X-Way Forensics: Integrated Computer Forensics Software
X-Way Forensics is an advanced work environment for computer forensic examiners. It provides a strong, compositive environment of forensic and analysis. It comprises all the general and specialist features known from WinHex, also it has more powerful functions:
It provides a function formidable, the synthesis evidence collection, the analysis environment, is also called the WinHex law card version
Disk cloning and imaging, even under DOS with X-Ways Replica (forensically sound)
Examining the complete directory structure inside raw (.dd) image files, even spanned over several segments
Native support for FAT, NTFS, Ext2/3/4, CDFS, UDF
Built-in interpretation of RAID 0 and RAID 5 systems and dynamic disks
Complete access to disks, RAIDs, and images more than 2 TB in size (more than 232 sectors)
Viewing and dumping physical RAM and the virtual memory of running processes
Various data recovery techniques and file carving
File header signature database, based on flexible GREP notation
Hard disk cleansing to produce forensically sterile media
Gathering slack space, free space, inter-partition space, and generic text from drives and images
File and directory catalog creation for all computer media
Easy detection of and access to NTFS alternate data streams (ADS), even where other programs fail
Mass hash calculation for files (CRC32, MD5, SHA-1, SHA-256, …)
Unlike a competing product, does not depend exclusively on MD5 (collisions in MD5)
Powerful physical and logical search capabilities for many search terms at the same time
Recursive view of all existing and deleted files in all subdirectories
Automatic coloring for the structure of FILE records in NTFS
Bookmarks/annotations
Bates-numbering files