Posted on Tuesday, March 14 2006 @ 13:22:01 CET by LSDsmurf
Support for Unicode characters in file and directory names in most parts
of the user interface, notably in the directory browser and the directory
Newly created evidence file containers can now optionally incorporate
filenames in Unicode instead of ASCII. For compatibility with older versions
of X-Ways Forensics, stick with ASCII.
Support for the platforms Windows 95/98/Me has finally been discontinued.
v12.8 remains the last version to run under those Windows versions.
When verifying file types based on signatures, no fictitious items with
the presumed correct extensions are listed any more. Instead, the detected
type can be seen in the new optional Type column. Only initially the Type
column shows the same as the Extension column. The Category column is now
based on the Type column, no longer on the Extension column. When a mismatch
between filename and type is detected, either when refining the volume
snapshot, when previewing files, or when viewing files in the Gallery, both
the Type and the Category column are updated and turn blue.
There is also a new filter that conveniently lets you address files of
selected types, in addition to the Category filter. (forensic licenses only)
Another new optional column indicates the status of the file type column.
Initially "not verified". After checking for filename/file type
mismatches: If a file is very small, the status is "don't care".
If neither the extension nor the signature is known to the file type
signature database, the status is "not in list". If the signature
matches the extension according to the database, the status is
"confirmed". If the extension is referenced in the database, yet
the signature is unknown, the status is "not confirmed". If the
signature matches a certain file type in the database and the extension
matches a different file type or none at all, the status is "newly
identified". A filter can be used on this column, too. (forensic
The separate viewer component has been updated on March 3, 2006.
Ability to display timestamps with tenths of seconds in the directory
browser. Useful for the file systems NTFS and FAT that provide for and even
exceed this precision in all or some timestamps.
The volume snapshot data format has changed. Previously created volume
snapshots can be converted automatically for use with v12.85 and later,
except for ReiserFS/Reiser4 volumes. Should you encounter problems importing
old volume snapshots, you can either recreate the volume snapshot from
scratch (thereby losing comments, tags, discovered orphaned files, etc.) or
continue using v12.8 for that case/image. Backup copies of the original
volume snapshot files are left in the metadata subdirectories.
Support for drive/directory contents table creation has finally been
The priorities when sorting by the Attribute column have been redefined.
Ability to maintain custom sections of the file type signature database
separate from the main file in an arbitrary number of files named "File
Type Signatures *.txt". These files are loaded in addition to the main
file. Their internal format must be the same. Usage of such user-defined
files prevents that your own definitions will be overwritten when you
install an update.
NetBSD UFS now supported.
The structure of deleted nested subdirectories on Ext2 volumes is now
often better represented.
ReiserFS volume snapshots are now taken faster.
Ability to include the contents of archives in a logical search when in a
Slack data added to evidence file containers is now marked and sortable as
slack in the Attribute column. You can hold the Shift key as before to add a
file plus its slack, and now alternatively the Ctrl key to add _only_ the
Ability to tag or untag an unlimited number of items at a time in a
Ability to print case reports optionally with a user-defined header line,
a logo, and a preface (see Case Properties, Report Options).
Ability to treat and display archives exactly like directories once their
contents have been included in the volume snapshot.
This is reversible and can also be applied retroactively. One benefit is
that archives are not subject to dynamic filters any more as are ordinary
files, so it's easier to navigate to the contents of the archives when a
filter is active that would normally filter out the archives. Another
benefit is that archives turned into directories behave like directories
when it comes to tagging.
Ability to convert packed 7-bit ASCII to readable 8-bit ASCII with a
Right-clicking a file in the directory browser now updates the Preview
area. (since v12.8 SR-6)
.tif pictures now included directly in the HTML case report, not as a
link, as they can be displayed by Firefox. (since v12.8 SR-6)
When adding files to containers with the indirect method, the name of the
externally output file is now checked better for compliance with Windows
filename restrictions. (since v12.8 SR-6)
An error was fixed that on certain partitions prevented the fictitious
"Free space" file from being read. (since v12.8 SR-8)
An error was fixed that in certain situations prevented the prompt for an
output filename when exporting a file list from a recursively explored Case
Root window. (since v12.8 SR-9)
Several other minor improvements.
Program Information Category:
Tools and Utilities Type:
Shareware Version: 12.85 Size: 1.22MB Works on: Windows