Clik here to view.
Video 51 - Superimposing Sectors to Recover Messed Up Disks
Following on from narrative and Video 50, I wanted to show you "Superimposing Sectors". What's that you may ask? Well ask no more dear reader and instead read on.Have you ever had one of those days...
View ArticleClik here to view.
Video 52 - Make your investigations easier on your mince pies (eyes) with...
By default, X-Ways Forensics usefully highlights in certain subtle ways. For example, encrypted files that it detects are coloured a light green, and so on.But for various reasons that will often be...
View ArticleA good X-Ways Forensics vs EnCase vs FTK vs Autospy Comparison
Sorry there has been no new content of late. I've been very busy with other things along with a family bereavement issue so doing XWF videos has not been a top priority.However, a colleague of mine...
View ArticleClik here to view.
Video 53 - Searching for Whole and Non-Whole Words At the Same Time
Very often we may choose to do a search utilizing "Whole words only" to ensure the number of false hits are kept to a minimum. But sometimes we may have words that are very unique meaning a whole word...
View ArticleClik here to view.
Narrative 54 - Creating Data Schedules of Your Reviewed Evidence
These days, in both criminal, civil and 'e-discovery' circles, people want to see lists. Lists 'of stuff'. It's often no longer enough just to say "there was a lot on the computer, sir" or "there were...
View ArticleClik here to view.
Introducing NSRL Stripper - Easily convert NSRL hash set to single hash columns
This is not directly X-Ways Forensics related, but I thought it may be useful to followers of these pages.As you all must certainly know, NIST create a hash set of known irrelevant files called the...
View ArticleClik here to view.
Video 54 - Children and Parent Objects and Report Tables
p { margin-bottom: 0.25cm; line-height: 120%; }Many of us have to bookmark data. Either we (the digital forensics people) do it or perhaps more often than not we might present the data to a...
View ArticleClik here to view.
Video 55 - Converting FTK Imager AD1 Custom Image Data To X-Ways Forensics...
All to often, I hear about people who have created FTK Imager Ad1 images or have been passed such containers and they need to access them with X-Ways Forensics. To achieve this, they open the container...
View ArticleClik here to view.
Video 56 - Remote Viewing using X-Ways Investigator or XWI CTR
p { margin-bottom: 0.25cm; line-height: 120%; }It's 2017. The days of hiring a DVD from Blockbuster seems like a generation ago, and my massive drawer of hundreds of DVD's that was once rather an...
View ArticleClik here to view.
Video 57 - Parsing SQLite Database with X-Ways Forensics
Firstly, apologies again for the long break between this narrative and the last. It's very difficult to find the time, and peace, needed to create these instructions. As it is, this is being made at...
View ArticleClik here to view.
Video 58 - Save and Load Long Report Table Association Lists
In Video 58 I show you how you can save long lists of report table associations for easy re-insertion into other X-Ways Forensics cases, avoiding the need to retype them.When you have a scenario...
View ArticleClik here to view.
Apple APFS Disks now supported by X-Ways Forensics v19.7
I'm pleased to report that recent work has found that v19.7 Beta of X-Ways Forensics can open and traverse APFS filesystems (experimental currently but seemingly working well). Lots of other forensic...
View ArticleClik here to view.
Coming soon - The X-Ways Forensic API for beginners
Some of you (perhaps many of you) might be similar to me in that you are aware of the power and benefits of the X-Ways Forensics API, but either due to a lack of time, lack of experience, lack of...
View ArticleClik here to view.
Video 59 - Introduction to X-Tensions for Beginners
In this video 59, I attempt to give a brief overview of the basics of writing your first X-Tension. This is a very high level walkthrough, designed to help those who might have tried and failed to get...
View ArticleClik here to view.
Video 60 - New Export Options and new XWF_OpenItem flags
Firrstly all the usual "new normal" well wishes to you all and I hope you and your families are doing OK amidst our national pandemic! In my previous post and Video 59 which was as recent as, cough...
View ArticleClik here to view.
Video 61 - Rebuilding RAID0...with LVM!
You have imaged a handful if disks from some device. Those disks were part of a RAID0 (so a striped RAID). And to make matters worse, an LVM has been put across it. What do you do?So recent versions of...
View ArticleClik here to view.
Video 62 - Support for the btrFS Linux Filesystem in X-Ways Forensics 20.1
 Users of X-Ways Forensics who follow the release announcements page might already be aware that in the Preview, and now beta, version of X-Ways Forensics v20.1, support has been added for the btrFS...
View ArticleVideo 64 - Channel [Re]Introduction
 After a 4 year absence from the channel caused by a melody of reasons, I thought I'd take to the screen myself for the first time in 12 years to welcome you all back, thank you for sticking around, to...
View ArticleVideo 65 - Comparing Two Different Text Files with X-Ways Forensics
 This evening, in Video 65 - Comparing Two Different Text Files with X-Ways Forensics - I settle us back into a rhythm with a super simple demonstration of comparing two very similar text files and...
View ArticleVideo 66 - Comparing Two Non-Text Files with X-Ways Forensics
Following on from Video 65, this simple video illustrates how to easily compare two non-text files whose sizes match, and which should be a copy of each other, but the hashes don't match and you want...
View ArticleVideo 67 - Adding NSRL SQLite Hash Sets to X-Ways Forensics
For at least two decades, I have used the NSRL text based hash lists with forensic tools, including X-Ways Forensics. But in the last year or so, NIST have moved away from providing the sets as text...
View ArticleVideo 68 - Conducting OCR (Optical Character Recognition) with X-Ways Forensics
The ability to find text within picture files is often very useful as part of any review of digital data. This video demonstrates how to do OCR with X-Ways Forensics, and makes passing comment to an...
View ArticleVideo 69 - Understanding and Using the Data Interpreter in X-Ways Forensics
 Video 69 hopes to help new users, or new practitioners to the field, with understanding HOW the Data Interpreter of X-Ways Forensics actually does "interpret data". It starts with a foundation session...
View ArticleVideo 70 - Device Types & Generator Signatures in X-Ways Forensics
 Video 70 - Device Types & Generator Signatures in X-Ways ForensicsIn this short 9 minute video, I quickly highlight some of the capabilities of the Device Type and generator Signature capabilities...
View Article