Table of Contents
Software Introduction
X-Ways Forensics is an advanced work environment for computer forensic examiners and our flagship product. Runs under Windows XP/2003/Vista/2008/7/8/8.1/2012/10/2016/2019/11*, 32 Bit/64 Bit, standard/PE/FE. (Windows FE is described here, here and here.) Compared to its competitors, X-Ways Forensics is more efficient to use after a while, by far not as resource-hungry, often runs much faster, finds deleted files and search hits that the competitors will miss, offers many features that the others lack, as a German product is potentially more trustworthy, comes at a fraction of the cost, does not have any ridiculous hardware requirements, does not depend on setting up a complex database, etc.! X-Ways Forensics is fully portable and runs off a USB stick on any given Windows system without installation if you want. Downloads and installs within seconds (just a few MB in size, not GB). X-Ways Forensics is based on the WinHex hex and disk editor and part of an efficient workflow model where computer forensic examiners share data and collaborate with investigators that use X-Ways Investigator.
Website : http://www.x-ways.net/forensics/
The main function
- Complete case management and logging functions
- Automatically generate case reports in HTML format, which can be viewed and edited with programs such as Word
- Document reader supports hundreds of file formats
- Supports file printing, and can include file metadata information in the printed cover
- Can identify DD images and .e01 evidence file format
- Can analyze the files in the evidence file manager made by X-Ways Forensics,
- Can run keyword search, support logical search and index search (index search data needs to be made by X-Ways Forensics)
- Powerful search and the search result preview function that supports contextual preview of the proximity of keywords. For example, you can search the Documents and Settings directory, the last access time is 2004, and the doc and ppt files containing keywords A, B, D can
- be previewed in thumbnail mode, and the file date can be viewed in calendar mode. In
- The case report, you can associate file comments or The filter information
- Can mark files and add the marked files to the custom case report. The
- Left side of the software window displays the directory number structure, and can browse and mark related directories and subdirectories
- Powerful dynamic filtering function, can use file type, hash File filtering by combination of library, time, file size, comment, report table, etc.
- Through the recursive browsing function, the files in all directories and deleted data are displayed at the same time
- Skin color detection (e.g. a gallery view sorted by skin color percentage greatly accelerates a search for traces of sensitivity information)
Software screenshot
This screenshot is the previous technician version, the current version is the forensic version, and the functions are the same
Download link
LanZou Net Disk: https://592850.lanzoui.com/iOWEOh1gntg
