I know, this has nothing to do with X-Ways Forensics. But hey, the X-Ways Practitioner’s Guide was first…
Practically, this seems like a good book for Encase users to park on the shelf (while the X-Ways Practitioner’s Guide sits on your desk next to your keyboard).
So, when is that book on “FTK” coming out….and who is going to write it?…And if you do want to write it, give Syngress a shout.
I previously posted that a book on FTK is sure to come along, since we have the best book of X-Ways and the other book on Encase. Now comes a book on FTK. Just like the XWF Guide or the upcoming Encase guide, I wouldn’t see any reason for a FTK user to not have a book on FTK.
It makes sense to have “the” book on X-Ways, “the” book on Encase, and “the” book on FTK. By having books on your major forensic suites, it is easier to compare what suite “A” does compared to tools “B” and “C” as well as how to get from point A to B using each tool.
So….how about that book on ProDiscover? Anyone? Grab the opportunity before someone else does. I promise to buy it, as I have already ordered the FTK and Encase books.
I have brief reviews on my favorite DF books at http://winfe.wordpress.com/books/
————————————————————————–
Forensic 4cast Awards
I just saw that the book of the year nominees at the Forensic 4cast Awards include both the X-Ways Practitioner’s Guide and Placing the Suspect Behind the Keyboard. For those that made the nominations, that was very kind. For those that vote for either book, I thank you in advance.
Both books are pretty good. Each gives plenty of tips and information to save you hours of frustration, and more importantly, close some cases. There is a sample chapter of Placing the Suspect Behind the Keyboard here: http://searchsecurity.techtarget.com/feature/Placing-the-Suspect-Behind-the-Keyboard There are reviews at Amazon for both books that may be helpful if you were thinking of getting either book.
If you use X-Ways…..you need the X-Ways Guide, no matter how long you have been using X-Ways. When I asked Eric to help me write this book, he ran with it and did a super job of helping create an easy to read guide to using a very powerful forensic tool. I have more than a ton of emails of how the book converted Encase/FTK primary users into XWF primary users.
As for the Placing the Suspect Behind the Keyboard, that has also helped more than a few examiners close a case with a simple (yet elusive) tip, trick, method, or process that saves hours, if not days, of work. Again, even if you have been doing forensics for a long time, nothing says you can’t learn or relearn something you may not know or have forgotten.
Thanks again to everyone.
Brett
Don’t forget to vote for the XWF Guide at http://forensic4cast.com/2014/04/2014-forensic-4cast-awards-meet-the-nominees/. But of course, only vote if you liked it :)
And if you didn’t like it (which means you don’t have XWF…), vote for my other book, Placing the Suspect Behind the Keyboard. But again, only vote if you liked it :)
And if you didn’t like that book either…give me your phone number. We need to talk…
From a twitter post, a cool video on imaging with X-Ways noted (13:50) as doing something other tools don’t. The entire video is actually pretty good too.
Not that many years ago, you would not find a requirement of having experience with X-Ways to apply for a DFIR job. But now, some jobs recommend it and yet some others require it. This is not to say the other big players (Encase, Accessdata, etc..) are not needed or useful, just that XWF has made it to the same level at a price point that will probably not be beat with capabilities that still outpace other tools.
So……it makes sense to know a little about the tool that might put you over the edge for that next job. Of course, you need to be competent too, but like I’ve said before, “beware the examiners that use X-Ways Forensics because they probably know what they are doing.”
For the future XWF users, check out www.x-ways.net for some details, download and read a quick guide, and when you move forward with XWF, buy the book :)
The X-Ways Users Conference is here in a few weeks. My kind of conference: Australia and fellow X-Ways users!
Maybe next year for me…but it sure would make for a good vacation, I mean, training trip.
Taking WinFE to even another level on a multiboot thumbdrive. Very cool, but I spread this word to you because there are few things in life neater than a forensically bootable CD/USB with X-Ways Forensics.
I know, this has nothing to do with X-Ways Forensics. But hey, the X-Ways Practitioner’s Guide was first…
Practically, this seems like a good book for Encase users to park on the shelf (while the X-Ways Practitioner’s Guide sits on your desk next to your keyboard).
So, when is that book on “FTK” coming out….and who is going to write it?…And if you do want to write it, give Syngress a shout.
I previously posted that a book on FTK is sure to come along, since we have the best book of X-Ways and the other book on Encase. Now comes a book on FTK. Just like the XWF Guide or the upcoming Encase guide, I wouldn’t see any reason for a FTK user to not have a book on FTK.
It makes sense to have “the” book on X-Ways, “the” book on Encase, and “the” book on FTK. By having books on your major forensic suites, it is easier to compare what suite “A” does compared to tools “B” and “C” as well as how to get from point A to B using each tool.
So….how about that book on ProDiscover? Anyone? Grab the opportunity before someone else does. I promise to buy it, as I have already ordered the FTK and Encase books.
I have brief reviews on my favorite DF books at http://winfe.wordpress.com/books/
————————————————————————–
Forensic 4cast Awards
I just saw that the book of the year nominees at the Forensic 4cast Awards include both the X-Ways Practitioner’s Guide and Placing the Suspect Behind the Keyboard. For those that made the nominations, that was very kind. For those that vote for either book, I thank you in advance.
Both books are pretty good. Each gives plenty of tips and information to save you hours of frustration, and more importantly, close some cases. There is a sample chapter of Placing the Suspect Behind the Keyboard here: http://searchsecurity.techtarget.com/feature/Placing-the-Suspect-Behind-the-Keyboard There are reviews at Amazon for both books that may be helpful if you were thinking of getting either book.
If you use X-Ways…..you need the X-Ways Guide, no matter how long you have been using X-Ways. When I asked Eric to help me write this book, he ran with it and did a super job of helping create an easy to read guide to using a very powerful forensic tool. I have more than a ton of emails of how the book converted Encase/FTK primary users into XWF primary users.
As for the Placing the Suspect Behind the Keyboard, that has also helped more than a few examiners close a case with a simple (yet elusive) tip, trick, method, or process that saves hours, if not days, of work. Again, even if you have been doing forensics for a long time, nothing says you can’t learn or relearn something you may not know or have forgotten.
Thanks again to everyone.
Brett
Don’t forget to vote for the XWF Guide at http://forensic4cast.com/2014/04/2014-forensic-4cast-awards-meet-the-nominees/. But of course, only vote if you liked it :)
And if you didn’t like it (which means you don’t have XWF…), vote for my other book, Placing the Suspect Behind the Keyboard. But again, only vote if you liked it :)
And if you didn’t like that book either…give me your phone number. We need to talk…
The X-Ways Forensics Practitioner’s Guide won the Best Digital Forensics Book of the Year award at the DFIR Summit 2014 in Austin, Texas. I’d like to thank everyone who voted for the XWF Guide and hope the book has helped you in your work.
A new X-Tension, “C4All” is available for download (free) at http://www.x-ways.net/forensics/x-tensions/index.html. C4All is used to categorize pictures and videos, processing skin tone and video stills. Speeds up to 30GB min speeds on SSD drives have been observed.
If you are an X-Ways user, this is one of those cool “little” things that will make you excited.
I created an X-Ways Forensics online training course at http://courses.dfironlinetraining.com/x-ways-forensics-practitioners-guide. This course, X-Ways Forensics Practitioner’s Guide Online I is introductory to using X-Ways Forensics, but it covers more than enough to cover most of the use of X-Ways in a case.
The XWF II course goes into great detail with more information on using XWF in different scenarios and some more highly specific functions. Although the course is based on the book, it is not the book, nor is it the X-Ways Forensics classroom training. It is however, the least expensive and fastest way to get up to speed on X-Ways Forensics :)
There is a 25% discount code you can use “xwf1” that is good until July 17. Everyone that registers before July 17 receives a separate discount code of 100% for the XWF II online course that will be released as soon as this discount period ends. Both courses are the same cost, but the discount is valid only until July 17.
If you can’t attend the X-Ways AG classroom training due to cost or time, this online training fits both your pocketbook and daily schedule.
For all XWF I registrations prior to July 17, 2014, you will receive a code for 100% off the XWF II course shown below at the email you registered. The deadline to register in order to receive the 100% discount code for XWF II is July 17, 2014, after which, the course is available for purchase without a discount.
These are on-demand courses and you have lifetime access to both courses (XWF I and XWF II). There will be an XWF III course released during the summer, all who register before July 17, 2014 will receive another 100% off discount code for XWF III. So, for the purchase of XWF I by July 17, you will have lifetime access to XWF I, XWF II and XWF III.
XWF II will be released after the discount codes currently given have expired in a few weeks. The general discount code for 25% off is: xwf1
Members of HTCC, IACIS, and CTIN have received a 30% discount code in their e-mail. If you are a member and did not receive the code, check your e-mail, it should be there. If you belong to a high tech crime group not listed, contact me and I can send a 30% code to your association. Otherwise, feel free to use the 25% discount code.
I’m sure there are a few more people left to register for the X-Ways Forensics online course (XWF I) with the discount code of “xwf1″. That’s 25% off, plus includes free tuition to the X-Ways Forensics II online course. XWF I is introductory, XWF II is more indepth, quite a bit longer, and will be released in August. XWF III, a shorter course will be released sometime after August.
Everyone registering by midnight tonight (Pacific time) for XWF I, gets access to XWF II and XWF III when published without cost. Otherwise, it’s a separate tuition payment for each course. From July 18, the XWF I is back to $195, XWF II will be $299, and XWF III will be $75. Each class is lifetime access, on demand training, including updates to the courses when XWF is substantially updated (should be a course update once a year).
Details on XWF II are here: http://xwaysforensics.wordpress.com/2014/07/05/x-ways-forensics-practitioners-guide-online-ii/
Register for X-Ways Forensics Practitioner’s Guide online course here: http://courses.dfironlinetraining.com/x-ways-forensics-practitioners-guide
- Select Directory, directory-mode is atomatically activated
– Click ‘with sub-folders’ if you need recursive hashing
– Alternatively select some files, file-mode is atomatically activated
– you can switch everytime between both modes
– Choose your Entropy
– If you need to find a part of a single file use ‘one input – one output’ mode
– If you need to find a part of a bulk of files use ‘all in one’ mode
– Add ‘MD5′-Header is necessary for X-Ways Forensics
Start hashing now. A Logfile ist automatically generated.
BlockHasher is Freeware.
If you need source send mail to denny@d-forensik.de
This is the same as version 3.5.12.k except adds the function to create a CETS manifest XML needed for those using CETS.
Arnold will post information for CETS users regarding changes needed to properly use the X-Tension.
C4All X-Tension CETS compatible version 3.5.13.a
http://1drv.ms/1pajcsb
For use with CETS:
1. This will provide a generic “CETS Media Manifest.xml” file2. This generic file will not include the digital signature InvestigationID, ManifestID, or CategorizationID. However, the CategorizationID can be added manually.
3. With the CETS Media Uploader you can “re-sign” the manifest file if you use “adminmode” of the CETS Media Uploader.
To enter into Admin Mode:
1. Right Click on “CETSMediaUploader.exe”
2. Select: Sent To, Desktop (create shortcut)
3. Locate the shortcut on your desktop
4. Right Click on the shortcut and select : Properties
5. In the Target Field append to the end of the line(after the closing “): -adminmode
6. Double click the edited Short CutWhen you launch the CETS Media Uploader in Admin Mode you will a new button to “Sign Manifest” file.
Clicking on the button will bring up a dialogue window to manually select a user and the related investigation.Keep in mind, that you must manually cut and paste your Categorization settings into the XML file.
Arnold Guerin
Canadian Police Centre for
Missing and Exploited Children.
C4All X-Tension for CETS users