X-Ways Forensics comprises all the general and specialist features known from WinHex, such as...

  • Disk cloning and imaging
  • Ability to read partitioning and file system structures inside raw (.dd) image files, ISO, VHD, VHDX, VDI, and VMDK images
  • Complete access to disks, RAIDs, and images more than 2 TB in size (more than 232 sectors) with sector sizes up to 8 KB
  • Built-in interpretation of JBOD, RAID 0, RAID 5, RAID 5EE, and RAID 6 systems, Linux software RAIDs, Windows dynamic disks, and LVM2
  • Automatic identification of lost/deleted partitions
  • Native support for FAT12, FAT16, FAT32, exFAT, TFAT, NTFS, Ext2, Ext3, Ext4, Next3®, CDFS/ISO9660/Joliet, UDF
  • Superimposition of sectors, e.g. with corrected partition tables or file system data structures to parse file systems completely despite data corruption, without altering the original disk or image
  • Access to logical memory of running processes
  • Various data recovery techniques, lightning fast and powerful file carving
  • Well maintained file header signature database based on GREP notation
  • Data interpreter, knowing 20 variable types
  • Viewing and editing binary data structures using templates
  • Hard disk cleansing to produce forensically sterile media
  • Gathering slack space, free space, inter-partition space, and generic text from drives and images
  • File and directory catalog creation for all computer media
  • Easy detection of and access to NTFS alternate data streams (ADS)
  • Mass hash calculation for files (Adler32, CRC32, MD4, ed2k, MD5, SHA-1, SHA-256, RipeMD-128, RipeMD-160, Tiger-128, Tiger-16, Tiger-192, TigerTree, ...)
  • Lightning fast powerful physical and logical search capabilities for many search terms at the same time
  • Recursive view of all existing and deleted files in all subdirectories
  • Automatic coloring for the structure of FILE records in NTFS
  • Bookmarks/annotations
  • Runs under Windows FE, the forensically sound bootable Windows environment, e.g. for triage/preview, with limitations
  • Support for high DPI settings in Windows
  • Ability to analyze remote computers in conjunction with F-Response
  • and more

X-Ways Forensics



    Thanks for submitting!