|
Integrated
Computer Forensics Software
X-Ways
Forensics is an advanced work environment for computer
forensic examiners and our flagship product.Runs under
Windows XP/2003/Vista/2008/7*, 32 Bit/64 Bit. Compared to
its competitors, X-Ways Forensics is more efficient to use
after a while, often runs faster, is not as resource-hungry,
finds deleted files and search hits that the competitors
will miss, offers many features that the others lack, ...,
and it comes at a fraction of the cost! It is based on the
WinHex hex and disk editor and part of an efficient workflow
model where computer forensic examiners share data and
collaborate with investigators that use X-Ways Investigator.
X-Ways Forensics comprises all the general and specialist
features known from WinHex, such as...
Disk
cloning and imaging
Ability to read partitioning and file system structures
inside raw (.dd) image files, ISO, VHD and VMDK images
Complete access to disks, RAIDs, and images more than 2 TB
in size (more than 232 sectors) with sector sizes up to 8 KB
Built-in interpretation of JBOD, RAID 0, RAID 5, and RAID 6
systems (including Linux software RAIDs), Windows dynamic
disks, and LVM2
Native support for FAT12, FAT16, FAT32, exFAT, TFAT, NTFS,
Ext2, Ext3, Ext4, Next3®, CDFS/ISO9660/Joliet, UDF
Viewing and dumping physical RAM* and the virtual memory of
running processes
Various data recovery techniques, lightning fast and
powerful file carving
Well maintained file header signature database based on GREP
notation
Data interpreter, knowing 20 variable types
Viewing and editing binary data structures using templates
Hard disk cleansing to produce forensically sterile media
Gathering slack space, free space, inter-partition space,
and generic text from drives and images
File and directory catalog creation for all computer media
Easy detection of and access to NTFS alternate data streams
(ADS)
Mass hash calculation for files (CRC32, MD4, ed2k, MD5,
SHA-1, SHA-256, RipeMD, ...)
Lightning fast powerful physical and logical search
capabilities for many search terms at the same time
Recursive view of all existing and deleted files in all
subdirectories
Automatic coloring for the structure of FILE records in NTFS
Bookmarks/annotations
Runs in WinFE, the forensically sound bootable Windows
environment, e.g. for triage/preview, with limitations
Ability to analyze remote computers in conjunction with
F-Response
...
|
