X-Ways Forensics

X-Ways Forensics is an integrated computer forensics software designed to meet the needs of small to large companies. According to the vendor, this software is widely used by law enforcement agencies, government agencies, corporate security teams, digital forensics professionals, and legal professionals.

Key Features

Disk cloning and imaging: According to the vendor, X-Ways Forensics allows users to read partitioning and file system structures inside various image files, providing complete access to disks, RAIDs, and images over 2 TB in size. It also supports the interpretation of different RAID systems and dynamic disks.

Automatic identification of lost/deleted partitions: The vendor states that this software natively supports a wide range of file systems and can superimpose sectors to parse file systems completely, even in the presence of data corruption. It also provides access to the logical memory of running processes.

Various data recovery techniques, lightning-fast and powerful file carving: X-Ways Forensics is equipped with a well-maintained file header signature database and a data interpreter that supports 20 variable types. According to the vendor, users can view and edit binary data structures using templates.

Hard disk cleansing to produce forensically sterile media: X-Ways Forensics allows users to gather slack space, free space, inter-partition space, and generic text from drives and images. The vendor states that it also facilitates the creation of a file and directory catalog for all computer media and provides easy detection and access to NTFS alternate data streams (ADS).

Mass hash calculation for files: The vendor claims that X-Ways Forensics offers lightning-fast and powerful search capabilities for multiple search terms simultaneously. It provides a recursive view of all existing and deleted files in all subdirectories and supports automatic coloring for the structure of FILE records in NTFS.

Ability to analyze remote computers in conjunction with F-Response: X-Ways Forensics supports a wide range of file systems, ensuring compatibility with different operating systems. The vendor also states that it offers superior disk imaging with intelligent compression options and the ability to read and write .e01 evidence files.

Logical acquisition: Ability to copy relevant files and directories to evidence file containers: X-Ways Forensics provides complete case management functionality, allowing users to tag files and add notable files to the case report. It also supports multiple examiners in cases, with separate or shared results.

Ability to import hash sets and create your own hash sets: According to the vendor, this software allows users to reduce the analysis scope using ID modulo filter and immediately available pseudo-hash values. It offers convenient navigation options, including back & forward navigation, gallery view, and calendar view. It also provides an internal viewer for various file types.

Ability to collect Internet Explorer history and browser cache index.dat records: X-Ways Forensics ensures extensive and precise file type verification based on signatures and specialized algorithms. It offers a directory tree for easy exploration and tagging of directories and synchronizes the sectors view with the file list and directory tree.

MANY powerful dynamic filters based on true file type, hash set category, timestamps, file size, comments, report tables, contained search terms, etc.: According to the vendor, X-Ways Forensics allows users to identify and filter out duplicate files, automatically detect encrypted MS Office and PDF documents, and extract embedded files from various other files. It also provides detection of black & white or grayscale pictures and PDF documents that should be OCR'ed.