From a twitter post, a cool video on imaging with X-Ways noted (13:50) as doing something other tools don’t. The entire video is actually pretty good too.
Author: Brett Shavers
http://www.amazon.com/author/brettshavers
https://www.brettshavers.com
https://www.dfir.training
WFA/4e
I’m duplicating this post from another blog because this will probably be the coolest book to come out this year in digital forensics and is a must-have. The short version as to why the book is a must-have is “duh, it’s Harlan’s latest book…and Windows 8…”
I’ll wait to give an “official” review of Harlan’s book (Windows Forensic Analysis Toolkit, Fourth Edition: Advanced Analysis Techniques for Windows 8) only to give others the chance to read it once it becomes available. But…I’ll say that based on my early reading as a tech editor, this is a book that ranks for me in as much anticipation as a new Tom Clancy novel being released.
I also think this is one of those books that if not pre-ordered, will have you waiting until it is reprinted due to being over-ordered. The X-Ways Practitioner’s Guide was one of those books too, where late-comers had to wait weeks for the second printing. This book is no different, because just about all of the neat things in the book show just how much Harlan has discovered in some very neat areas of Windows 8.
One thing I learned about ordering books from Amazon, is that Amazon will pretty much match the lowest price found elsewhere. I also learned that with a pre-ordered book, you can cancel before the book is printed if you find a lower price somewhere else. The point is, pre-order the book or you may be waiting a month after everyone else gets their copy…it comes out in April ’14 and I’d expect the second printing to be needed in April ’14…
Cloud Storage Forensics
I have a detailed review of this book at http://winfe.wordpress.com. In short, it’s a really good book and of all tools to choose for the research in the book, the authors picked X-Ways Forensics. But then, that should not come as any surprise.
There’s still time to ask Santa to put this in your stocking…
Cool update to the XWFIM, Portable Install
Eric is at it again. This time with a pretty cool update to the X-Ways Forensics Install Manager (v0.0.7.0). The update to the XWFIM now includes an option to create a portable install to external media. Page 13 of the Practitioner’s Guide to X-Ways Forensics details how to do this manually, but XWFIM does it for you with a few clicks.
Another cool little feature is that the XWFIM creates all the case folders for you in the process of the portable install. Neat.
Don’t forget, if you liked the Practitioner’s Guide to X-Ways Forensics, write a review on Amazon to let us know how you liked it (or if you didn’t…). And if you use XWF and didn’t buy the guide…you are missing out on more than a few tips and tricks that will save you dozens of keystrokes.
X-Ways Forensics Install Manager
I cannot imagine anyone who uses XWF not having Eric Zimmerman‘s XWFIM. Every time I use it, I wonder how I did without it. XWFIM is available through the XWF support forum. It’s free, but you need a license for XWF to get it.
Eric constantly adds little things to it, much like Stefan adds ‘little’ things to X-Ways Forensics. One of the latest little additions is the selection box to “Include pre-release versions” which is pretty cool.
And if you haven’t bought the XWF Guide yet and you use the XWFIM, just click the book’s graphic and you can have the guide on your Kindle in about 30 seconds.
X-Ways Forensics Imaging Article
In case you missed an article on X-Ways Forensics Imaging (page 40), you can download a free copy of the issue of eforensicsmag here: http://eforensicsmag.com/jumpstart-3-free/
The article is an overview of imaging with X-Ways Forensics, which is covered in more detail in the XWF Guide. If you haven’t bought the guide yet and are on the fence on whether XWF is right for you, check out the article on the one feature of imaging and I am sure you will not be on the fence anymore.
XWF Guide translations
There is a possibility that the XWF Guide may be translated into Chinese and Korean. That would be pretty cool. I can at least look at the pictures 🙂
X-PERT Certification Program
Been using X-Ways Forensics for a while now, have ya? Been to an X-Ways training class? Then consider getting certified by X-Ways as an expert (X-PERT) in XWF.
Be sure to set aside time, have your XWF Guide at your side, and dive right in. It’s a real forensics exam that if you pass, have a certificate that actually means you know what you are doing with X-Ways.
Something else cool about XWF
Consider the differences between X-Ways v12 below:
With the current version 17:
They look the same!
XWF has had literally hundreds upon hundreds of significant updates over this time between v12 and v17, but the interface and usage remains constant. Personally, I enjoy an update to a program that looks the same, the buttons are in the same place, and there are new features to use. The last thing I want is a totally different interface, buttons where I have to hunt and peck to find or miss completely, or have to take another class from the vendor to be told how to use their new fandangle program.
It’s nice to know that in 10 years, XWF will probably look the same, even though I know it will be able to do so much more then, I’ll be able to use it without skipping a beat.
This is also the reason that the XWF Guide will carry you through the next many years without having to worry about a major change in operation of XWF. What other manual or guide can say that?
Cloud Storage Forensics and XWF
I recently finished tech editing a book soon to be published on Cloud Storage Forensics. One of the main tools used was….wait for it…X-Ways Forensics. Without giving anything about the book away, I was really impressed by the level of detail documented on the amount of research conducted in cloud storage forensics.
The book goes to print in January, but available for preorder. I’ll be writing a review of the book once it is made available, but in short, I give it a high grade of technical accuracy and research on the most commonly used cloud storage services and the connected machines. The authors documented testing of various cloud services as if it were scientific examinations (which by the way, digital forensics testing is…) and their methods can be used by anyone as can their results. I’ll give a small tidbit that there are many instances of “holy smokes!” on some of their findings that I have not seen anywhere else.
The authors could have chosen any major forensic tool, but they chose XWF. This is just another example of how X-Ways Forensics is used to validate scientific theories and tests over all others. The reason is simple: XWF works.
This book, along with a few others that I know are coming out fairly soon, should be quick sellouts for the first printing. For anyone that buys books from Amazon, preordering is a good way to go and Amazon price matches books, even after you have already ordered. Just saying…
The X-Ways Forensics Practitioner's Guide/2E 