X-Ways Forensics will not investigate for you. It’s a scalpel for artifacts and can show you artifacts all day long but can’t tell you what they mean in your case.
If you want a headstart on the 3rd edition of X-Ways Forensics Practitioner’s Guide, the theme of the 3rd edition is the core theme of PSBK CASEWORK – working a case.
PSBK CASEWORK is not teaching X-Ways Forensics (but it may come up briefly). This is a real-time, full case workup where you make the decisions on case direction.
This isn’t a scenario on how to “investigate” a database or prefetch or registry or malware. It is an IMMERSION-BASED case in which you must solve it using everything you know about DF/IR.
Then you present it.
That which you don’t know, you will learn and see in action.
X-Ways Forensics gets the artifacts for you. PSBK CASEWORK teaches you to effectively put those artifacts into use.
X-Ways Forensics is the tool. PSBK CASEWORK is the discipline.
https://www.suspectbehindthekeyboard.com/psbk-casework
Oh yeah. I’ll give you a complimentary copy of Placing the Suspect Behind the Keyboard, DF/IR Investigative Strategies (Vol 3), and sign it for you (shipping details on the registration).
The X-Ways Forensics Practitioner's Guide/2E 