What's new
RevTeam.Re - Reverse Engineering Team

Welcome Guest! Register a free account today to become a member! Once signed in, you'll be able to participate on this site by adding your own topics and posts, as well as connect with other members through your own private inbox! Register and wait for our approve!

X-Ways Forensics

c1400700226

c1400700226

Active member
Joined
Sep 30, 2021
Messages
38
Reaction score
13
20.4 SR-4:

* Faster viewing and previewing of large PSD pictures, using the internal graphics viewing library instead of the viewer component.

* Fixed an error in the Tools | Compute Hash command that occurred when applied in File mode.

* Attaching files in the case root window previously switched to a file listing that was shown as being not recursive. That was fixed.

* Some minor improvements.

20.5 Preview 2:

* Ability to interpret unencrypted evidence files in Ex01 format.

* The "Mount as Drive Letter" functionality now comes with a new option named "Apply recursively" to present files from all subdirectories of the currently active evidence object or the selected directory in a flat list. This is useful if you wish to use an external program to view many of the files and don't wish to bother with directory navigation. When using this option, the int. IDs of the files are inserted into the filenames to make the files better identifiable to X-Ways Forensics.

* Comments of evidence objects are now also shown in the Comments column in the Case Root window and can be edited from there. The description of evidence objects is now also shown in the Metadata column in the Case Root window.

* Ability to define the maximum size of files for which thumbnails should be created in the gallery. It may be necessary to increase that limit for high resolution Photoshop PSD pictures for example.

* Several minor improvements.

@730boro Please share, thanks!
 
kardelen

kardelen

Well-known member
Joined
Dec 13, 2021
Messages
210
Reaction score
265

c1400700226​

Dikkatimi çekti sürekli güncel sürümü istiyorsun sende çalışan dongle yama var gibi paylaşabilir misin
 
c1400700226

c1400700226

Active member
Joined
Sep 30, 2021
Messages
38
Reaction score
13
20.5 Preview 3:

* Additional generator signatures defined.

* Support for new Exif tags concerning composite images and time zones.

* Revised recognition of camera original pictures, now with a lower false negative rate, especially for Xiaomi smartphones.

* Evaluates camera debug information in the Application Marker 4 for Samsung smartphones such as camera serial number, timestamp of the last firmware update, and a 2-letter country code. This may enable the examiner to associate a photo with the exact device that took it.

* Provides the last printing date and the internal last modification date of OpenOffice documents as events.

* Automatic verification of newly created images via hash is now applied to an optional 2nd image copy also when adding the 1st copy to the active case.

* Several minor improvements.

@730boro Please share, thanks a lot!
 
c1400700226

c1400700226

Active member
Joined
Sep 30, 2021
Messages
38
Reaction score
13
20.5 Preview 6:

* When computing PhotoDNA hash values and storing the hashes for deduplication and fast re-matching, X-Ways Forensics now also automatically compares embedded thumbnails to their parent files. If the difference is noticable, that will be brought to the user's attention with two report tables, "Thumbnail discrepancy" and "Thumbnail notable (data corrupt/incomplete)", where the latter means that there is a difference most likely just because the parent file is corrupt or incomplete. (The thumbnail, which requires little storage space and is located near the start of the file, could be unaffected and therefore helpful.) The former could indicate that someone has retroactively altered /redacted the full resolution picture and left the embedded thumbnail as it was.

* X-Ways Forensics from now on distinguishes between 4 instead of 3 possible file format consistency states: unknown, OK, irregular and corrupt. This is in the process of being revised. Important for the Type status filter settings.

* Improved handling of hard disks that were partitioned and formatted as if they had a different sector size.

* Same fix level as v20.4 SR-5.

* Some minor improvements.

20.4 SR-5:

* Waits longer for closed evidence objects to open if targeted by RVS, to avoid the error message "Sorry, the following evidence object was skipped".

* Fixed a cluster allocation display error of v20.4 SR-4.

* Fixed an exception error that could occur in v20.4 under certain circumstances when generating the case report.

* Some minor improvements.

@730boro Please share, thanks!
 
c1400700226

c1400700226

Active member
Joined
Sep 30, 2021
Messages
38
Reaction score
13
20.5 Beta 1:

* Now executable again under Windows XP (with limitations).

* In condition cell coloring, you now have the option to color the Name cell in addition to the original cell that the condition is based on. Useful if you wish to be visually alerted of the matching condition even if the triggering column is currently not visible, and if highlighting the entire line would be too much.

* Revised and improved alternative .eml preview, which is important also for the case report option "Alternative .eml presentation directly in browser".

* A filter is now available for process dumping. You can use it like other file mask filters in X-Ways Forensics. For example "explorer.exe" will only dump memory and windows of the Windows File Explorer process. ":C*" will dump all processes except those whose names starts with the letter "C", ie for example not "Chrome.exe". The file mask is not case sensitive. Multiple file masks can be concatenated with semicolons. (However, the total length is limited.)

* Registry Viewer: Ability to copy the value data as shown in the list view on the right-hand side. (In order to copy the value data in binary, select the value in the list view, move the registry viewer aside and copy the selected data from File mode.)

* The Notation settings now allow you to see some "internal" flags in the Description column if you wish. Those flags identify the status of a file in volume snapshot refinement.
[Emb]: checked for embedded data to uncover
[Arc]: file archive checked for content
[Enc]: encryption test already performed
[Ext]: e-mail or e-mail archive checked for extractable content
[Met]: checked for internal metadata
[Xtn]: created by an X-Tension

* Printing templates did not show formatted GUIDs correctly. That was fixed.

* Beta version also available as X-Ways Investigator.

* Several minor improvements.

@ 730boro Could you please share? Thanks!
And they published a new plugin:
Excire for X-Ways Forensics is a separate module usable in
Please, Log in to view URLs content!
and
Please, Log in to view URLs content!
based on technology developed by
Please, Log in to view URLs content!
, a German AI firm started in 2005 as a spin-off of the University of Lübeck. PRC has an excellent team of computer scientists with extensive expertise in machine learning, neural networks, and computer vision.
 
P

purplegiraffe

Member
Joined
Jan 23, 2022
Messages
6
Reaction score
2
Proximo said:
Please, Log in to view quote content!
Click to expand...
When I run it, it says that this application cannot run in a Virtual Machine (I am running Win 11 in VMware). I was able to run 20.3 SR-4 in a VM without issues. I am surprise to see that this version does not run in a VM. Would that be related to the crack?
 
You must log in or register to reply here.
Top