X-Ways Forensics

X-Ways Forensics is an advanced working environment and a flagship product of a German company - X-Ways AG. It operates in the Windows 2000/XP/2003/Vista/7 environment. As compared to competitive solutions, X-Ways operates faster, more effectively, it requires fewer resources, it locates many more deleted files and folders and, what is most important, it is much cheaper. It is fully integrated with the WinHex disc editor.

The main functions of X-Ways Forensic:

taking disc snapshots and cloning disks, also in the DOS system, by means of the X-Ways Replica tool;
browsing directory structure directly from the previously created disk snapshots, also when the snapshot was divided into many parts;
supporting many file systems: FAT, NTFS, Ext2FS, Ext3FS, ReiserFS, CDFS, UDF,various implemented techniques of recovering and identifying files (hundreds of defined file signatures imported from the "FileSig" file);
a built-in function allowing accurate hard disk cleaning to prepare the carrier for work;
extracting the following from images and disks: chains of signs and hidden data space (inaccessible from the system level), free space, unused space between partitions, slack space (the ending parts of files in a given file system);
creating lists of files and folders;
using alternative data streams of the NTFS file system;
computing collective check sums for files (CRC32, MD5, SHA-1, SHA-256, PSCHF etc.);
advanced simultaneous search for many phrases;
possible bookmarks and notes;automatic numbering of the created files;
a built-in image browser for the following formats: JPEG, JPEG 2000, GIF, TIFF, BMP, PNG, TGA, PCX, WMF, EMF, MNG, and JBG;
protection against overwriting the analysed carrier;
detecting discrepancies between the file extension and the actual file format;
fully functional case management;automatic logging of all operations;
automatic HTML report generation to be imported to other office applications (e.g. MS Word);
possible and adjustable view of all files (even if deleted) present on a carrier according to file type (documents, images, internet etc.), independent of directory structure;a built-in Windows register files viewer, possible automatic report generating;
possible view of files, also in chronological order;skin colour detectionthe possibility of creating customised check sum sets;
comparing files by the use of check sum databases (supports NSRL RDS 2.x, HashKeeper, ILook);
examining e-mails saved as Outlook files (PST, OST), Outlook Express (DBX), Mozilla (Netscape and Thunderbird), AOL PFC (mbox, Berkeley, BSD, Unix), Eudora, PocoMail, Barca, Opera, Forte Agent, The Bat!, Pegasus, PMMail, FoxMail, maildir;
a built-in function of reading files in the Encase format and of saving compressed case files in a custom format;