X-Ways Utilities

BlockHasher

BlockHasher helps you creating Block-HashSets for X-Ways Forensics

– Select Directory, directory-mode is atomatically activated
– Click ‘with sub-folders’ if you need recursive hashing
– Alternatively select some files, file-mode is atomatically activated
– you can switch everytime between both modes
– Choose your Entropy
– If you need to find a part of a single file use ‘one input – one output’ mode
– If you need to find a part of a bulk of files use ‘all in one’ mode
– Add ‘MD5’-Header is necessary for X-Ways Forensics

Start hashing now. A Logfile ist automatically generated.

BlockHasher is Freeware.
If you need source send mail to denny@d-forensik.de

———————————————————————

X-Ways MD5 Hash Manipulator

hash
A program to manipulate your Hash sets from X-Ways.
It will allow you to Add hashes, Remove hashes, Compare hashes and remove the duplicates, create hash set of excluded files, and be in the proper format to quickly import to X-Ways.
This will allow users to maintain their hash sets and create small diff files if needed to distribute when hashes are added/removed from database.
It works on the basis of add or removing records, indicating duplicates and also the ‘-‘ prefix implemented in X-ways. files with ‘-‘ prefix can be anywhere in set, not at the beginning.
Thanks to X-Tension author Steve Frawley (who is also the author of the C4All X-Tension) and thanks to beta tester Derek Frawley.
instructions
file

———————————————————————

X-Ways Forensics Installation Manager (XWFIM)

http://www.winhex.net/  (registered XWF users only)

———————————————————————

XWFIM

—————————

X-Ways Forensics Report Tweaker (XWFRT)

https://code.google.com/p/dfir-apps/downloads/list

externalitem1

————————————————————————————————

Magnet Forensics, TSV to TLN Converter

Magnet Forensics provides a FREE tool at http://info.magnetforensics.com/tsv-to-tln-converter, which converts the X-Ways generated TSV file into the TLN format.  From the tutorial, this looks to be pretty neat and you can’t beat the price either.

Magnet

The tutorial on how to use the TSV to TLN Converter can be found at: http://www.magnetforensics.com/convert-x-ways-tsv-data-into-tln-data-for-ief-timeline/

————————————————————————————————

dmares

From Dan Mares, http://www.dmares.com

http://www.dmares.com/maresware/html/X-Ways_meta_processing.htm

—————————————————————————————–

gaijin1

http://www.gaijin.at/en/xwfreportstyler.php

gaijin

Cool tools from http://www.gaijin.at/en/xtmultifilefinder.php

hash

http://www.gaijin.at/en/dladdhash.php

—————————————————————————————

Want to write your own XWF Script?  Then check this out!

chttps://github.com/chadgough/x-tensions


	

4 thoughts on “X-Ways Utilities”

  1. Hi, there might be something wrong with WXFRT binary. It doesn’t start on x64, but on 386 system it runs command prompt ant that is all. Black window… Could you check it?

    1. Hello!

      I just ran XWFRT version 4.10 from the dropbox link and it worked as expected on x64 windows 8. do you have another machine you can try?

  2. Hi,

    you were right. I don’t know why, but XWFRT has downloaded several times just some 100kb (Save as…). At first I thought this is the reason (comparing also to the size of XWFIM), but when it was the same several times, I abandoned this reason. Today I clicked on the link to open DB site and downloaded the file using the Download button and it worked OK:-) Thx!

    Maybe just one suggestion. Could you publish the size of the file and some hash value on this page so we wouldn’t have such basic problems?

    BTW: I’m using x64 W7.

  3. Great application, thanks for sharing. The ability to add in External Files was just what I was looking for.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: