Updates to X-tension and Hash File Manipultator

Hashbrown program 64 bit version only http://1drv.ms/1tLsNnG updated October 10 2014

instructions http://1drv.ms/XNdgeJ
-New Version that handles many duplicates and many unsorted more efficiently posted.
 
X-tension
Update October 19 2014
download link to version 3.6.2.c http://1drv.ms/1prWU2h
-Fixed issue with extended character support of UTF-16 in XML. should show all but those 0xD800 – 0xDFFF characters.
-Adds the functions of 3.5.12.k as well as option to create a Picture/video library based on MD5 hash value as name and the option to include not confirmed files when extracting pictures and movies. (before the file had to have a type status of Confirmed or newly identified. see post from 27 September in this thread for more details)
– 3.5.12.k
option to include or not include metadata in XML
-The option to run against multiple evidence objects and better naming of folders in c4all folder tree.
-CETS users have toggle to create a CETS XML or not.

New version of X-Tension

New version of X-Tension
3.6.2.a http://1drv.ms/1rrCJ7s
Changes
-adds the functionality to create a picture/video library.
-adds the ability to extract pictures or movies that are type status of ‘not confirmed’
(this was added as there are so many variations of avi formats, that even some valid working movies were not ‘confirmed’)
If the user does not want these files, they can be filtered out and the X-Tension run excluding filtered or excluded files

C4All X-Tension for CETS users

Re-posted with permission (more info at: http://www.forensicfocus.com/Forums/viewtopic/t=11868/):

Default C4All X-Tension for CETS users

This is the same as version 3.5.12.k except adds the function to create a CETS manifest XML needed for those using CETS.

Arnold will post information for CETS users regarding changes needed to properly use the X-Tension.

C4All X-Tension CETS compatible version 3.5.13.a
http://1drv.ms/1pajcsb

For use with CETS:
1. This will provide a generic “CETS Media Manifest.xml” file

2. This generic file will not include the digital signature InvestigationID, ManifestID, or CategorizationID. However, the CategorizationID can be added manually.

3. With the CETS Media Uploader you can “re-sign” the manifest file if you use “adminmode” of the CETS Media Uploader.

To enter into Admin Mode:
1. Right Click on “CETSMediaUploader.exe”
2. Select: Sent To, Desktop (create shortcut)
3. Locate the shortcut on your desktop
4. Right Click on the shortcut and select : Properties
5. In the Target Field append to the end of the line(after the closing “): -adminmode
6. Double click the edited Short Cut

When you launch the CETS Media Uploader in Admin Mode you will a new button to “Sign Manifest” file.
Clicking on the button will bring up a dialogue window to manually select a user and the related investigation.

Keep in mind, that you must manually cut and paste your Categorization settings into the XML file.

Arnold Guerin
Canadian Police Centre for
Missing and Exploited Children.

BlockHasher for XWF

Yet another cool XWF utility!

BlockHasher

BlockHasher helps you creating Block-HashSets for X-Ways Forensics

– Select Directory, directory-mode is atomatically activated
– Click ‘with sub-folders’ if you need recursive hashing
– Alternatively select some files, file-mode is atomatically activated
– you can switch everytime between both modes
– Choose your Entropy
– If you need to find a part of a single file use ‘one input – one output’ mode
– If you need to find a part of a bulk of files use ‘all in one’ mode
– Add ‘MD5’-Header is necessary for X-Ways Forensics

Start hashing now. A Logfile ist automatically generated.

BlockHasher is Freeware.
If you need source send mail to denny@d-forensik.de

X-Ways MD5 Hash Manipulator

Another cool utility for X-Ways!

X-Ways MD5 Hash Manipulator

hash
A program to manipulate your Hash sets from X-Ways.
It will allow you to Add hashes, Remove hashes, Compare hashes and remove the duplicates, create hash set of excluded files, and be in the proper format to quickly import to X-Ways.
This will allow users to maintain their hash sets and create small diff files if needed to distribute when hashes are added/removed from database.
It works on the basis of add or removing records, indicating duplicates and also the ‘-‘ prefix implemented in X-ways. files with ‘-‘ prefix can be anywhere in set, not at the beginning.
Thanks to X-Tension author Steve Frawley (who is also the author of the C4All X-Tension) and thanks to beta tester Derek Frawley.
instructions
file

Last day of discounted X-Ways Forensics online course

I’m sure there are a few more people left to register for the X-Ways Forensics online course (XWF I) with the discount code of “xwf1”. That’s 25% off, plus includes free tuition to the X-Ways Forensics II online course. XWF I is introductory, XWF II is more indepth, quite a bit longer, and will be released in August. XWF III, a shorter course will be released sometime after August.

Everyone registering by midnight tonight (Pacific time) for XWF I, gets access to XWF II and XWF III when published without cost. Otherwise, it’s a separate tuition payment for each course.  From July 18, the XWF I is back to $195, XWF II will be $299, and XWF III will be $75.   Each class is lifetime access, on demand training, including updates to the courses when XWF is substantially updated (should be a course update once a year).

Details on XWF II are here: https://xwaysforensics.wordpress.com/2014/07/05/x-ways-forensics-practitioners-guide-online-ii/

Register for X-Ways Forensics Practitioner’s Guide online course here:  http://courses.dfironlinetraining.com/x-ways-forensics-practitioners-guide

xwfii

New X-Tension: Up to 30GB min speeds on SSD drives!

A new X-Tension, “C4All” is available for download (free) at http://www.x-ways.net/forensics/x-tensions/index.html.  C4All is used to categorize pictures and videos, processing skin tone and video stills.  Speeds up to 30GB min speeds on SSD drives have been observed.

free css template

If you are an X-Ways user, this is one of those cool “little” things that will make you excited.

Digital Forensics Book of the Year!

The X-Ways Forensics Practitioner’s Guide won the Best Digital Forensics Book of the Year award at the DFIR Summit 2014 in Austin, Texas.  I’d like to thank everyone who voted for the XWF Guide and hope the book has helped you in your work.

  Xways-Cover

award
https://forensic4cast.com/forensic-4cast-awards/2014-results/

Vote for your favorite book

Don’t forget to vote for the XWF Guide at http://forensic4cast.com/2014/04/2014-forensic-4cast-awards-meet-the-nominees/.  But of course, only vote if you liked it 🙂

And if you didn’t like it (which means you don’t have XWF…), vote for my other book, Placing the Suspect Behind the Keyboard.  But again, only vote if you liked it 🙂

And if you didn’t like that book either…give me your phone number.  We need to talk…

Humbled and honored

4cast
Forensic 4cast Awards

I just saw that the book of the year nominees at the Forensic 4cast Awards include both the X-Ways Practitioner’s Guide and Placing the Suspect Behind the Keyboard.  For those that made the nominations, that was very kind.  For those that vote for either book, I thank you in advance.

Both books are pretty good.  Each gives plenty of tips and information to save you hours of frustration, and more importantly, close some cases.  There is a sample chapter of Placing the Suspect Behind the Keyboard here: http://searchsecurity.techtarget.com/feature/Placing-the-Suspect-Behind-the-Keyboard  There are reviews at Amazon for both books that may be helpful if you were thinking of getting either book.

If you use X-Ways…..you need the X-Ways Guide, no matter how long you have been using X-Ways.  When I asked Eric to help me write this book, he ran with it and did a super job of helping create an easy to read guide to using a very powerful forensic tool.  I have more than a ton of emails of how the book converted Encase/FTK primary users into XWF primary users.

As for the Placing the Suspect Behind the Keyboard, that has also helped more than a few examiners close a case with a simple (yet elusive) tip, trick, method, or process that saves hours, if not days, of work.  Again, even if you have been doing forensics for a long time, nothing says you can’t learn or relearn something you may not know or have forgotten.

Thanks again to everyone.

Brett

 

%d bloggers like this: