That was fixed in v20.7 and will also be fixed in all future service releases of older versions.

* Some target paths in jumplists were improperly truncated in the event list. That output was fixed.

* Improved support for machines in the Google cloud as a platform.

* Fixed a memory leak that could occur during volume snapshot refinement, especially in v20.7.

* Fixed caching of compressed TAR archives processed with the alternative extraction method if they contained additional nested archives.

* Prevented multi-threading read errors in certain nested images.

* Several minor improvements.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Wednesday, Jan 25, 2023 - 3:56:   

SR-4:

* Better compatibility with the Aquatic high contrast dark theme of Windows 11.

* *.service_worker is now included in fresh installations in the file mask for the file header signature search portion of "Uncover embedded data in various file types" to target cache files.

* Support for certain streamed MP4 video files in the internal carving algorithm ~27 for the file header signature search.

* Fixed an error in the "Find Text" function in the Registry Viewer in v20.6 and v20.7.

* Fixed failure to decode Base64-encoded e-mail bodies that could occur depending on the characters in the search terms.

* Fixed an error in the "Filename analysis" for pictures sent via WhatsApp.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Monday, Feb 20, 2023 - 3:03:   

SR-5:

* Fixed an exception error that could occur in v20.7 SR-3 and SR-4 when trying to access storage devices.

* Fixed an exception error that could occur in v20.7 with the "OS dir list: Compute total amount of data" option.

* Fixed recycle bin file naming error in v20.7.

* Prevented data interpretation of some invalid ANIS SQL timestamps as nonsensical dates.

* Fixed a rare time zone problem with carved partial QuickTime video files.

* Some minor fixes and improvements.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Friday, Mar 10, 2023 - 12:54:   

SR-6:

* Fixed a rare instability that could occur when parsing corrupt inactive data of HFS+ file systems.

* Fixed sector number display in the progress indicator window of simple searches (searches that don't output to the search hit list).

* Avoided an error message that could occur under Windows XP and Vista when opening storage devices.

* Fixed an exception error that could occur with the alternative .eml presentation.

* Some minor fixes.

Also released as WinHex for owners of personal and professional licenses.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Thursday, Mar 23, 2023 - 19:11:   

SR-7:

* Fixed a rare instability that could occur when processing MSG files with forwarded other e-mail messages with very long subject lines.

* Better prepared for the transition to v20.8.

* Some minor improvements.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Wednesday, Apr 5, 2023 - 19:20:   

SR-8:

* The option "Always ignore start sectors of known files" of the file header signature search now treats previously existing files in FAT32 file systems as known even though their start cluster numbers are just guesswork, so that more duplicates are prevented.

* Fixed display of certain SIDs in the Data Interpreter when shown alongside of GUIDs.

* Highlights more recent FILETIME values in the hex and text display.

* Fixed inability to extract thumbnails in some old JPEG pictures with very small Exif segments.

* Reducing the case's auto-save interval now takes effect immediately instead of next time when the previous interval elapses.

* Some minor improvements and fixes.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Thursday, Apr 20, 2023 - 19:52:   

SR-9:

* Labels derived from hash set matches are now always of the special "hash set" type, not the generic "hint" type, no matter whether they are created immediately when matching hash values against the database or retroactively.

* The File Header Signature Search will not skip JPEG signatures within a known JPEG file any more assuming the function to uncover embededed data will pick up the inner file later, if the outer known JPEG file is a previously existing file. That can make a difference if the outer JPEG file is not intact any more and there is no logical connection between the inner and the outer file (thumbnail representation or alternative resolution), in which case the function to uncover embedded data would not find the inner file.

* More compact representation of PhotoDNA matches in Details mode.

* Ability to understand information about additionally found partitions as stored in .xfc case files by v20.8. Ability to gracefully deal with case files in which that kind of information is not understood.

* Some minor improvements.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Sunday, Jun 18, 2023 - 7:52:   

SR-10:

* Some of the fixes and minor improvements introduced in later versions. Highly recommended to users whose access to updates covered no more than v20.7. Available to these users on request usually, for a limited time.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Sunday, Nov 12, 2023 - 14:57:   

SR-11:

* Some of the fixes and minor improvements introduced in later versions. Highly recommended to users whose access to updates covered no more than v20.7. Available to these users on request usually, for a limited time.
Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Thursday, Jan 25, 2024 - 14:26:   

SR-12:

* Some of the fixes and minor improvements introduced in later versions. Highly recommended to users whose access to updates covered no more than v20.7. Available to these users on request usually, for a limited time.

Add Your Message Here
Post:
Username: Posting Information:
Only registered users may post messages here, i.e. you need to have a profile.
Password:
Options: Enable HTML code in message
Automatically activate URLs in message
Action:
Forum operated by X-Ways Software Technology AG.