The book launch might have only a few hours left..

I planned a certain number of books that I thought would last 100 hours. I miscalculated by about 48 hours.

With that, the 100-hour book launch looks like it might be over by tomorrow morning or lunchtime. There are a few orders to work out shipping and purchases, and after that, only a few books left that I planned to offer for the launch.

Don’t worry if you didn’t make this launch as the book will be on Amazon and everywhere else in a week or two. I’ll be sure to put the link here and elsewhere.

Now….getting ready to ship some books!

Book launch process & updates

The good:

99% of all orders have had no problems.

The not so good:

Maybe 1% of the orders have had a little bit of problems, but nothing that can’t be fixed.

a) orders were not calculated correctly (undercharged, fault of the system, but easy to remedy)

b) some countries not listed (don’t worry; I’m checking on shipping to these countries that were not listed)

The good and not-so-good, depending on how you look at it

The number of books set aside for the launch are almost gone. This is good to see that XWF users want the book, but not-so-good if someone waits until the last minute to order, since the launch is looking like to be over before the 100 hours is done. An unlimited number will be available from, Barnes & Noble, etc…soon enough.


PayPal has been working, but comments against PayPal have been made. I am also not a fan of PayPal, but for payment processors, PayPal has a major chunk of the market. For the book launch, PayPal it is…

But, for anyone not wanting to use PayPal for the book launch, no worries! The launch is almost over and then the book will be available on and other book seller sites to order from there. This is just a discounted launch, same book, just different pricing when the launch is over.

Still haven’t ordered but thinking about it?

Might want to hurry if you want to grab the book now with the launch discount. Otherwise, you’ll have to wait and order retail price online at



Book Launch is live!

Aaannnnnddddd, the 100-hour countdown clock has started. Let’s see how long this batch of books last.

USA orders

Non-USA orders

This is the first (proof) copy and all looks good! Purchased copies don’t have the “Not for Resale” banner.

Unlike the first edition from prior publisher, this book is in COLOR!

Bonuses for Book Launch Buyers

#1 Access to XWF-related downloads (quickstart guides, tooltips, etc…)

#2 “If” a Kindle version will be released, which would be at the end of this year if that happens, all early bird, book launch buyers will receive the Kindle version free. Plus, the Kindle version will not be available outside of this group, since this is a bonus for the book launch. This could change many ways to Sunday, but that is the current intention.

THE X-Ways Forensics Practitioner’s Guide is complete!


There will be an XWF/2E Book Launch happening in a few days. today (4/24/22)!

The book will be $20 off ($49.99 instead of $69.99) and includes free shipping in the USA (outside the USA is available, but not free).

(1) The book launch will be for ONLY 100 hours

(2) There is only a limited number of books for the book launch.

When the books are gone or when the 100 hours are up, the book launch will be closed.

If you want to be notified via email when the book launch begins, add your email to the notification list here:   I WANT IN ON THE 100-HOUR BOOK LAUNCH!

Some more detail:

This book took some serious time and effort!  But it was so worth it.  There are over 400 pages in the second edition, which is about 150 pages more compared with the first edition.

The XWF dialog windows are more fully detailed visually as are the checkboxes and tri-state checkboxes. There are a dozen contributors who gave their war stories or workflow processes in how they use XWF.  You are getting the perspective of many from one book. The combined experience with XWF is probably more than a century given the contributors experience.

The first edition of the X-Ways Forensics Practitioner’s Guide was good.  Good enough to win forensic book of the year. But now, that book is outdated. It has been many years since the first edition, and XWF has had many hundreds of updates to render the first edition useless for any practical sense.

This second edition of the Practitioner’s Guide focuses on XWF v20.5 and should be a great resource for the next years in exploiting X-Ways Forensics to your maximum ability. I tend to believe that the chance that I can fully push XWF to its maximum ability is low since my personal limits are less than what XWF can do. It is good to have that gap as a goal to increase personal skills rather than have a software application that limits your abilities.

XWF/2E Book Launch

For the XWF/2E book launch, I will have some XWF-related downloads available, but only for those who make it into the book launch. After the book launch is over (either 100 hours or when the limited number of books are sold), XWF/2E will be available for purchase everywhere you usually find books.


I’ll cover USA shipping. For international shipping, there will be a charge, but you will be able to have the book shipped to you.

After the book launch, free shipping will be over.

$20 discounted special

At over 400 pages and quite a bit of information, this book will be listed at $69.99. But for those who really want to get into the book faster, the XWF/2E book launch gets you $20.00 off the retail price.

This is not a pre-order

I will never do a pre-order again. Ever. I jumped the gun on that previous pre-order, resulting in refunding everyone rather than hold onto money for the book. I apologize again to those who ordered and were refunded…my intention was to ship out those books as a bonus of being first.

From now, no orders until the book is in my hand. Or in the store. That was too much stress.

Electronic versions

For the foreseeable future, there will be no electronic version available. If/when this happens, it will be most likely a Kindle ebook in 2023. Until then, an ebook might be made available in the practitioner’s guide online course. If this happens, then all updates to the book will most likely be free to these students from the course.

Future “versions” of the X-Ways Forensics Practitioner’s Guide

Speaking of updates to the the guide…the first edition was published by Syngress, but this second edition is self-published. This may not mean much, but here is the biggest point that affects XWF users: I can update this book whenever I see fit (as in, when XWF is substantially updated, I can update this book on-the-fly).  With books printed by a publisher, updates might not ever happen due to the way the publishing industry operates.  With self-publishing, I can update a page or entire chapters, upload a new version of the book, and note it as such.

So you will most likely see in the future:

X-Ways Forensics Practitioner’s Guide, Second Edition, Revision 1

X-Ways Forensics Practitioner’s Guide, Second Edition, Revision 2

X-Ways Forensics Practitioner’s Guide, Third Edition


This was only made possible by taking back ownership of this book from the publisher, which was not an easy or simple task. Nor was it quick. It took YEARS. But now, here we are and I’ll update the book as needed, including revisions and corrections on the fly.

Bonus Material

For the XWF Practitioner’s Guide Book Launch buyers, you will have a bonus offer that is not available to anyone else. Plus some XWF-related downloads that you will be given access to some XWF-related downloads.

To make sure you have a chance at the book launch, submit your email for a reminder here:   I WANT IN ON THE 100-HOUR BOOK LAUNCH!

The X-Ways Forensics Practitioner’s Guide/2E OnDemand Course is ONLINE NOW! Sign up today!

Sign ups are open now.




30 day access.

Register here: SIGN UP

Note to current DFIR Training subscribers (you know who you are!). You have access to the course as a subscriber already 🙂

Righted the rights!

Syngress released the rights of the X-Ways Forensics Practitioner’s Guide this week!  This allows Eric and me to write and control all future editions of the book, which we will now be getting started.



What can you expect from the new edition?

  1. Updated content (of course, the latest version of X-Ways!)
  2. Innovative methods of use
  3. More 3rd party tool integrations (commercial and FOSS)
  4. Work processes and case-specific methods
  5. New cover design
  6. And just as important, your suggestions 🙂

When can you expect the new edition?

2020. This year. Not next year. Not the year after. Since Eric and I control the rights and publishing, it will be on our schedule, not a publishers schedule.

Table of Contents

We will keep the table of contents (TOC) updated here:

Expect the TOC to change with new (ie, better) ideas and suggestions. Do you have an idea for the book? What you would like to see us cover? Or maybe you have an X-Tension script you would like us to add in the book? Or maybe you created a new way to use XWF for a process that you’d like to share and be credited for? How do you use XWF with your other tools?

Send it and we’ll consider it for the new edition!

A short note on Syngress..

I’ve received several dozen emails from XWF users asking for a second edition, and through this time, have been asking Syngress (who owned the rights of the book) for an updated edition for years. Each time, the Syngress response had been “maybe later” or something to that effect.

Apparently during these past few years, Syngress had been working to change their business model, which meant no new DFIR books and no new editions of current books. You should not expect any more forensic books being published through Syngress. I don’t know the details other than new DFIR books through Syngress won’t happen. I have enjoyed having my books published through Syngress, but like anything, things change.



X-Ways Forensics runs in the new WinFE 10


Here is the WinFE website with build instructions: .

Brief overview of some details that may be helpful to know

Developed by Troy Larson of Microsoft in 2008, further developed into a GUI build (WinBuilder) by a number of developers in 2009, with a great write protect tool written by Colin Ramsden in 2012, noted in digital forensic books such as Computer Forensics InfoSec Pro Guide and Computer Forensics and Investigations , taught by FLETC , SEARCH , IACIS , and DFIR Training , documented in dozens of blogs and magazines, WinFE has become a widely accepted and commonly used digital forensics tool. And now you can boot an ARM device and image it with WinFE 10.

Windows Forensic Environment Training available

Typically, WinFE has mostly been law enforcement or association-membership only. Actually, there are no training courses outside of government training. Government training courses have been provided by IACIS, SEARCH, ICAC, NW3C, and FLETC.

The only non-government course is the Windows Forensic Environment online course created in 2014 and updated today with WinFE 10. I’m not counting YouTube videos as formal, documented training…neither should you (please do not put, “I learnt forensics on YouTube” on your court CV…). This course was created by one who has been involved in WinFE development from shortly after it’s initial inception (that’s me!).

Side note : I have a short promo of 60% off the Windows Forensic Environment course for the first 100 people.   Completing the entire course gets you 6 hours of formal, documented training, which is way better to put on your training records than watching a YouTube ‘training’ video. So, if you use WinFE, and want documented proof of training from one of the original developers, here you go!

Registration: $125

Promo code:  WINFE10 (60% off for $50)


Promo Expires:January 31, 2020 or at the 100 th registration , whichever is first.

Hours: 6

Access: 1 month. 24/7 on demand


WinFE Cheats Guide

In a few days, you will see an updated WinFE Cheats Guide available on Currently, the guide available doesn’t have the WinFE 10 information, but when you see the new cover “Includes WinFE 10” , that will be the updated guide should you wish to purchase the only book in print that focuses only on WinFE.


X-Ways Forensics Practitioner’s Guide, Second Edition

Here’s the update, TL:DR version

The second edition will be here in 2020.

Here’s the holdup (the bad news)

Syngress (who holds the publishing rights), is not taking on any new books, nor any future editions of current books. For all practical purposes, publishing through Syngress is over for everyone. They have changed their business strategy, which means, no X-Ways Forensics Practitioner’s Guide/2E through Syngress.

And for good news

Syngress promised to transfer the rights back to me and Eric Zimmerman.  It’s been weeks since waiting for the official rights transfer, but it is coming, so I am told. I am keeping up with weekly reminders to make sure. I do not doubt the rights are coming back, and when they do, the book will be self-published.

Self-published means:

  1. Typing to print time will be 75% faster.
  2. Updates will be practically immediate
  3. Future editions, when necessary, will be just a fast
  4. The book will be exactly what we want, which is the way we think best for users

C4All X-tension update

Update November 14, 2014

Download link to version 3.6.2.d…
This update changes the way the video stills are treated when extracting movies.
-now video stills are extracted if the parent movie is extracted, regardless of whehter
the video still has been type verified.
That is for version 3.6.2.d that fixes a few issues with C4All not handling some characters.
Videos and links to updated guides.
Steps for c4all X-tension updated November 2014.doc…4.doc?dl=0

Steps to prepare and run C4All X november 2014.doc…4.doc?dl=0

I recommend downloading both guides. ***both Udpated November 2014***

Links to Youtube videos to run X-Tension – part 1 of 3 – part 2 of 3 – part 3 of 3

%d bloggers like this: