| Author |
Message |
Stefan Fleischmann
Username: admin
Registered: 1-2001
| | Posted on Tuesday, Jun 9, 2026 - 13:36: | |
A preview version of X-Ways Forensics 21.9 is now available. The latest download instructions including log-in credentials can be retrieved by querying one's license status, as always.
What's new in v21.9 Preview?
* The event type filter dialog now only lists event types that actually occur in the event list.
* The event type filter dialog now lists event types other than the internally defined ones if such events were added by an X-Tension.
* When saving directory browser settings to a .settings file, you now have more control over what is actually remembered and what will be restored when loading that file. For example you may prefer to have .settings files with just your preferred column order and widths that do not activate or deactivate any column-based filters and do not make you lose your current filter settings. Or .settings files with just your favorite conditional cell coloring that do not override column widths. Or all settings except conditional cell coloring etc. To create .settings files that are compatible with previous versions, you can simply choose to store ALL settings in them.
* Your favorite .settings files can now be loaded with a single mouse click. That is possible if you name them with a single-digit number or letter or any exotic single Unicode symbol, followed optionally by a space and more descriptive text, e.g. "1.settings" or "E Most essential columns only.settings" or "Ⓟ Default filters for pictures.settings" etc. That first character will be displayed in the caption line of the directory browser and will be clickable. If multiple .settings files exist whose naming matches the requirements, their respective first characters will be listed in ascending order of Unicode values.
* Several minor improvements.
* Same fix level as v21.8 SR-2. |
Stefan Fleischmann
Username: admin
Registered: 1-2001
| | Posted on Friday, Jun 19, 2026 - 16:40: | |
Preview 2:
* Ability to toggle between the usual high-low nibble order within one byte in the hex display and the low-high order, by clicking a new cell in the status bar, or using a checkbox in the top right corner of the general options. Though uncommon and awkward for human reading habits, showing the lower nibble first and the higher nibble second is a logical choice where multiple bytes belong to an integer value stored in little-endian byte order because that way all hex digits are arranged in ascending order of power. The difference that this setting makes is apparent in particular when looking at the 12-bit entries in a FAT12 file allocation table, whose nibbles usually appear intertwined, but in low-high order are straight-forward and consecutive.
* The data interpretation in the status bar now has its own big endian switch and does not use the big endian setting of the Data Interpreter. It shows "BE" if big endian interpretation is active. Other settings are still inherited from the Data Interpreter.
* The bits in binary representation in the Data Interpreter, in templates as well as in the status bar can now optionally be shown in ascending order, i.e. from the lowest-valued / least significant bit (LSB) to the highest-valued / most significant bit (MSB). This is not to be confused with and works in addition to the byte order, which defines which of multiple bytes is the highest valued one (depends on the Big Endian switch). If the LSB-to-MSB order is active, a triangle with its smaller end of the left and its bigger end on the right is displayed before the word "Binary:" to remind you.
* Checksums are by convention usually displayed in big-endian byte order. That means for example that a 2-byte file with the byte values 0x33 0x00 has a 16-bit checksum that is shown as 0033. That is understandable because checksums are true integer number with a meaning (the result of an addition of assumed integer numbers), and numbers are read and written by humans with the most significant digit first from left to right (even in Arabic and Hebrew). CRCs like CRC16, CRC32 and Adler32 are also often (but not always) byte-wise reversed for display purposes. However, this is already harder to justify because those hash values are more random in nature and do not have an actual meaning as numbers. Longer hashes are never byte-reversed. A new notation allows you to see checksums and CRCs in litte endian / original byte order, for compatibility with specific other tools if necessary or when comparing checksums and CRCs to how they are actually stored on disk / in files, e.g. in zip archives.
* Challenging the brain supposedly boosts neuroplasticity and maintains cognitive fitness during aging (https://www.health.harvard.edu/mind-and-mood/tips-to-leverage-neuroplasticity-to-maintain-cognitive-fitness-as-you-age). Therefore, if you occasionally switch up the endianness settings in X-Ways Forensics installations of your colleagues when they are not looking, they will likely thank you later.
* The binary representation in the Data Interpreter as well as in the status bar can now show 24 bits. For better readability, a space is now inserted after every 8 bits for 16, 24 and 32 bit representations.
* The Data Interpreter settings can now be saved to and loaded from .dlg files completely.
* New time zone definitions for British Columbia and Alberta (not in strictly ascending order in the list). Previous users of the Saskatchewan time zone need to change to the combined Central America, Saskatchewan time zone, please. Daylight saving time can now be defined in the GUI for an entire year safely (without potentially missing a few days in early January or late December) by entering 0 as the start month and 13 as the end of month. Up to 100 different time zone variants can now theoretically be defined (previously 76).
* Gives the user an extra hint if file system areas were not included in a skeleton image, before closing that image, and makes a note of the inclusion in the image log.
* Some minor improvements. |
Stefan Fleischmann
Username: admin
Registered: 1-2001
| | Posted on Thursday, Jul 2, 2026 - 14:52: | |
Preview 3:
* More visibility for volume labels: Previously only shown in the Technical Details Report and in the Info Pane, they are now included in evidence object titles/numbers when partitions are added to a case. That also means that they can become part of the path of files in evidence file containers.
* Improved dealing with incomplete cases, where you only have the .xfc file and no corresponding subdirectories.
* Tentative support for some more VDI image variants.
* Some minor improvements.
* Same fix level as v21.8 SR-4. |
Stefan Fleischmann
Username: admin
Registered: 1-2001
| | Posted on Wednesday, Jul 8, 2026 - 14:27: | |
Preview 4:
* Updated recognition of aspect ratios of pictures.
* A new value for "Media design" can now occur: Swipe. Swipe indicates that a picture was resized to match the screen width and enable vertical swiping on the screen.
* A fainter color for icons of previously existing files in dark mode now means darker icons instead of lighter.
* Special blue disk icon for MD-RAID container partitions (i.e. partitions that serve a similar function as a physical disk) and for images of physical partitioned disks that have been misinterpreted as images of a volume, to indicate that something is out of the ordinary.
* Some minor improvements. |
Stefan Fleischmann
Username: admin
Registered: 1-2001
| | Posted on Wednesday, Jul 15, 2026 - 13:30: | |
Preview 5:
* Ability to extract WhatsApp and Facebook Messenger messages from UFDR.
* Choose from four different light bulb colors to mark evidence objects as notable. The light bulbs can also simply help you find certain evidence objects in long lists of evidence objects, e.g. when exploring recursively from the case root or when importing relevant evidence objects from another case. And you can click a new button to quickly select all the evidence objects that have a light bulb (of any color).
* Optionally associate labels with light bulbs in four different colors. Those light bulbs appear in the Name cell of labeled files. Whether the icons are large or small depends on the height in pixels of the rows in the directory browser, which in turn depends on the DPI scaling in your Windows system (175% or more recommended for high-resolution screens) and on your chosen font size adjustment in the general options. The light bulbs can also simply help you locate certain labels in long lists of label names, e.g. in the label filter dialog window.
* Some more icons in the graphical user interface.
* Accelerated loading of high-resolution pictures in Preview mode with the internal graphics display library.
* Device definitions for smartphones were updated. As a consequence, device class detection and processing state detection of pictures were improved.
* Detection of front camera photos improved.
* Some minor improvements. |
Stefan Fleischmann
Username: admin
Registered: 1-2001
| | Posted on Wednesday, Jul 22, 2026 - 19:56: | |
Preview 6:
* Some minor improvements and fixes. |
|