SAT31
Gold Member | Редактировать | Профиль | Сообщение | Цитировать | Сообщить модератору
What's new?
* Calendar mode now represents all timestamps from all 6 timestamp columns of the regular directory browser (instead of just 3) for all listed files (instead of only selected files). The darker the gray color in the calendar for a day, the more timestamps on that day. Hovering the mouse cursor over a day in the calendar tells you the number of timestamps that fall on that day. Left-clicking on a day sets that day as the left boundary for the combined timestamp filter. Right-clicking on a day sets that day as the right boundary. Middle-clicking on a day hones in on that particular day only. If the same file is listed more than once (which can happen in a search hit list if it contains more than 1 search hit), then its timestamps are also represented more than once in the calendar.
* For event lists, Calendar mode now shows the number of events on each day (all events that are currently listed) using different shades of gray (the darker, the more events on that day). That allows you to quickly figure out when there was most activity and when there was no activity. Hovering the mouse cursor over a day in the calendar tells you the number of events on that day. Left-clicking on a day sets that day as the left boundary for the event timestamp filter. Right-clicking on a day sets that day as the right boundary. Middle-clicking on a day filter for that particular day only.
* If the corresponding timestamp filter is active, years are printed in blue in Calendar mode to remind you of the filter. To turn off the filter as always click the blue filter symbol in the caption line of the directory browser.
* Event timestamps from FAT file systems are now output adequately. They are not translated to local time and do not show more precision than they actually have.
* Timestamps in the normal directory browser that meet the timestamp filter condition are now highlighted. Timestamps in an event list that are identical to the event timestamp are now also highlighted.
* Better support for high DPI settings in Windows (larger than 125, non-XP style scaling), display no longer blurred. Still settings in the 100-125 range are recommended.
* Ability to create report table associations for files based on search terms that they contain. Useful if you wish to keep the information about which file contains which search terms even after deleting search hits, or to preserve it in evidence file containers. Report tables representing contained search terms are the 3rd kind of report tables, the first two being report tables created by X-Ways Forensics to make the user aware of certain file specialities and user-created general purpose report tables. Report tables representing search terms are recognized in evidence file containers by v17.3 and later.
* Ability to automatically associate siblings of selected files with report tables. Useful for example when reviewing search hits, if you find a relevant search hit in the attachment of an e-mail message and want to be sure to include other attachments of the same e-mail message in further processing, even if they do not contain search hits.
* Gallery display accelerated and flickering avoided in certain situations.
* Gallery thumbnails remain visible when proceeding to the next page until replaced by the new thumbnails of the next page, and can usually still be double-clicked. Useful if you still spot a potentially relevant picture after having pressed Page Dn or rolled the mouse wheel too early.
* Progress shown in taskbar in Windows 7 and later.
* Relative progress displayed when indexing large files and in some other situations.
* Includes hardlinks of the same file in containers of the new file format even if they have the same name.
* When copying selected files to an evidence file container, reports how many files were selected in addition to the number of files that were actually copied, for reasons of convenience. If all selected files were copied, that will be pointed out by the word "all". Previously the number of selected files could only be seen in the selection statistics below the directory browser.
* New flag "W" (upper case) supported in File Type Header Signatures Check Only.txt", which identifies header signatures that are too weak to newly detect the type of a file and are merely used to confirm the type suggested by the name extension of the file.
* X-Ways Forensics now remembers the sort criteria and the "Group files and directories" option separately
1) for the normal directory browser of a volume,
2) for the normal directory browser of a partitioned disk,
3) for search hit lists and
4) for event lists.
* Whole word searches now work for words in Western European languages in UTF-16 BE.
* The virtual "Free space" file is now shown in gray if the "net free space computation" option is active, as a reminder of the fact that it does not represent the entire free space when opened.
* Clickable offsets in the HTML representation of Windows .evtx event logs.
* The presence of a file named winhex.nouser in the installation directory forces a generic (not user-specific) configuration. Useful for example for portable use on an external USB hard disk, to avoid that you will inadvertently use an existing user-specific configuration on the same system when executing X-Ways Forensics. For more information about storing configurations please see http://www.x-ways.net/winhex/setup.html. |
