XWF/2E Contributors & Your Stories!

Putting together an AWESOME group of contributors for the X-Ways Forensics Practitioner’s Guide/2E.  Just wait until you see the line up from some of the most competent users of X-Ways Forensics and respected members of the forensic community!


Do you have an interesting or cool X-Ways Forensics story to tell?

Comment below with your story and you could end up in the book! What kind of story? If you have any case or instance where XWF made your day, made your case, or surprised you in doing something, then that is the kind of story we are looking for.

There are so many “x” ways to use X-Ways Forensics that we’d like to showcase different ways that users have been doing for the past years or even from yesterday. Your “x” way may be better than another way, or maybe just different. We want to know and maybe put you in the book!



Righted the rights!

Syngress released the rights of the X-Ways Forensics Practitioner’s Guide this week!  This allows Eric and me to write and control all future editions of the book, which we will now be getting started.



What can you expect from the new edition?

  1. Updated content (of course, the latest version of X-Ways!)
  2. Innovative methods of use
  3. More 3rd party tool integrations (commercial and FOSS)
  4. Work processes and case-specific methods
  5. New cover design
  6. And just as important, your suggestions 🙂

When can you expect the new edition?

2020. This year. Not next year. Not the year after. Since Eric and I control the rights and publishing, it will be on our schedule, not a publishers schedule.

Table of Contents

We will keep the table of contents (TOC) updated here: https://xwaysforensics.wordpress.com/the-manual-s/

Expect the TOC to change with new (ie, better) ideas and suggestions. Do you have an idea for the book? What you would like to see us cover? Or maybe you have an X-Tension script you would like us to add in the book? Or maybe you created a new way to use XWF for a process that you’d like to share and be credited for? How do you use XWF with your other tools?

Send it and we’ll consider it for the new edition!

A short note on Syngress..

I’ve received several dozen emails from XWF users asking for a second edition, and through this time, have been asking Syngress (who owned the rights of the book) for an updated edition for years. Each time, the Syngress response had been “maybe later” or something to that effect.

Apparently during these past few years, Syngress had been working to change their business model, which meant no new DFIR books and no new editions of current books. You should not expect any more forensic books being published through Syngress. I don’t know the details other than new DFIR books through Syngress won’t happen. I have enjoyed having my books published through Syngress, but like anything, things change.



XWF/2E Table of Contents

The ball has begun to roll forward on the 2nd edition of the X-Ways Forensics Practitioner’s Guide (XWF/2E).

The tentative table of contents (TOC) starts here. For the most part, the topics listed below are general, but the content will be updated by way of the the latest version of XWF, the newest features, and a few newer innovative uses of XWF.

  • Acknowledgements
  • About the Authors
  • About the Tech Editor
  • Foreword
  • Introduction
  • Book Organization
  • Installation and Configuration
  • Case Management and Imaging
  • Interface Navigation
  • Refine Volume Snapshot
  • Internal Hash Database
  • Registry Viewer
  • Searching in X-Ways Forensics
  • X-Ways Forensics Reporting
  • X-Ways Investigator
  • X-Ways Imager
  • WinHex
  • X-Ways Forensics and Criminal Investigations
  • X-Ways Forensics and Electronic Discovery
  • Appendix A Cheats
  • Appendix B Significant updates since XWF 1E
  • Appendix C Third Party Apps

Just like the first edition, your input is welcome and encouraged! What would you like to be included in the second edition? We have a few neat sub-topics being added based on our usage and experimentation, but we’d like to hear about your unique uses as well.

X-Ways Forensics runs in the new WinFE 10


Here is the WinFE website with build instructions: www.winfe.net .

Brief overview of some details that may be helpful to know

Developed by Troy Larson of Microsoft in 2008, further developed into a GUI build (WinBuilder) by a number of developers in 2009, with a great write protect tool written by Colin Ramsden in 2012, noted in digital forensic books such as Computer Forensics InfoSec Pro Guide and Computer Forensics and Investigations , taught by FLETC , SEARCH , IACIS , and DFIR Training , documented in dozens of blogs and magazines, WinFE has become a widely accepted and commonly used digital forensics tool. And now you can boot an ARM device and image it with WinFE 10.

Windows Forensic Environment Training available

Typically, WinFE has mostly been law enforcement or association-membership only. Actually, there are no training courses outside of government training. Government training courses have been provided by IACIS, SEARCH, ICAC, NW3C, and FLETC.

The only non-government course is the Windows Forensic Environment online course created in 2014 and updated today with WinFE 10. I’m not counting YouTube videos as formal, documented training…neither should you (please do not put, “I learnt forensics on YouTube” on your court CV…). This course was created by one who has been involved in WinFE development from shortly after it’s initial inception (that’s me!).

Side note : I have a short promo of 60% off the Windows Forensic Environment course for the first 100 people.   Completing the entire course gets you 6 hours of formal, documented training, which is way better to put on your training records than watching a YouTube ‘training’ video. So, if you use WinFE, and want documented proof of training from one of the original developers, here you go!

Registration: $125

Promo code:  WINFE10 (60% off for $50)

Website: http://courses.dfironlinetraining.com/windows-forensic-environment-winfe

Promo Expires:January 31, 2020 or at the 100 th registration , whichever is first.

Hours: 6

Access: 1 month. 24/7 on demand


WinFE Cheats Guide

In a few days, you will see an updated WinFE Cheats Guide available on Amazon.com. Currently, the guide available doesn’t have the WinFE 10 information, but when you see the new cover “Includes WinFE 10” , that will be the updated guide should you wish to purchase the only book in print that focuses only on WinFE. https://www.amazon.com/Ultimate-Cheats-Windows-Forensic-Environment/dp/1790322782


X-Ways Forensics Practitioner’s Guide, Second Edition

Here’s the update, TL:DR version

The second edition will be here in 2020.

Here’s the holdup (the bad news)

Syngress (who holds the publishing rights), is not taking on any new books, nor any future editions of current books. For all practical purposes, publishing through Syngress is over for everyone. They have changed their business strategy, which means, no X-Ways Forensics Practitioner’s Guide/2E through Syngress.

And for good news

Syngress promised to transfer the rights back to me and Eric Zimmerman.  It’s been weeks since waiting for the official rights transfer, but it is coming, so I am told. I am keeping up with weekly reminders to make sure. I do not doubt the rights are coming back, and when they do, the book will be self-published.

Self-published means:

  1. Typing to print time will be 75% faster.
  2. Updates will be practically immediate
  3. Future editions, when necessary, will be just a fast
  4. The book will be exactly what we want, which is the way we think best for users

C4All X-tension update

Update November 14, 2014

Download link to version 3.6.2.d https://www.dropbox.com/s/zewn7myskf…6.2.d.zip?dl=0
This update changes the way the video stills are treated when extracting movies.
-now video stills are extracted if the parent movie is extracted, regardless of whehter
the video still has been type verified.
That is for version 3.6.2.d that fixes a few issues with C4All not handling some characters.
Videos and links to updated guides.
Steps for c4all X-tension updated November 2014.doc

Steps to prepare and run C4All X november 2014.doc

I recommend downloading both guides. ***both Udpated November 2014***

Links to Youtube videos to run X-Tension
www.youtube.com/watch?v=HP6DTzpG0KI – part 1 of 3
www.youtube.com/watch?v=zCIcrA9CldI – part 2 of 3
www.youtube.com/watch?v=53cLlcogr40 – part 3 of 3

Updates to X-tension and Hash File Manipultator

Hashbrown program 64 bit version only http://1drv.ms/1tLsNnG updated October 10 2014

instructions http://1drv.ms/XNdgeJ
-New Version that handles many duplicates and many unsorted more efficiently posted.
Update October 19 2014
download link to version 3.6.2.c http://1drv.ms/1prWU2h
-Fixed issue with extended character support of UTF-16 in XML. should show all but those 0xD800 – 0xDFFF characters.
-Adds the functions of 3.5.12.k as well as option to create a Picture/video library based on MD5 hash value as name and the option to include not confirmed files when extracting pictures and movies. (before the file had to have a type status of Confirmed or newly identified. see post from 27 September in this thread for more details)
– 3.5.12.k
option to include or not include metadata in XML
-The option to run against multiple evidence objects and better naming of folders in c4all folder tree.
-CETS users have toggle to create a CETS XML or not.

New version of X-Tension

New version of X-Tension
3.6.2.a http://1drv.ms/1rrCJ7s
-adds the functionality to create a picture/video library.
-adds the ability to extract pictures or movies that are type status of ‘not confirmed’
(this was added as there are so many variations of avi formats, that even some valid working movies were not ‘confirmed’)
If the user does not want these files, they can be filtered out and the X-Tension run excluding filtered or excluded files

C4All X-Tension for CETS users

Re-posted with permission (more info at: http://www.forensicfocus.com/Forums/viewtopic/t=11868/):

Default C4All X-Tension for CETS users

This is the same as version 3.5.12.k except adds the function to create a CETS manifest XML needed for those using CETS.

Arnold will post information for CETS users regarding changes needed to properly use the X-Tension.

C4All X-Tension CETS compatible version 3.5.13.a

For use with CETS:
1. This will provide a generic “CETS Media Manifest.xml” file

2. This generic file will not include the digital signature InvestigationID, ManifestID, or CategorizationID. However, the CategorizationID can be added manually.

3. With the CETS Media Uploader you can “re-sign” the manifest file if you use “adminmode” of the CETS Media Uploader.

To enter into Admin Mode:
1. Right Click on “CETSMediaUploader.exe”
2. Select: Sent To, Desktop (create shortcut)
3. Locate the shortcut on your desktop
4. Right Click on the shortcut and select : Properties
5. In the Target Field append to the end of the line(after the closing “): -adminmode
6. Double click the edited Short Cut

When you launch the CETS Media Uploader in Admin Mode you will a new button to “Sign Manifest” file.
Clicking on the button will bring up a dialogue window to manually select a user and the related investigation.

Keep in mind, that you must manually cut and paste your Categorization settings into the XML file.

Arnold Guerin
Canadian Police Centre for
Missing and Exploited Children.