Clik here to view.
Video 31 - Filtering E-Mails by their 'Read' or 'Unread' status
What if you're asked for a list of the e-mails that appear to have been read, or indeed only those that are unread? How can you do that with X-Ways Forensics?Easy. Add you image(s) or devices to a case...
View ArticleClik here to view.
The new book - reserve your copy
The book titled "X-Ways Forensics - The Practitioners Guide" is available internationally via Amazon from September 17th 2013 (though you can reserve it now) and via Elsevier around 15th October 2013.I...
View ArticleClik here to view.
Video 32 - Determine computer usage patterns (Startup, Shutdown, Unlock etc)...
P { margin-bottom: 0.21cm; direction: ltr; color: rgb(0, 0, 0); line-height: 115%; widows: 2; orphans: 2; }P.western { font-family: "Calibri",sans-serif; font-size: 11pt; }P.cjk { font-family:...
View ArticleClik here to view.
Video 33 - Commenting and Exploring Free Space as Child Objects
OK, so god awful X-Factor is on the TV so this gives me an hour to abandon domestic matters and get back to my blog!XWF, unlike other tools, has a single virtual file for representing the free space of...
View ArticleClik here to view.
Video 34 - Creating User Categorised Search Hits from Free Space
In the previous Video 33, I showed you how to create child objects of relevant evidence from free space. In this video (Video 34) titled 'Creating User Categorised Search Hits from Free Space', I show...
View ArticleClik here to view.
Understanding Child & Parent Relationships when 'Bookmarking'
One of the ways that XWF helps me with my workflow so much and saves me so much time is its "like nothing else out there" method of bookmarking, or, to use the correct XWF terminology, creating and...
View ArticleClik here to view.
Enable or disable 'File Object Count' statisitics
Users upgrading from earlier versions of XWF (prior to v17.6 down to, as a rough estimate, perhaps v16.9 or thereabouts) )will know that the file object count of a case and and evidence object and each...
View ArticleClik here to view.
Preserve filter and column sort settings on a case-by-case basis
In versions of XWF prior to v17.0 (released around March 2013), it was sometimes awkward if you applied filters and column sorts for a case because the next time you opened it, the settings from the...
View ArticleClik here to view.
Video 39 - Restoring the '.' to the hex display for unprintable bytes
A minor thing but frustrating when you don't know how to change it is the hex display in XWF doesn't display '.' in place of non-printable characters anymore. And if you like to see them in place of...
View ArticleClik here to view.
Video 40 - Improving Indexing Speeds and Storage Efficiencies using type...
The new indexing engine that was introduced in v17.2, made more significant in v17.5 (but with the old one still available) and seemingly made the primary indexing engine in v17.6 (or .7) is worthy of...
View ArticleClik here to view.
How far down the list am I?
p { margin-bottom: 0.08in; }Often you, or a team you are assisting, might find themselves in a position where they have a list of many thousands of files in the directory browser of X-Ways Forensics...
View ArticleClik here to view.
Using the Position Manager to Annotate Byte Ranges
p { margin-bottom: 0.08in; }The position manager enables us to keep a nicely ordered list of positions within digital data and our X-Ways Forensics case. This is useful for both investigations,...
View ArticleClik here to view.
Video 42 - So UserB asked UserA "Where are your keyword searches?" and UserA...
Since v17.5, multi-user co-ordination has played a big part in the world of X-Ways Forensics. It's a great feature that enables multiple users to work the same case at the same time (up to 255) and...
View ArticleClik here to view.
Video 43 - Exporting files named as the Unique ID
The Unique ID column is X-Ways is a great way to ensure that each file object is totally unique to the whole case, regardless of how many forensic images you add.It differs by the Internal ID in as...
View ArticleClik here to view.
Video 44 - Creating Your Own Custom "File Type" Categorisations
Video 44 is a goodie....I'm confident everyone will like it.One of the reasons I created this site was to help the guys at X-Ways Software illustrate how X-Ways Forensics can be used for everyday...
View ArticleClik here to view.
Video 45 - Logging file exports and customising the log
X-Ways Forensics, like most forensic tools, has the ability to export files to your local filesystem from the forensic image you're examining. Naturally this puts the file at the mercy of the...
View ArticleClik here to view.
Video 46 - Block Hashing Explained
In my opinion, for what it is worth, the addition of block hashing to X-Ways Forensics is one of the most impressive new additions to the tool.As always, the manual explains this fully and properly....
View ArticleClik here to view.
Video 34 - Creating User Categorised Search Hits from Free Space
In the previous Video 33, I showed you how to create child objects of relevant evidence from free space. In this video (Video 34) titled 'Creating User Categorised Search Hits from Free Space', I show...
View ArticleClik here to view.
Video 35 - Basic RAID Reassembly using XWF
For those that work in areas involving corporate servers especially, but these days, many home PC's are configured with RAID configurations too, an understanding of RAID technology is...
View ArticleClik here to view.
Video 47 - Disk Image Mounting Coming with v18.6
From time to time during my travels the odd person says to me "Ah yes, I know X-Ways is great, but it doesn't do X", and 9\10 I am able to turn round and tell them "Er, actually, it does. You just...
View Article