…are a little late coming out due to an emergency…but will be published soon.  sorry for the delay.

New version of X-Tension
3.6.2.a http://1drv.ms/1rrCJ7s
Changes
-adds the functionality to create a picture/video library.
-adds the ability to extract pictures or movies that are type status of ‘not confirmed’
(this was added as there are so many variations of avi formats, that even some valid working movies were not ‘confirmed’)
If the user does not want these files, they can be filtered out and the X-Tension run excluding filtered or excluded files

Hashbrown program 64 bit version only http://1drv.ms/1tLsNnG updated October 10 2014

Update November 14, 2014

Here’s the update, TL:DR version

The second edition will be here in 2020.

Here’s the holdup (the bad news)

Syngress (who holds the publishing rights), is not taking on any new books, nor any future editions of current books. For all practical purposes, publishing through Syngress is over for everyone. They have changed their business strategy, which means, no X-Ways Forensics Practitioner’s Guide/2E through Syngress.

And for good news

Syngress promised to transfer the rights back to me and Eric Zimmerman.  It’s been weeks since waiting for the official rights transfer, but it is coming, so I am told. I am keeping up with weekly reminders to make sure. I do not doubt the rights are coming back, and when they do, the book will be self-published.

Self-published means:

1. Typing to print time will be 75% faster.
2. Updates will be practically immediate
3. Future editions, when necessary, will be just a fast
4. The book will be exactly what we want, which is the way we think best for users

TL:DR

Here is the WinFE website with build instructions: www.winfe.net .

Brief overview of some details that may be helpful to know

Developed by Troy Larson of Microsoft in 2008, further developed into a GUI build (WinBuilder) by a number of developers in 2009, with a great write protect tool written by Colin Ramsden in 2012, noted in digital forensic books such as Computer Forensics InfoSec Pro Guide and Computer Forensics and Investigations , taught by FLETC , SEARCH , IACIS , and DFIR Training , documented in dozens of blogs and magazines, WinFE has become a widely accepted and commonly used digital forensics tool. And now you can boot an ARM device and image it with WinFE 10.

Windows Forensic Environment Training available

Typically, WinFE has mostly been law enforcement or association-membership only. Actually, there are no training courses outside of government training. Government training courses have been provided by IACIS, SEARCH, ICAC, NW3C, and FLETC.

The only non-government course is the Windows Forensic Environment online course created in 2014 and updated today with WinFE 10. I’m not counting YouTube videos as formal, documented training…neither should you (please do not put, “I learnt forensics on YouTube” on your court CV…). This course was created by one who has been involved in WinFE development from shortly after it’s initial inception (that’s me!).

Side note : I have a short promo of 60% off the Windows Forensic Environment course for the first 100 people.   Completing the entire course gets you 6 hours of formal, documented training, which is way better to put on your training records than watching a YouTube ‘training’ video. So, if you use WinFE, and want documented proof of training from one of the original developers, here you go!

Registration: $125

Promo code:  WINFE10 (60% off for $50)

Website: http://courses.dfironlinetraining.com/windows-forensic-environment-winfe

Promo Expires:January 31, 2020 or at the 100 ^th registration , whichever is first.

Hours: 6

Access: 1 month. 24/7 on demand

WinFE Cheats Guide

In a few days, you will see an updated WinFE Cheats Guide available on Amazon.com. Currently, the guide available doesn’t have the WinFE 10 information, but when you see the new cover “Includes WinFE 10” , that will be the updated guide should you wish to purchase the only book in print that focuses only on WinFE. https://www.amazon.com/Ultimate-Cheats-Windows-Forensic-Environment/dp/1790322782

The ball has begun to roll forward on the 2nd edition of the X-Ways Forensics Practitioner’s Guide (XWF/2E).

The tentative table of contents (TOC) starts here. For the most part, the topics listed below are general, but the content will be updated by way of the the latest version of XWF, the newest features, and a few newer innovative uses of XWF.

• Acknowledgements
• About the Authors
• About the Tech Editor
• Foreword
• Introduction
• Book Organization
• Installation and Configuration
• Case Management and Imaging
• Interface Navigation
• Refine Volume Snapshot
• Internal Hash Database
• Registry Viewer
• Searching in X-Ways Forensics
• X-Ways Forensics Reporting
• X-Ways Investigator
• X-Ways Imager
• WinHex
• X-Ways Forensics and Criminal Investigations
• X-Ways Forensics and Electronic Discovery
• Appendix A Cheats
• Appendix B Significant updates since XWF 1E
• Appendix C Third Party Apps

Just like the first edition, your input is welcome and encouraged! What would you like to be included in the second edition? We have a few neat sub-topics being added based on our usage and experimentation, but we’d like to hear about your unique uses as well.

Syngress released the rights of the X-Ways Forensics Practitioner’s Guide this week!  This allows Eric and me to write and control all future editions of the book, which we will now be getting started.

What can you expect from the new edition?

1. Updated content (of course, the latest version of X-Ways!)
2. Innovative methods of use
3. More 3rd party tool integrations (commercial and FOSS)
4. Work processes and case-specific methods
5. New cover design
6. And just as important, your suggestions

When can you expect the new edition?

2020. This year. Not next year. Not the year after. Since Eric and I control the rights and publishing, it will be on our schedule, not a publishers schedule.

Table of Contents

We will keep the table of contents (TOC) updated here: https://xwaysforensics.wordpress.com/the-manual-s/

Expect the TOC to change with new (ie, better) ideas and suggestions. Do you have an idea for the book? What you would like to see us cover? Or maybe you have an X-Tension script you would like us to add in the book? Or maybe you created a new way to use XWF for a process that you’d like to share and be credited for? How do you use XWF with your other tools?

Send it and we’ll consider it for the new edition!

A short note on Syngress..

I’ve received several dozen emails from XWF users asking for a second edition, and through this time, have been asking Syngress (who owned the rights of the book) for an updated edition for years. Each time, the Syngress response had been “maybe later” or something to that effect.

Apparently during these past few years, Syngress had been working to change their business model, which meant no new DFIR books and no new editions of current books. You should not expect any more forensic books being published through Syngress. I don’t know the details other than new DFIR books through Syngress won’t happen. I have enjoyed having my books published through Syngress, but like anything, things change.

Putting together an AWESOME group of contributors for the X-Ways Forensics Practitioner’s Guide/2E.  Just wait until you see the line up from some of the most competent users of X-Ways Forensics and respected members of the forensic community!

Do you have an interesting or cool X-Ways Forensics story to tell?

Comment below with your story and you could end up in the book! What kind of story? If you have any case or instance where XWF made your day, made your case, or surprised you in doing something, then that is the kind of story we are looking for.

There are so many “x” ways to use X-Ways Forensics that we’d like to showcase different ways that users have been doing for the past years or even from yesterday. Your “x” way may be better than another way, or maybe just different. We want to know and maybe put you in the book!

Chapters are being finalized. Tech editing is happening. Cover design is done.

XWF/2E is almost here!

Looks like the second edition of the X-Ways Forensics Practitioner’s Guide will be a go!

Here’s the update, TL:DR version

The second edition will be here in 2020.

Here’s the holdup (the bad news)

Syngress (who holds the publishing rights), is not taking on any new books, nor any future editions of current books. For all practical purposes, publishing through Syngress is over for everyone. They have changed their business strategy, which means, no X-Ways Forensics Practitioner’s Guide/2E through Syngress.

And for good news

Syngress promised to transfer the rights back to me and Eric Zimmerman.  It’s been weeks since waiting for the official rights transfer, but it is coming, so I am told. I am keeping up with weekly reminders to make sure. I do not doubt the rights are coming back, and when they do, the book will be self-published.

Self-published means:

1. Typing to print time will be 75% faster.
2. Updates will be practically immediate
3. Future editions, when necessary, will be just a fast
4. The book will be exactly what we want, which is the way we think best for users

TL:DR

Here is the WinFE website with build instructions: www.winfe.net .

Brief overview of some details that may be helpful to know

Developed by Troy Larson of Microsoft in 2008, further developed into a GUI build (WinBuilder) by a number of developers in 2009, with a great write protect tool written by Colin Ramsden in 2012, noted in digital forensic books such as Computer Forensics InfoSec Pro Guide and Computer Forensics and Investigations , taught by FLETC , SEARCH , IACIS , and DFIR Training , documented in dozens of blogs and magazines, WinFE has become a widely accepted and commonly used digital forensics tool. And now you can boot an ARM device and image it with WinFE 10.

Windows Forensic Environment Training available

Typically, WinFE has mostly been law enforcement or association-membership only. Actually, there are no training courses outside of government training. Government training courses have been provided by IACIS, SEARCH, ICAC, NW3C, and FLETC.

The only non-government course is the Windows Forensic Environment online course created in 2014 and updated today with WinFE 10. I’m not counting YouTube videos as formal, documented training…neither should you (please do not put, “I learnt forensics on YouTube” on your court CV…). This course was created by one who has been involved in WinFE development from shortly after it’s initial inception (that’s me!).

Side note : I have a short promo of 60% off the Windows Forensic Environment course for the first 100 people.   Completing the entire course gets you 6 hours of formal, documented training, which is way better to put on your training records than watching a YouTube ‘training’ video. So, if you use WinFE, and want documented proof of training from one of the original developers, here you go!

Registration: $125

Promo code:  WINFE10 (60% off for $50)

Website: http://courses.dfironlinetraining.com/windows-forensic-environment-winfe

Promo Expires:January 31, 2020 or at the 100 ^th registration , whichever is first.

Hours: 6

Access: 1 month. 24/7 on demand

WinFE Cheats Guide

In a few days, you will see an updated WinFE Cheats Guide available on Amazon.com. Currently, the guide available doesn’t have the WinFE 10 information, but when you see the new cover “Includes WinFE 10” , that will be the updated guide should you wish to purchase the only book in print that focuses only on WinFE. https://www.amazon.com/Ultimate-Cheats-Windows-Forensic-Environment/dp/1790322782

The ball has begun to roll forward on the 2nd edition of the X-Ways Forensics Practitioner’s Guide (XWF/2E).

The tentative table of contents (TOC) starts here. For the most part, the topics listed below are general, but the content will be updated by way of the the latest version of XWF, the newest features, and a few newer innovative uses of XWF.

• Acknowledgements
• About the Authors
• About the Tech Editor
• Foreword
• Introduction
• Book Organization
• Installation and Configuration
• Case Management and Imaging
• Interface Navigation
• Refine Volume Snapshot
• Internal Hash Database
• Registry Viewer
• Searching in X-Ways Forensics
• X-Ways Forensics Reporting
• X-Ways Investigator
• X-Ways Imager
• WinHex
• X-Ways Forensics and Criminal Investigations
• X-Ways Forensics and Electronic Discovery
• Appendix A Cheats
• Appendix B Significant updates since XWF 1E
• Appendix C Third Party Apps

Just like the first edition, your input is welcome and encouraged! What would you like to be included in the second edition? We have a few neat sub-topics being added based on our usage and experimentation, but we’d like to hear about your unique uses as well.

Syngress released the rights of the X-Ways Forensics Practitioner’s Guide this week!  This allows Eric and me to write and control all future editions of the book, which we will now be getting started.

What can you expect from the new edition?

1. Updated content (of course, the latest version of X-Ways!)
2. Innovative methods of use
3. More 3rd party tool integrations (commercial and FOSS)
4. Work processes and case-specific methods
5. New cover design
6. And just as important, your suggestions

When can you expect the new edition?

2020. This year. Not next year. Not the year after. Since Eric and I control the rights and publishing, it will be on our schedule, not a publishers schedule.

Table of Contents

We will keep the table of contents (TOC) updated here: https://xwaysforensics.wordpress.com/the-manual-s/

Expect the TOC to change with new (ie, better) ideas and suggestions. Do you have an idea for the book? What you would like to see us cover? Or maybe you have an X-Tension script you would like us to add in the book? Or maybe you created a new way to use XWF for a process that you’d like to share and be credited for? How do you use XWF with your other tools?

Send it and we’ll consider it for the new edition!

[contact-form]

A short note on Syngress..

I’ve received several dozen emails from XWF users asking for a second edition, and through this time, have been asking Syngress (who owned the rights of the book) for an updated edition for years. Each time, the Syngress response had been “maybe later” or something to that effect.

Apparently during these past few years, Syngress had been working to change their business model, which meant no new DFIR books and no new editions of current books. You should not expect any more forensic books being published through Syngress. I don’t know the details other than new DFIR books through Syngress won’t happen. I have enjoyed having my books published through Syngress, but like anything, things change.

Putting together an AWESOME group of contributors for the X-Ways Forensics Practitioner’s Guide/2E.  Just wait until you see the line up from some of the most competent users of X-Ways Forensics and respected members of the forensic community!

Do you have an interesting or cool X-Ways Forensics story to tell?

Comment below with your story and you could end up in the book! What kind of story? If you have any case or instance where XWF made your day, made your case, or surprised you in doing something, then that is the kind of story we are looking for.

There are so many “x” ways to use X-Ways Forensics that we’d like to showcase different ways that users have been doing for the past years or even from yesterday. Your “x” way may be better than another way, or maybe just different. We want to know and maybe put you in the book!

Chapters are being finalized. Tech editing is happening. Cover design is done.

XWF/2E is almost here!

Yes, finally. After a hiatus due to life and death, it is time to wrap up the book in a nice bow, and give an updated XWF Practitioner’s Guide online course.

No excuses on being late, as it is what it is. But now back to getting this done. Here is the time schedule:

Feb 1, 2022: The start of a live, online X-Ways Forensics Practitioner’s Guide course. You can register here with a $200 discount ($795 $595). There are only 15 seats left as of today.

https://courses.dfir.training/offers/g2PKupVP/checkout?coupon_code=XWFLIVE200

The course includes two books (USA/Canada shipping only).

(1) The X-Ways Forensics Practitioner’s Guide, Second Edition, and

(2) Ultimate DFIR Cheats! X-Ways Forensics.

On March 1, 2022, the live course will end and a recorded version will be published in mid-March. The recorded version will be $1100. If you register for the live course, you’ll have a few extra weeks to also view the recorded course in case you miss any sessions or want to review.

I do things a little differently…

The XWF book is not the manual. Not even close. It also does not teach forensics, but it does show you what you need to know to work XWF. The Cheats guide goes into some of the undocumented features and tips on use.

The XWF Practitioner’s Guide course is also not the X-Ways Forensics course provided by X-Ways. The practitioner’s course is different. The course is designed to get you from zero to XWF HERO in the shortest amount of time, with no fluff or unnecessary stuff. Ie, hit this button to do this. Hit that button to do that. Right click when hovering here and left click when hovering there.

I don’t believe in teaching “push button forensics”, but when forensic software is being taught, that is actually the most important to know – where is the button to push!?!

As one example, below is a one-page guide on all the ways to add evidence in XWF. I remember the days of v3 of a software from years back, where I could not find how to add a raw image. The manual was the size of a Tom Clancy novel and I had not had training in that software at the time. It took me an hour to figure out how to get that raw image added by asking someone to show me. There was absolutely nothing in the interface that outwardly showed how to add a raw image. Adding another type of image was easy, just push the button. But the raw image required some right and left clicks to get there.

So with XWF, this is similar in that the interface is difficult to figure out. The manual is tough as well. The training is expensive. And spending hours to figure out wastes resources. If you are govt, spending hours trying to figure something out means that you are not moving forward in that case. In the private sector, it means loss of billing hours.

XWF is not a one-tool-does-it-all kind of forensic software. But it is a this-is-the-only-tool that does what other tools do not. In the practitioner’s course, and in the upcoming practitioner’s book, 3rd party tool integration is included, as are comments that another tool may be better than XWF in specific instances.

Live XWF Course note:

Only 3 spots left! If you want to be one of the three, you can register here (this link takes $200 off the registration price!): https://courses.dfir.training/offers/g2PKupVP/checkout?coupon_code=XWFLIVE200>

About X-Ways Forensics being difficult to use

Graeme Horsman’s latest paper on “Who is the digital forensic expert and what is their expertise?” gives an amazing simple method that you can should use when qualifying for expertise.  I posted a follow up blog post to his paper here:  https://www.dfir.training/blog/you-are-proably-an-expert-but-just-not-accepting-it-yet as it relates to tool training.

There are so many issues in certifications, degrees, formal training, informal training, and practice when it comes to having credibility in tool proficiency. All of these issues involve money, time, and availability. X-Ways Forensics is no different than any other DFIR tool as it relates to needing training for user credibility.

When you have thousands or tens of thousands of dollars in software/hardware tools, and then add up the costs of being trained in all of them, you can quickly reach all of your annual salary just for training. This is unrealistic.  So we pick and choose what we can, and then try to get as much as possible.

My thoughts on training as it applies to X-Ways Forensics

X-Ways Forensics is hard. Today’s forensic suites have moved into easy-to-use dashboards that automate almost everything. This is awesome as it is as close to ‘push-button forensics’ as we have ever had in the past. Yes, you still have to know forensics and yes, there is still analysis that is not automated. The point is that X-Ways Forensics is not push-button forensics.

On the other end of forensic dashboards and push-button forensics is the deep diving, data carving, bits and bytes visibility of everything tool that is known as X-Ways Forensics.  I believe that we truly need the automated tools and to compliment our ability AND we need X-Ways Forensics or a similar type of tool to do the most thorough job.

Yes, I am an X-Ways Forensics evangelist

For any DFIR tool that I use or test, if it does what it says it does and does what I need it to do, I will always be an advocate for it.  Although XWF is one of those tools, there are others. There are two reasons that I will recommend particular DFIR tools.

1. I want the community to use it to make sure that it is a ‘community accepted tool’
2. I want the developer to keep making it better for my needs

Using any tool that is not ‘community accepted’ means that it might not be a good tool (defective), could be discontinued at any time, and creates a difficult time in court for me to testify that the tool is good even though the DFIR community doesn’t support or use it.

I was a WinHex user way back, and when X-Ways Forensics was first released a decade ago, I felt better that a “forensic” version of WinHex was available. BUT IT WAS NEW!  No one really heard about it, everyone was still using WinHex as their forensic app.  Even FLETC was only teaching WinHex and not XWF. Not that I had anything to do with it at the time, but I brought my own license to FLETC BCERT (now taught as NCFI BCERT) and asked “Yo, why not teach XWF too?”

Given the limited number of users of XWF, the continued use WinHex as the forensic tool, and no training existing at the time, a friend of mine and I asked X-Ways if they would create a course so that we could host it in the US. So, the first X-Ways course happened in Seattle, I helped get some fortune 500 companies and a fortune 50 company to get on board with XWF licenses, wrote a book on it with Eric Zimmerman, and I created courses taught a little differently than the X-Ways AG course. 

And now the second edition of the practitioner’s should be in print in March 2022, along with a new, live course that I am starting on Feb 1, 2022 (which includes the ondemand version afterward).  There are still (only) 3 spots left…

https://courses.dfir.training/offers/g2PKupVP/checkout?coupon_code=XWFLIVE200

My intention to give alternative XWF training is to have more options to training that may be too expensive or unavailable due to time or distance, in order for more examiners to be trained. They also can have some formalized and documented training in a tool that is difficult to figure out, as well as checking the box if ever asked on the stand or a job interview of, “Have you ever had formal training in X-Ways Forensics?” This directly leads to more XWF users, which leads to X-Ways being able to further developer XWF, which leads to more users, which leads to…

….community acceptance and continued development because of community use.