The current (and free) issue of eForensics Magazine has an article on imaging with X-Ways Forensics. Of course, the XWF Guide is more detailed, but to get an idea of some of what XWF can do with imaging, take a look at the article.
I’m in the process of creating working materials to go along with the XWF Guide in the form of exercises and test images. I expect to be finished in 2014 or 2015 or …(it all depends on time available). The materials will be freely available but will really only work best with the XWF Guide. And yes, I know I can use images already available, like at http://digitalcorpora.org/corpora/disk-images, but these datasets will be made to demonstrate all the neat things detailed in the XWF Guide.
One thing I’d like to point out regarding an issue with creating forensic images when giving images to students that contain data may violate the EULA if distributed. Files like commercial programs and operating systems. Anyone that deals with this in training will be happy with how XWF can be used to address this problem.
With the “Cleansed Image” option of XWF, simply exclude/hide any and all files that would violate any privacy concerns or EULA violations before creating the image. Then create the image 🙂
This gives you a complete (minus excluded files) disk image without worrying about violating a EULA. You could do this the hard way by using WinHex to overwrite every single file in question. Or you can mass exclude files in one fell swoop with XWF and bam. Image done. Now you have something to give out to your class.
I’ve always wondered why some instructors give out complete images of a single system and make the student “promise” not to distribute the files…that is a bit too trusting in my opinion. And come on, you know who you are…
<and I’ll leak a little information from the book on the cleansed image feature. you can use this technique to remove private/privileged/protected data from an image to comply with a court order but can’t produce specific protected data on the image. an example being a civil case where you need to turn over an image to the opposing expert but have privileged files on the image. don’t hex edit it, cleanse it!>
The XWF Guide has dozens of these kinds of tips and tricks, but you get one today for free. Get the book for the rest of the tips and tricks, you will without a doubt, find something worthwhile that will save you hours or days of work.
We’ve gotten quite a bit of personal email feedback on the XWF Guide, and in one category at Amazon (Forensic Science), the XWF Guide ranks at #2.
There’s been only one Amazon review, so let us know if you found the book helpful with a review on Amazon. We will be very grateful for nice 🙂 words, but we’ll take any criticisms as well 😦
Elsevier – Snygress has another sale, but this time it is 50% off. You have only a few days to take advantage of it (I am…). There is a limit of two books, so if you were looking for a second book to add, how about this one: http://store.elsevier.com/product.jsp?isbn=9781597499859&pagename=search
Ken Pryor wrote a very in-depth review of the XWF Guide. Ken has a very informative DF blog and we’re glad to have been mentioned in such detail. Thank you Ken for the nice review.
Check out Ken’s review at: http://digiforensics.blogspot.com/2013/09/book-review-x-ways-forensics.html
And of course, here is a direct link to order the XWF Guide…
That’s right, a free signed copy of the XWF Guide is yours, but only IF you can win the contest.
http://hackingexposedcomputerforensicsblog.blogspot.com/
On a related note, check out Eric’s interview on his ongoing imaging tests on YouTube.
And the winner is….
So far, we’ve had a lot of positive feedback on the XWF Guide, so much so, that the second edition (should that happen) will have a few added things. Like…a companion CD with sample data and slidedecks for classroom use.
However, before a second edition is started, this edition has to first be outdated by updates in XWF.
The bad news on a second edition is that we wrote the book to cover XWF for some time to come even with the expected updates that occur every month or so. That means a second edition isn’t likely until we see a major change in XWF.
The good news on a second edition is that we wrote the book to cover XWF for some time to come even with the expected updates that occur every month or so. That means this book will last you well into your expertise is solid with XWF.
For the college and university profs and instructors, we’d be glad to help review your slidedecks if you will be using the book in your course. Potentially, we may be able to create a set of slidedecks (with help from those teaching) to make available to any schools using XWF).
Not to put on any pressure, but I’ve been informed the XWF Guide is planned for reprint due to the preorder demand. For those that preordered, that was a good idea, you may have your guide by now or it’s in the mail. For those that were waiting for the book to come out first instead of preordering, you may want to hurry. I’m not sure how long it takes to reprint more books (that’s like, beyond the guys that just type the words…). Then again, you could always wait for the next go around for reprints…
Amazon still looks to have the best price, but only a few copies left before they have to order more.
**Update**
Looks like most have received their preorders, and those that waited late might have to wait again for a reprint. Direct link to Amazon – XWF Guide.
Looks like more Kindle readers than paperback readers. Then again, it’s easier to have the Kindle at your desk than a stack of books when you are fighting through hex, decoding registry values, and spilling coffee on the desk.
It certainly feels like a long time has passed, but the time is finally here, at least for the Kindle. Order through Amazon and you can have the book on your Kindle in less than a minute.
Although it feels like it took a long time (at least for me), Eric and I finished the book 6 months ahead of schedule. If you don’t have a Kindle, you can at least read the Introduction through the link below. We hope (and know) this guide will be your best friend to your XWF dongle.
The X-Ways Forensics Practitioner's Guide/2E 