FYI, I am going to mark up your book.

Yes, if you win the drawing, you get a free copy of the X-Ways Forensics Practitioner’s Guide/Second Edition. But be aware, I will be marking it up.

This is what I will be doing to your book.

I’m going to sign it (not a major deal..just my signature).

Then I’m going to write a personal note to you and sign that note.

Then I’m going to highlight one passage that means the most to me in the book that you might like to see. And I’ll sign that highlighted passage too, just to put my name on what I believe in.

So, you won’t be getting a pristine book, but rather a personalized XWF book that is unique among the thousands of other copies out there.

A challenge to you

I have given away a bunch of books over the past years as part of a DFIR Book Challenge. This is a continuation of that challenge. I paused this challenge with the lockdowns since no one was going anywhere, but now we are free to travel. I have another book to giveaway next month and will be buying more books asking those authors to sign in the same manner. The author will sign and highlight, then I will, then I will give the books away in the challenge.

Here is the challenge:

Read the book. Learn from it. And then give it away.

But before giving it away, write something personal to the person who you are giving it to. Then highlight a passage that was meaningful to you, and sign that. And ask the person you give the book to do the same.

Do this at a training event, or your workplace, or where ever you meet DFIR folks.

This book will be the only X-Ways/2E book that I sign with a personal statement and highlighted passage, and passed to someone that I challenge to carry on. If you do this, it will be the only XWF/2E book signed by the writer, then the next reader, and the next reader, and…


This is an ice-breaker to engaging people. Did you ever wonder what to say to someone that you wanted to speak to at a conference? How about, “Hey, someone gave me a DFIR book signed by the author in a book challenge to pass on? I would like you to have it next if you’d be so kind.”

Now you engaged. Now there is conversation with someone that is positive and fruitful. Now your name is in the list of readers of the book that passed from the author to another and hopefully another and hopefully another.

You will also see what others feel are important in the book that you have in your hand. This is priceless insight of other DFIRers.


Free to enter. Free to win and free shipping too!

Enter by September 25, 2022 as the drawing will be on September 26, 2022.

Enter here:

NOTE!! After entering your name and email, you do not have to create an account. Just ignore the screen asking you to create an account.

Giving away 1 signed copy of the X-Ways Forensics Practitioner’s Guide/2E

Free to enter. Free to win and free shipping too!

Enter by September 25, 2022 as the drawing will be on September 26, 2022.

Enter here:

NOTE!! After entering your name and email, you do not have to create an account. Just ignore the screen asking you to create an account.

Getting bang for your buck

This is why I wrote this book.

Every purchase of nearly everything that I make must answer one simple question: “Is this worth the money?”

For personal items, this is an easy question to answer. If my car needs gas, the answer is always “Yes” because I need to drive my car!

For work items, this question needs a little reflection. For example, when I evaluate a need any DFIR tool (hardware, software, books, training, education), I want to know:

(1) Do I really need it or can I use what I already have, or

(2) will this tool make me more money net in billing, or

(3) will this tool save me time, or

(4) will this tool reduce mistakes.

And that is where the X-Ways Forensics Practitioner’s Guide, Second Edition comes in.

If there is one chapter, or one paragraph in the book that can save you a gross amount of time or prevent making errors or help be more effective with X-Ways Forensics than if you didn’t read it, then the value of the book is equivalent to that amount of benefit.

Sometimes, it is difficult to recognize value in our tools. We tend to look at the dollar sign for a conference or software and complain (silently or not-so-silently) that everything is too expensive or should be free. Practically, however, if taking a $5,000 training course allows you to work on cases where you might be billing $10,000 to $50,000 PER CASE, then $5,000 is a great investment.

I look at books the same way. If I can spend a few minutes a day reading and find something that can save me days of effort, or prevent mistakes that cost me days of re-doing work or embarrassment, then that book cost was worth it. Even if the book sits on a shelf until needed, I plan on using every tool at my disposal just so my expenses can be turned into investments.

Perhaps, especially if you are new to X-Ways Forensics, this book is worth 100x its price.

And that is why this book exists.

Don’t buy the (wrong) X-Ways Practitioner’s Guide

Short PSA.

There are two X-Ways Forensics Practitioner’s Guides. One is the outdated first edition and the second is the newly released second edition.

  1. First edition: Outdated. Still being sold by some sellers.
  2. Second edition: Current edition. Only sold via Amazon and no electronic versions.

The first edition is maybe still 25% relevant as so much has changed in X-Ways. The second edition is 100% relevant and current.

There is a reduced price by Amazon for the second edition. Take advantage of that now before it goes back to retail price.

I only post this because someone just bought the wrong book and asked me for an exchange, but I can’t because I am not selling the first edition and don’t have any control over sales of that book. Sorry…

Amazon Reviews of X-Ways Forensics Practitioner’s Guide/Second Edition

This is the first review, and I am sincerely appreciative!

Any and all reviews are encouraged and welcomed, even if they are critical (so that I can do better next time).

Amazon lowered the price of the X-Ways Forensics Practitioner’s Guide?!?

The X-Ways Forensics Practitioner’s Guide WAS listed on Amazon at $69.99.

Today, it is NOW listed at $51.62.

Today I learned that Amazon raises or lowers the prices of books as they see fit, without asking or informing the authors, and this happens to most books. This is out of control of the authors.

A little annoying since Amazon doesn’t even give a notification of price changes. But it is what it is.

Per Amazon:

The good news is that if you have not yet bought your copy, this is probably a good time since Amazon lowered the price. I don’t know when or if the price will go lower or go back to retail price, and I have absolutely no control over the price now (a new learning experience with Amazon KDP).

The early order shipping stories

Out of all the orders, there were:

  • 4 bad print copies (blurred, smeared ink) – all replaced
  • 5 damaged books in transit – all replaced
  • 10 VERY late deliveries (some of these are still enroute by Amazon!)
  • 3 few “double deliveries” (same book, delivered twice…).
  • 2 deliveries to the wrong address (written address was correct, delivery was wrong).
  • Many delivered in days. Others in weeks.
  • Amazon delivered about 75% of the books, but…
  • Amazon gave about 10% of the books to USPS for delivery. This added weeks of shipping time.
  • The remainder were given to third-party carriers (some I have never heard of…) and this added weeks to shipping time.

A word about “Other Sellers” on Amazon

There aren’t any other sellers (yet) for the XWF Practitioner’s Guide. The guide will be on Barnes and Noble and bookstores sooner (or later), but there is only one publisher for this book (the publisher is Amazon).

I bring this up because around 2 years ago, I was getting complaints on the 1st edition of the X-Ways Practitioner’s Guide about the “order of the chapters and pages”. The complaints were saying that the pages and chapters need to be reordered, and I replied each time with “Well, that is the way the book was written.”

However, after a few of those complaints, someone explained that the pagers were literally out of order (1, 2, 99, 34, 45, etc…) and that someone had taken an ebook copy or scanned a print book, and then uploaded the PDF to Amazon in their own account to sell as “Other Sellers.” Unfortunately for everyone who bought the pirated book, the pages were out of order and the buyers were scammed with fake, pirated, and unusable books.

This is just a personal note to be aware of the “Other sellers” of the same product of anything on Amazon.

“By the book”

Quick note because there were more than a few requests to create a course that ran alongside the XWF book, like a textbook course, I’ll make it.

Here it comes…

If you already bought a book, you can take a discount off the price. If you posted a photo of your book online somewhere, you can take another discount off the price. If you work in govt, or you are a student, or teach students, or the owner of a business, you can take even more of a discount.

If you are subscribing to DFIR Training as an “all-in” subscriber, the course will be free to you. If you just bought an XWF course from DFIR Training and still active, this course is free to you.

Access will be for 6 months. Plenty of time to go through the book a few dozen times, and be refreshed with the ondemand course as much as you need.

The XWF Guide is Worldwide!

To those who ordered, thank you! I hope that the XWF Practitioner’s Guide/2E will serve you well now and in the future with your X-Ways Forensics work.

Direct link to purchase on Amazon:

If there is just one thing that you find in the book that helps to resolve a case by finding something that you would not have found otherwise, or find an artifact faster than you would have, or resolve a case that would have taken longer or maybe never been able to close, then the book was worth every written word.

My guess is that the biggest benefit you will have with this guide is that the one thing will be many things and those are the kind of things that will save you frustration and time. Hours saved and errors prevented are worth much more than the cost of a class, a book, or the time spent talking DFIR over coffee.

The XWF Manual

I have nothing against the XWF manual as it does what it does, but it doesn’t show you how to use X-Ways Forensics. That is where the XWF Practitioner’s Guide fills in. I wrote this guide in the manner that I would want to read how to use a complex software application, and how I think other XWF users want to read as well.

I am grateful to everyone who has already bought a copy, and happy to see the social media posts on book deliveries. My apologies for the timeliness (or rather, lack thereof) by Amazon and some delivery carriers in getting the books delivered.

Again, use the book well! Write in it! Highlight it! Dog-ear pages! Put it to good use because when you do, that is an indication of you exploiting X-Ways Forensics to its fullest. Books are created to be used to better your life and/or work, not admired on a shelf.

More XWF Users and Fewer Support Issues

A selfish goal that I have when recommending forensic tools is that if more in the DFIR community use the tools that I use, the better for me because of community acceptance and peer review. I don’t want to use a tool that no one else uses because that makes it a little more difficult to explain in cases as a using a community accepted tool.

There are plenty of XWF users, for sure. But just like I recommend other tools that are already community accepted, I continue to advocate for the best tools. Regarding this book, I would expect more ‘new’ users of XWF, more renewal of licenses that were expired (because too much frustration to learn/use), and fewer support issues (so that X-Ways AG can focus on more features, which is another selfish goal of mine…).

Of course, I say that these are my “selfish” goals, but truly, we all benefit when we can peer review good tools and advocate for their use, development, and improvement for all of our benefit.

Side Note on “Other” Forensic tools

Let not this book nor my advocacy for this book, X-Ways Forensics, or any one tool mean that I am a one-tool examiner. XWF is one tool of many great tools that I use and that I recommend. You will never hear me disparage a good tool, or say that you should only use one tool. You will hear me advocate many great tools, and XWF is just one of them.


If you find this guide to be of benefit, an Amazon review would be good to see feedback. And as difficult as it is to read, not-so-good reviews with suggestions are helpful to me as well so that I can do better.

Some of the social media posts

These are all so super cool to see. I’m hoping that I am following every account that posted a picture, or will be following 🙂

I’ll add to this post every time that I see a book picture posted.

%d bloggers like this: