X-Ways Forensics 20.5 SR 1 Portable [Latest]

FULL INFO BELOW:

X-Ways Forensics - X-Ways Forensics Portable is an advanced work environment for computer forensic examiners and our flagship product. Compared to its competitors, X-Ways Forensics is more efficient to use after a while, by far not as resource-hungry, often runs much faster, finds deleted files and search hits that the competitors will miss, offers many features that the others lack, as a German product is potentially more trustworthy, comes at a fraction of the cost, does not have any ridiculous hardware requirements, does not depend on setting up a complex database, etc.! X-Ways Forensics is fully portable and runs off a USB stick on any given Windows system without installation if you want. Downloads and installs within seconds (just a few MB in size, not GB). X-Ways Forensics is based on the WinHex hex and disk editor and part of an efficient workflow model where computer forensic examiners share data and collaborate with investigators that use X-Ways Investigator.


Features

? Disk cloning and imaging

? Ability to read partitioning and file system structures inside raw (.dd) image files, ISO, VHD and VMDK images

? Complete access to disks, RAIDs, and images more than 2 TB in size (more than 232 sectors) with sector sizes up to 8 KB

? Built-in interpretation of JBOD, RAID 0, RAID 5, RAID 5EE, and RAID 6 systems, Linux software RAIDs, Windows dynamic disks, and LVM2

? Automatic identification of lost/deleted partitions

? Native support for FAT12, FAT16, FAT32, exFAT, TFAT, NTFS, Ext2, Ext3, Ext4, Next3?, CDFS/ISO9660/Joliet, UDF

? Superimposition of sectors, e.g. with corrected partition tables or file system data structures to parse file systems completely despite data corruption, without altering the original disk or image

? Access to logical memory of running processes

? Various data recovery techniques, lightning fast and powerful file carving

? Well maintained file header signature database based on GREP notation

? Data interpreter, knowing 20 variable types

? Viewing and editing binary data structures using templates

? Hard disk cleansing to produce forensically sterile media

? Gathering slack space, free space, inter-partition space, and generic text from drives and images

? File and directory catalog creation for all computer media

? Easy detection of and access to NTFS alternate data streams (ADS)

? Mass hash calculation for files (Adler32, CRC32, MD4, ed2k, MD5, SHA-1, SHA-256, RipeMD-128, RipeMD-160, Tiger-128, Tiger-16, Tiger-192, TigerTree, ...)

? Lightning fast powerful physical and logical search capabilities for many search terms at the same time

? Recursive view of all existing and deleted files in all subdirectories

? Automatic coloring for the structure of FILE records in NTFS

? Bookmarks/annotations

? Runs under Windows FE, the forensically sound bootable Windows environment, e.g. for triage/preview, with limitations

? Support for high DPI settings in Windows

? Ability to analyze remote computers in conjunction with F-Response

? more...
Download

X.Ways.Forensics.20.5.SR.1..Portable.rar - 61.9 MB