Syngress released the rights of the X-Ways Forensics Practitioner’s Guide this week! This allows Eric and me to write and control all future editions of the book, which we will now be getting started.
What can you expect from the new edition?
- Updated content (of course, the latest version of X-Ways!)
- Innovative methods of use
- More 3rd party tool integrations (commercial and FOSS)
- Work processes and case-specific methods
- New cover design
- And just as important, your suggestions 🙂
When can you expect the new edition?
2020. This year. Not next year. Not the year after. Since Eric and I control the rights and publishing, it will be on our schedule, not a publishers schedule.
Table of Contents
We will keep the table of contents (TOC) updated here: https://xwaysforensics.wordpress.com/the-manual-s/
Expect the TOC to change with new (ie, better) ideas and suggestions. Do you have an idea for the book? What you would like to see us cover? Or maybe you have an X-Tension script you would like us to add in the book? Or maybe you created a new way to use XWF for a process that you’d like to share and be credited for? How do you use XWF with your other tools?
Send it and we’ll consider it for the new edition!
A short note on Syngress..
I’ve received several dozen emails from XWF users asking for a second edition, and through this time, have been asking Syngress (who owned the rights of the book) for an updated edition for years. Each time, the Syngress response had been “maybe later” or something to that effect.
Apparently during these past few years, Syngress had been working to change their business model, which meant no new DFIR books and no new editions of current books. You should not expect any more forensic books being published through Syngress. I don’t know the details other than new DFIR books through Syngress won’t happen. I have enjoyed having my books published through Syngress, but like anything, things change.
Update November 14, 2014
Download link to version 3.6.2.d https://www.dropbox.com/s/zewn7myskf…6.2.d.zip?dl=0
This update changes the way the video stills are treated when extracting movies.
-now video stills are extracted if the parent movie is extracted, regardless of whehter
the video still has been type verified.
That is for version 3.6.2.d that fixes a few issues with C4All not handling some characters.
Videos and links to updated guides.
Hashbrown program 64 bit version only http://1drv.ms/1tLsNnG updated October 10 2014
-New Version that handles many duplicates and many unsorted more efficiently posted.
Update October 19 2014
download link to version 3.6.2.c http://1drv.ms/1prWU2h
-Fixed issue with extended character support of UTF-16 in XML. should show all but those 0xD800 – 0xDFFF characters.
-Adds the functions of 3.5.12.k as well as option to create a Picture/video library based on MD5 hash value as name and the option to include not confirmed files when extracting pictures and movies. (before the file had to have a type status of Confirmed or newly identified. see post from 27 September in this thread for more details)
option to include or not include metadata in XML
-The option to run against multiple evidence objects and better naming of folders in c4all folder tree.
-CETS users have toggle to create a CETS XML or not.
New version of X-Tension
-adds the functionality to create a picture/video library.
-adds the ability to extract pictures or movies that are type status of ‘not confirmed’
(this was added as there are so many variations of avi formats, that even some valid working movies were not ‘confirmed’)
If the user does not want these files, they can be filtered out and the X-Tension run excluding filtered or excluded files
Another cool utility for X-Ways!
X-Ways MD5 Hash Manipulator
A program to manipulate your Hash sets from X-Ways.
It will allow you to Add hashes, Remove hashes, Compare hashes and remove the duplicates, create hash set of excluded files, and be in the proper format to quickly import to X-Ways.
This will allow users to maintain their hash sets and create small diff files if needed to distribute when hashes are added/removed from database.
It works on the basis of add or removing records, indicating duplicates and also the ‘-‘ prefix implemented in X-ways. files with ‘-‘ prefix can be anywhere in set, not at the beginning.
Thanks to X-Tension author Steve Frawley (who is also the author of the C4All X-Tension) and thanks to beta tester Derek Frawley.
I’m sure there are a few more people left to register for the X-Ways Forensics online course (XWF I) with the discount code of “xwf1”. That’s 25% off, plus includes free tuition to the X-Ways Forensics II online course. XWF I is introductory, XWF II is more indepth, quite a bit longer, and will be released in August. XWF III, a shorter course will be released sometime after August.
Everyone registering by midnight tonight (Pacific time) for XWF I, gets access to XWF II and XWF III when published without cost. Otherwise, it’s a separate tuition payment for each course. From July 18, the XWF I is back to $195, XWF II will be $299, and XWF III will be $75. Each class is lifetime access, on demand training, including updates to the courses when XWF is substantially updated (should be a course update once a year).
Details on XWF II are here: https://xwaysforensics.wordpress.com/2014/07/05/x-ways-forensics-practitioners-guide-online-ii/
Register for X-Ways Forensics Practitioner’s Guide online course here: http://courses.dfironlinetraining.com/x-ways-forensics-practitioners-guide
A new X-Tension, “C4All” is available for download (free) at http://www.x-ways.net/forensics/x-tensions/index.html. C4All is used to categorize pictures and videos, processing skin tone and video stills. Speeds up to 30GB min speeds on SSD drives have been observed.
If you are an X-Ways user, this is one of those cool “little” things that will make you excited.