Industry & Professional

[v20.2] X-Ways Forensics – Integrated computer forensics software

Ⅰ This article along with all titles and tags are the original content of AppNee. All rights reserved. To repost or reproduce, you must add an explicit footnote along with the URL to this article!
Ⅱ Any manual or automated whole-website collecting/crawling behaviors are strictly prohibited.
Ⅲ Any resources shared on AppNee are limited to personal study and research only, any form of commercial behaviors are strictly prohibited. Otherwise, you may receive a variety of copyright complaints and have to deal with them by yourself.
Ⅳ Before using (especially downloading) any resources shared by AppNee, please first go to read our F.A.Q. page more or less. Otherwise, please bear all the consequences by yourself.
This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.

X-Ways Forensics is a world-renowned and comprehensive computer forensics and analysis tool for Windows, Windows Server and Windows PE/FE (Forensic Environment), developed by X-Ways Software Technology from Germany. It is mainly used for computer forensics, data recovery, underlying data processing and IT security fields, etc.

Users can use X-Ways Forensics to view and analyze all the data on a computer, and extract available evidence to restore it; make the partition containing the data to be extracted as an image to ensure data integrity and no omissions, and then add the image to the analysis interface to start querying data resources; directly preview and print various common file formats; extract the contents of Zip and RAR archives; extract the contents of emails and attachments; perform keyword searches, logical searches and index searches. It also has powerful dynamic filtering function and skin color picture detection function, and can generate HTML format report, and more.

X-Ways Forensics is actually a forensic authorized version of WinHex. It has the same interface and all functions as WinHex. The difference is that it functionally restricts the write operation to the disk, provides stronger disk and file analysis function, and adds some practical functions such as file preview and recovery of deleted files. Compared with other similar products, X-Ways Forensics takes up less resources at runtime, has high accuracy and very fast analysis data, has many features that similar software lacks, does not rely on the establishment of complex databases, and does not require cumbersome operations. In short, it enables you to no longer be affected by various other factors in the process of conducting forensic analysis.

// Key Features //

X-Ways Forensics comprises all the general and specialist features known from WinHex, such as:

  • Disk cloning and imaging
  • Ability to read partitioning and file system structures inside raw (.dd) image files, ISO, VHD, VHDX, VDI, and VMDK images
  • Complete access to disks, RAIDs, and images more than 2 TB in size (more than 232 sectors) with sector sizes up to 8 KB
  • Built-in interpretation of JBOD, RAID 0, RAID 5, RAID 5EE, and RAID 6 systems, Linux software RAIDs, Windows dynamic disks, and LVM2
  • Automatic identification of lost/deleted partitions
  • Native support for FAT12, FAT16, FAT32, exFAT, TFAT, NTFS, Ext2, Ext3, Ext4, CDFS/ISO9660/Joliet, UDF
  • Superimposition of sectors, e.g. with corrected partition tables or file system data structures to parse file systems completely despite data corruption, without altering the original disk or image
  • Access to logical memory of running processes
  • Various data recovery techniques, lightning fast and powerful file carving
  • Well maintained file header signature database based on GREP notation
  • Data interpreter, knowing 20 variable types
  • Viewing and editing binary data structures using templates
  • Hard disk cleansing to produce forensically sterile media
  • Gathering slack space, free space, inter-partition space, and generic text from drives and images
  • File and directory catalog creation for all computer media
  • Easy detection of and access to NTFS alternate data streams (ADS)
  • Mass hash calculation for files (Adler32, CRC32, MD4, ed2k, MD5, SHA-1, SHA-256, RipeMD-128, RipeMD-160, Tiger-128, Tiger-16, Tiger-192, TigerTree, …)
  • Lightning fast powerful physical and logical search capabilities for many search terms at the same time
  • Recursive view of all existing and deleted files in all subdirectories
  • Automatic coloring for the structure of FILE records in NTFS
  • Bookmarks/annotations
  • Runs under Windows FE, the forensically sound bootable Windows environment, e.g. for triage/preview, with limitations
  • Support for high DPI settings in Windows
  • Ability to analyze remote computers in conjunction with F-Response
  • and much more

// Official Demo Video //

// Edition Statement //

AppNee provides the X-Ways Forensics multilingual full installers and unlocked files, as well as portable full registered versions for Windows 32-bit and 64-bit.

// Related Links //

// Download URLs //

Version Download Size
v19.9 reserved n/a
v20.2 46.8 MB

(Homepage)

If some download link is missing, and you do need it, just please send an email (along with post link and missing link) to remind us to reupload the missing file for you. And, give us some time to respond.
If there is a password for an archive, it should be "appnee.com".
Most of the reserved downloads (including the 32-bit version) can be requested to reupload via email.