| Author |
Message |
Stefan Fleischmann
Username: admin
Registered: 1-2001
| | Posted on Tuesday, Jun 9, 2026 - 13:36: | |
A preview version of X-Ways Forensics 21.9 is now available. The latest download instructions including log-in credentials can be retrieved by querying one's license status, as always.
What's new in v21.9 Preview?
* The event type filter dialog now only lists event types that actually occur in the event list.
* The event type filter dialog now lists event types other than the internally defined ones if such events were added by an X-Tension.
* When saving directory browser settings to a .settings file, you now have more control over what is actually remembered and what will be restored when loading that file. For example you may prefer to have .settings files with just your preferred column order and widths that do not activate or deactivate any column-based filters and do not make you lose your current filter settings. Or .settings files with just your favorite conditional cell coloring that do not override column widths. Or all settings except conditional cell coloring etc. To create .settings files that are compatible with previous versions, you can simply choose to store ALL settings in them.
* Your favorite .settings files can now be loaded with a single mouse click. That is possible if you name them with a single-digit number or letter or any exotic single Unicode symbol, followed optionally by a space and more descriptive text, e.g. "1.settings" or "E Most essential columns only.settings" or "Ⓟ Default filters for pictures.settings" etc. That first character will be displayed in the caption line of the directory browser and will be clickable. If multiple .settings files exist whose naming matches the requirements, their respective first characters will be listed in ascending order of Unicode values.
* Several minor improvements.
* Same fix level as v21.8 SR-2. |
Stefan Fleischmann
Username: admin
Registered: 1-2001
| | Posted on Friday, Jun 19, 2026 - 16:40: | |
Preview 2:
* Ability to toggle between the usual high-low nibble order within one byte in the hex display and the low-high order, by clicking a new cell in the status bar, or using a checkbox in the top right corner of the general options. Though uncommon and awkward for human reading habits, showing the lower nibble first and the higher nibble second is a logical choice where multiple bytes belong to an integer value stored in little-endian byte order because that way all hex digits are arranged in ascending order of power. The difference that this setting makes is apparent in particular when looking at the 12-bit entries in a FAT12 file allocation table, whose nibbles usually appear intertwined, but in low-high order are straight-forward and consecutive.
* The data interpretation in the status bar now has its own big endian switch and does not use the big endian setting of the Data Interpreter. It shows "BE" if big endian interpretation is active. Other settings are still inherited from the Data Interpreter.
* The bits in binary representation in the Data Interpreter, in templates as well as in the status bar can now optionally be shown in ascending order, i.e. from the lowest-valued / least significant bit (LSB) to the highest-valued / most significant bit (MSB). This is not to be confused with and works in addition to the byte order, which defines which of multiple bytes is the highest valued one (depends on the Big Endian switch). If the LSB-to-MSB order is active, a triangle with its smaller end of the left and its bigger end on the right is displayed before the word "Binary:" to remind you.
* Checksums are by convention usually displayed in big-endian byte order. That means for example that a 2-byte file with the byte values 0x33 0x00 has a 16-bit checksum that is shown as 0033. That is understandable because checksums are true integer number with a meaning (the result of an addition of assumed integer numbers), and numbers are read and written by humans with the most significant digit first from left to right (even in Arabic and Hebrew). CRCs like CRC16, CRC32 and Adler32 are also often (but not always) byte-wise reversed for display purposes. However, this is already harder to justify because those hash values are more random in nature and do not have an actual meaning as numbers. Longer hashes are never byte-reversed. A new notation allows you to see checksums and CRCs in litte endian / original byte order, for compatibility with specific other tools if necessary or when comparing checksums and CRCs to how they are actually stored on disk / in files, e.g. in zip archives.
* Challenging the brain supposedly boosts neuroplasticity and maintains cognitive fitness during aging (https://www.health.harvard.edu/mind-and-mood/tips-to-leverage-neuroplasticity-to-maintain-cognitive-fitness-as-you-age). Therefore, if you occasionally switch up the endianness settings in X-Ways Forensics installations of your colleagues when they are not looking, they will likely thank you later.
* The binary representation in the Data Interpreter as well as in the status bar can now show 24 bits. For better readability, a space is now inserted after every 8 bits for 16, 24 and 32 bit representations.
* The Data Interpreter settings can now be saved to and loaded from .dlg files completely.
* New time zone definitions for British Columbia and Alberta (not in strictly ascending order in the list). Previous users of the Saskatchewan time zone need to change to the combined Central America, Saskatchewan time zone, please. Daylight saving time can now be defined in the GUI for an entire year safely (without potentially missing a few days in early January or late December) by entering 0 as the start month and 13 as the end of month. Up to 100 different time zone variants can now theoretically be defined (previously 76).
* Gives the user an extra hint if file system areas were not included in a skeleton image, before closing that image, and makes a note of the inclusion in the image log.
* Some minor improvements. |
Stefan Fleischmann
Username: admin
Registered: 1-2001
| | Posted on Thursday, Jul 2, 2026 - 14:52: | |
Preview 3:
* More visibility for volume labels: Previously only shown in the Technical Details Report and in the Info Pane, they are now included in evidence object titles/numbers when partitions are added to a case. That also means that they can become part of the path of files in evidence file containers.
* Improved dealing with incomplete cases, where you only have the .xfc file and no corresponding subdirectories.
* Tentative support for some more VDI image variants.
* Some minor improvements.
* Same fix level as v21.8 SR-4. |
|