What's new
RevTeam.Re - Reverse Engineering Team

Welcome Guest! Register a free account today to become a member! Once signed in, you'll be able to participate on this site by adding your own topics and posts, as well as connect with other members through your own private inbox! Register and wait for our approve!

X-Ways Forensics

Sunnych

Sunnych

Active member
Joined
Sep 12, 2021
Messages
27
Reaction score
538
X-Ways Forensics
Yalnızca x86 sürümü çalışır -> "xwforensics.exe"yi başlatın (Only x86 version works -> start "xwforensics.exe")

Forensics20-3.jpg


X-Ways Forensics 20.3 SR4
  • MPlayer
  • viewer
  • libaff4-xways

View hidden content is available for registered users!
 
A

ademyener

Guest
Tuesday, Oct 12, 2021 - 5:28:​
​
SR-6:

* No more (futile) attempts to back up cases that are opened as read-only.

* When opening files that were carved and that contain NTFS-compressed data, the resulting decompressed file contents no longer contain a few surplus bytes.

* Avoids possible duplication when carving NTFS-compressed files.

* Some necessary initializations are now performed when triggering a logical search from the command line indirectly via RVS.

* Since v20.1, with the internal algorithm ~29 not all RAR archives were carved. That was fixed.
 
c1400700226

c1400700226

Active member
Joined
Sep 30, 2021
Messages
38
Reaction score
13
20.3 SR-8:

* Fixed an exception error that could occur since v20.2 when processing certain .evtx event log files.

* An error in the alternative spreadsheet text decoding method was fixed. This fix will also be available in v20.1 SR-13 and v20.2 SR-8. Please keep the application's main window in the foreground if you run a search with that option.

* The gallery now reflects the directory browser's scrollbar position when switching to gallery mode, like in v20.1 and earlier.

20.4 Beta 4:

* Ability to detect and defend against one more type of archive bomb.

* Support for overlong paths within the case directory.

* The resource download directory now contains ready-to-use XWF hash databases with the NIST NSRL RDS 2.74 hash values as MD5 and SHA-1.

* Some minor improvements.

* Same fix level as v20.3 SR-8.

Please share BOTH, thanks very much!
 
c1400700226

c1400700226

Active member
Joined
Sep 30, 2021
Messages
38
Reaction score
13
730boro said:
Please, Log in to view quote content!
Click to expand...
20.4 SR-1:

* The hash types for disk imaging and volume snapshot refinement can now be selected in the same dialog window, which requires two mouse clicks less and means that .dlg files of these dialog windows will cover the settings more completely.

* Avoided a read error that could occur when OCRing files.

* Prevents repeated output of hint on use of multiple .settings files.

Please share, thanks
 
N

n0fw5vlc1

Guest
Can anyone share the medicine for some newest version? Thank you...
 
c1400700226

c1400700226

Active member
Joined
Sep 30, 2021
Messages
38
Reaction score
13
20.4 SR-2:

* If you get file creation error messages when running OCR with multiple threads, you can now try an unlabeled, but tooltipped checkbox next to the Tesseract OCR option to make X-Ways Forensics wait longer for Tesseract to finish.

* Fixed a potential infinite loop that could occur with certain PDF documents when uncovering embedded data.

* Now uses an embedded JPEG picture as the thumbnail of certain camera raw files in the case report.

* When the case report is generated, the user now has the option to explore the directory where the report is stored instead of viewing the report directly.

* The hint given in fresh installations that the RVS processing state of files in evidence file containers is taken over is now given repeatedly, until the user disables it. Previously it was probably often overlooked or ignored and/or not understood.

* Chinese translation of the user interface updated.

* Some minor improvements.

@730boro Please share, thanks!
 
c1400700226

c1400700226

Active member
Joined
Sep 30, 2021
Messages
38
Reaction score
13
20.4 sr3
* Fixed an exception error that could occur in v20.4 with WofCompressed or possibly other kinds of pseudo-sparse files.

* Prevented inability to load previously decoded text that was written incompletely because of a crash. Earlier versions of X-Ways Forensics cannot load decoded text stored by v20.4 SR-3 and later.

* Several minor improvements.

@730boro Please share, thanks so much
 
c1400700226

c1400700226

Active member
Joined
Sep 30, 2021
Messages
38
Reaction score
13
20.5 Preview 1

* New command "Capture Processes" in the Tools menu in X-Ways Forensics that allows to acquire all data in the memory of running processes on a live system contiguously (i.e. pages in the order as allocated by the process). The creation times of processes can be seen as the creation timestamps of the memory dumps. Pages marked as containing executable code (PAGE_EXECUTE* styles) are optional and if omitted will suitably reduce the amount of data if you are merely interested in keyword searches or carving and not malware analysis. Carving in the memory dumps (files shown as type "mem") can be performed by uncovering embedded data, one of the functions of volume snapshot refinement.

* This command can also produces a tab-delimited list of all top-level windows with their titles and corresponding processes plus (comma-delimited) the titles of their child windows. Screenshots of some of the top-level windows are taken and output automatically. If this functionality is used without administrator rights, only processes of the current user are covered, otherwise all processes.

* The output folder of "Capture Processes" is by default either a subdirectory of the case or - if no case is active - a subdirectory of the directory for images. It can be automatically explored in Windows File Explorer once the output is complete and/or added to the active case as a directory.

* Recognizes Windows 11 as a platform and was confirmed to run on Windows 11 practically as well as on Windows 10.

* Supports new style of reparse point text of Windows 11.

* Applying X-Tensions to files in selected directories is now optional. (In case a particular X-Tension is useful when applied to directories only.)

* The rules of advanced sorting are now also applied to the Hash Set column.

* Improved PNG screenshot identification. In particular, a new Exif format is supported that is used mainly for Android screenshots. This allows to verify whether such Android screenshots are original.

* Further revised generating device identification (esp. smartphones, esp. all Samsung smartphones) with around 34,000 definitions and two new iOS release identifications.

* Several minor improvements.

@730boro Please share, thanks again
 
You must log in or register to reply here.
Top