Preview 2:
* Support for Windows 8 registry hives
* Separate menu command to add memory dumps to the case.
* Fixed disk imaging bug in original v16.3 Preview version.
* Some minor improvements.
Beta:
Evidence file containers
* Evidence file containers of the new format now store examiner comments and report table associations internally, no longer in separate files in a metadata subdirectory. Both comments and report table associations can also be seen in 3rd party tools that understand the new container format.
Usability
* It is now possible to press the Esc key in the search hit list to leave the search hit list (i.e. return to the normal directory browser) and navigate to the file that the selected search hit is contained in, if any.
* It is now possible to press the multiplication key on the numeric keypad of the keyboard or the asterisk key to explore a directory or file with child objects. Useful if you have selected to use double-clicks and the Enter key already for the View command.
* It is now possible to use the asterisk key just like the multiplication key (Windows standard) to fully recursively expand the directory tree from the selected directory downwards.
* It is now possible to navigate back and forward by pressing Ctrl and the cursor keys left and right, just like with the Back and Forward menu and toolbar commands.
* The Back and Forward commands now also remember switches from the normal directory browser to the search hit list and back and are able to undo them.
* It is now possible to explore a directory or file with child objects that contain search hits from within the search hit list. Just that note that you would see any of the child objects only if they also contain search hits. If they don't contain any search hits, you will see a reminder that you can use the Back functionality or press Esc to return to the normal directory browser.
* The number of filtered out search hits in the search hit list when a filter is active is now a more intuitively understandably count.
File format support
* Support for file archives revised. Proven ability to find and read files in corrupt zip archives that WinZip, WinRAR and 7-Zip cannot find.
* Support for pictures with extremely high resolutions (larger than ~ 25 MP).
* Ability to filter for pictures with a skin color percentage of x % or *less*. For example a very low percentage or 0% only can be useful to find scanned documents that have been scanned with full color depth instead of just with a gray scale.
* Additional overview of log-in and log-off operations at the end of the interpretation of .evtx event logs.
* No internal metadata extraction is attempted any more for files marked with a red X.
* A report table association is now created for multi-page TIFF files when extracting metadata.
* Ability to extract internal creation dates from certificates (*.cat, *.cer, *.ctl).
* Performance of JPEG consistency check improved.
* Several minor improvements.
* Same fix level as v16.2 SR-6.
Beta 2:
* Avoided exception error that could occur in the original beta version when switching between windows.
* Ability to distinguish between user-created and application-created report tables in evidence file containers.
* v16.3 Beta version also available for X-Ways Investigator.
Beta 3:
* Exchange EDB extraction accelerated by a factor of 2-3.
* File Header Signature Search.txt: Another flag "h" can now be set in the new last column to indicate that the specified header signature is used to find data that is not part of the file any more and should excluded. Ordinary headers are included in the carved file.
* Better support for pictures with an extremely high resolution.
* Revised standard e-mail extraction mask now includes MS Office 2011 for Mac .olk14MsgSource files to allow for extraction of attachments.
* Original individual e-mail message files present on a disk (like .eml, .emlx or .olk14MsgSource) are now marked in the Attr. column as processed original .eml once they have been processed (e-mail extraction in Refine Volume Snapshot) and thus can be filtered as such. Useful to cover all original individual e-mail files and artifically produced .eml files (representing extracted e-mail) with a single filter (the Attr. filter).
* Avoid exception error that could occur in v16.3 Preview/Beta when starting a file header signature search.
* Fixed a rare "Internal error 2010" that could occur in earlier versions when running logical searches.
* Several minor improvements.
Beta 4:
* Ability to reconstruct RAID level 6 systems, more precisely these variants: backward parity (Adaptec), forward parity, and forward delayed parity with non-zero start component (as used by WiebeTech/CRU-Dataport). Information on which manufacturers use which variant and which other variants need to be supported would be very welcome.
* Ability to reconstruct RAID level 5 forward delayed parity (in case it's used anywhere).
Beta 5:
* The parameters of reconstructed RAID level 6 systems can now be remembered by cases.
* The new container format is now compatible with Mount Image Pro v4 (first add image, then mount file system).
* More Exif metadata extracted from JPEG files: focal length, lens model, F number, serial number, firmware, image unique ID
* Signing date extracted from executable files (.exe, .dll, ...) where present.
* Internal creation timestamp extracted from certificate files (.cat, .cer).
* Path representation of the registry report's verbose mode for printing revised.
* The crash safe decoding option, if fully selected, now also applies to .eml files, which in previouos versions for performance reasons it did not.
Beta 6:
* Ability to reconstruct RAID level 5 forward dynamic delayed parity.
* Mode Disk/Partition/Container in X-Ways Investigator now hides the hex/text column and instead shows some useful information about the container and the volume snapshot.
* Template for GPT partition tables included and invocable via the directory browser context menu (when right-clicking the virtual file that represents the beginning of a GPT-partitioned disk) and via the drop-down menu of the white arrow button.
* When unlocked with a dongle just for disk imaging purposes, X-Ways Forensics now identifies itself as X-Ways Imager, and a smaller download of just the files that are needed to run X-Ways Forensics as X-Ways Imager is now available separately.
Beta 7:
* Memory requirements for Exchange EDB e-mail extraction limited and reduced.
* Prepared to carve .itc2 iTunes artwork cache files and PNG files within them.
* Files in evidence files containers that had child objects in the original volume are no longer shown as having child objects if none of the child objects have not been included in the container.
* Some minor improvements. Same fix level as v16.2 SR-8.
Beta 8:
* Ability to use File | Create Disk Image for physical RAM when opened under Windows XP or 2000.
* Search hits and their context can now also be correctly displayed if in UTF-8.
* Interpretation of timestamps in Ext* file systems now independent of data interpreter settings for UNIX/C timestamps as it should be
* new investigator.ini options:
+40 prevent GREP searches
+41 prevent skin tone detection
+42 prevent inclusion of log in report
+43 prevent inclusion of basic report in report
+44 prevent export of report table associations
+45 prevent file export for analysis
+46 prevent export tree command
* Minor improvements and fixes.
Beta 9:
* Exchange EDB extraction improved
* New investigator.ini options:
+47 prevent export list command
+48 prevent metadata extraction
* Security option to verify the chunk CRCs when reading from .e01 evidence files.
* Some minor improvements.
Beta 10:
* Some fixes.
Beta 11:
* Some exception errors fixed that could occur during metadata extraction.
* Output of dummy entries in registry report fixed.
* Ability to sort by search term column.
* Fixes for Exchange EDB extraction.
* Relative path to viewer component (like .\viewer) now fully supported.
* Some minor improvements.
v16.3 has just been released. |
