* Support for the exFAT file system. (requires a specialist license or higher)

* Ability to interpret dynamic Virtual PC VHD images. (requires a specialist license or higher) Such images can also be edited (in WinHex, not X-Ways Forenscis), but not expanded.

* Ability to interpret .e01 evidence files with an internal chunk size of up to 256 KB (previously up to 128 KB). Useful for example for memory dumps created by other software.

* Old versions of files that are found as part of the thorough file system data structure search in volume shadow copies are now marked as (SC) in the Attribute column and can be filtered. The old contents of old versions of large files will be correctly represented in a future release. The file system level metadata of old versions and the contents of small files are already usually correctly represented.

* Old names/paths of renamed/moved files in NTFS as discovered by the thorough file system data structure search are now by default no longer listed as additional items in the volume snapshot and in the directory browser. Instead, they are mentioned as comments that are attached to the renamed/moved files. This keeps directory browser listings smaller and makes searches quicker than before.

* The Simultaneous Search now supports case-insensitive searches generally, not just for English and German letters.

* GREP expressions may now contain true Unicode characters, and it is now possible to search in specific code pages when using GREP syntax.

* The most important MS Office 2007/2010 and OpenOffice 2/3 document types are now by default decoded for the logical search, and (in conjunction with the recommended data reduction) their main XML files are omitted from the search. That ensures that you get search hits in the documents and not in the XML files, which is more convenient, and that you don't get them twice unnecessarily. The other XML files, which may contain important metadata, are still searched (provided that you have included the contents of archives in the volume snapshot).

* Metadata extraction improved for Windows 7 .lnk files.

* Catalogs of JumpList files are now output in Details mode.

* Ability to recursively delete directory with subdirectories that cannot be deleted with Windows Explorer or other Windows tools and commands because of illegal characters, via Tools | File Tools | Delete recursively.

* Improved behavior when encountering already running instances. A new middle state allows to decide on a case-by-case basis whether to start another instance.

* There is now an option to filter by internal ID. Useful for example and very easy to use if you would like to focus on the x files that were added to the volume snapshot last or if you would like to resume a logical search with internal ID y (and filter out files that have already been searched).

* Introduced an interface that allows to copy files of a certain category from selected evidence objects to a user-defined output directory for analysis by a certain external program. The external program can then identify relevant files or classify files. The result can imported back into the case and will be shown as report table associations, by which you can filter or create reports. The interface works at the case level and requires a forensic license or X-Ways Investigator.

* Through this interface, using the upcoming professional version of the software DoublePics (www.dotnetfabrik.de) and a database of pictures from previous cases as often maintained by law enforcement agencies that have to deal with child pornography cases, it is possible to conveniently and automatically categorize pictures in new cases that are known already, as relevant or irrelevant or "gray area" or whatever. Known pictures can be recognized even if they are stored in a different file format, resized, if the colors or the quality are different or they have been edited, thanks to fuzzy logic and adjustable sensitivity and tolerance.

* When using the non-MAPI method to extract e-mails from PST/OST archives, HTML e-mails are now also usually represented in .eml format (except for outgoing/sent messages). Additionally, a clickable link to the attachments is now included in Preview mode (except for outgoing/sent messages, and not guaranteed to work if attachments have non-English names).

* Fixed an exception error that could occur when taking a volume snapshot.

* Previous limitations for writing sectors in partitioned areas under Windows Vista/7 have been practically removed. In 99% of all cases it is now possible to write sectors in these Windows versions.

* Some minor improvements.

* "NOT" option for the file type filter.

* Better processing of some unusual FAT volume layouts.

* Fixed an exception error that could occur when opening certain FAT volumes.

* Improved PDF metadata extraction for certain PDF generators.

* Slight improvements for registry report.

* Polish translation of user interface (still being tested).

* Fixed an exception error that could occur when generating the registry report.

* Fixed e-mail extraction path problem of v15.7 SR-4.

* Better prepared to work with new viewer component version.

* The filename filter is now optionally case-sensitive.

* GREP expressions used for the filename filter may now contain true Unicode characters (e.g. Chinese) and may now use the ^ anchor.

* An error was fixed in the filename filter that affected v15.7 when GREP syntax was used.

* Fixed line breaks in .eml files produced from OST/PST with the non-MAPI method in SR-3 and later.

* Some minor improvements.

* Ability to internally reconstruct JBOD, i.e. virtually concatenate spanned physical disks (or images of physical disks), via the menu command Specialist | Reconstruct RAID System. Requires a specialist license or higher.

* Recover/Copy: Ability to group existing and deleted files even when not recreating the original path. Forensic license only.

* Recover/Copy: Ability to group files by other parameters such as file type, category, description, sender, owner, hash set, hash category, report table association. Forensic license only.

* Recover/Copy: The single-character suffix that is used to name output folders for child objects of files (distinguish them from the name of the parent files, avoid name conflicts) is now user-definable. It can also be disabled to return to the behavior of v15.5 and earlier, where the words " child objects" were appended. Forensic license only.

* Recover/Copy no longer recreates the original Windows attributes when copying files because hidden and system attributes often make it unnecessarily complicated to see the output files.

* For e-mail extracted by v15.8, you can now see in the Attribute column if an e-mail message is marked as unread. Forensic license only.

* Revised ability to filter for e-mail messages via the Attr. column. Note that the additional e-mail properties by which you can filter are combined with a logical AND, not OR, as otherwise common within the Attr. filter. Forensic license only.

* The number of files that are contained in a directory or in evidence objects (recursively) is now optionally displayed in the directory tree and in the directory browser directly following the directory name, in parentheses. This allows you to easily find directories or evidence objects/partitions that contain most files. A file count is also provided for files that have child objects. File counts are also presented in a new directory browser column, which is sortable. Forensic license only.

Comments about this new feature and its visual presentation are welcome (e.g. color, preference to display 0 file counts or not, ...)

* Numeric columns in the directory browser such as 1st sector, skin color percentage, internal ID etc. are now right-aligned.

* If recursive selection statistics are enabled, in the directory browser X-Ways Forensics now shows as the size of a directory the total size of all the files directly or indirectly contained in that directory, not the size of the data structures of the directory any more. Comments about this new feature are welcome. The recursive selection statistics now exclude the size of the data structures of the directories themselves.

* The recursive selection statistics are now considerably faster to compute for directories on large volume snapshots.

* It is now possible to monitor lengthy operations in X-Ways Forensics from other computers in the same network, i.e. see whether they are still ongoing or completed. In General Options you can enable progress notifications via text files (that can be created in a directory on a network drive) and via e-mail in user-defined intervals. Forensic license only.

* Detection of eCryptfs-encrypted files (files stored by the Enterprise Cryptographic FileSystem for Linux). Based on material provided by Ted Smith and implementations for Ubuntu 8.10, 9.04, 9.10 and 10.04. Such files will by marked with E in the Attributes column, just like EFS-encrypted files in NTFS, but only after the encryption test has been run. Forensic license only.

* New default directory for cases under Windows Vista and 7 if X-Ways Forensics has been installed with the setup program.

* Several minor improvements.

* Sent e-mails in PST/OST archives are now extracted as .eml files by the non-MAPI extraction method, too, and their timestamps are now shown in the timestamp columns.

* Outlook calendar entries, contacts, notes, and tasks will now also be shown with timestamps.

* GPS module timestamps and coordinates are now extracted from JPEG files that contain them.

* Certain deleted files that are found during the particularly thorough file system data structure search in NTFS volumes can now be represented with correct contents even if they are fragmented and their FILE records are not available any more.

* The category filter popup menu has a tentatively introduced gimmick that allows to see statistics about the categories of the files currently listed.

* Some minor improvements, e.g. in file type detection.

* Outlook journal entries are now better represented.

* Comments in zip archives will be extracted by the metadata extraction.

* Zip archives that contain hidden files will now be flagged with a report table association.

* Recover/Copy: Ability to embed attachments that are part (but not the only contents) of e-mail messages in their respective parent .eml files, if both the attachment(s) and the e-mail message are selected for copying and not excluded by any filter. Not yet 100% flawless, but usable. The ability to embed attachments in .eml files already when extracting e-mail from e-mail archives will be removed only in the next version after 15.8.

* Support for non-English attachment names in artificially generated .eml representation of e-mails that were extracted from OST/PST with the non-MAPI method.

* New checkbox for logical searching and indexing that allows to specifically omit directories (i.e. not search NTFS INDX buffer, FAT directory entries etc. etc.).

* Maximum number of search terms that can be logically combined for a fuzzy AND combination slightly increased from 7 to 8.

* Contiguous bad clusters in FAT volumes are now represented as separate virtual files.

* Correct representation of FAT and root directory in the volume snapshot for FAT volumes with only 1 file allocation table.

* Ability to specify non-zero header sizes in component disks of JBODs. Note that if not all the sectors on the component disks are actually used (some reserved at the end) then prior to reconstructing the RAID you can specify the used sector count for each component via Tools | Disk Tools | Set Disk Parameters.

* Recover/Copy: Encoded size of embedded attachments now always correct. Warning if attachments are to be added and filters are affecting the scope of the operation as that may inadvertently exclude the attachments.

* Fixes of v15.7 SR-8.

* Polish translation of the menu.

* PNG metadata extraction revised.

* Support for the Linux file system next3. The exclude bitmap inode will be evaluated, and snapshot files are marked with (SF) in the Attribute column. Specialist license or higher required.

* Table "Partitions by disk signature" in registry report now supported for Windows 7 registries, too. New table "Windows portable devices".

SR-4:
* Fixed an error that could occur when using the disk reading cache with very large media.
* Fixed "child objects of files" filter.
* More detailed report when memory allocations fail.
* Ability to deactivate the strict drive letter protection in X-Ways Investigator. New investigator.ini option -36 prevents disabling the strict drive letter protection.
* Some minor improvements and fixes.

SR-3:
* E-mail extraction from PST/OST: Ability to reference original attachments in .eml files for e-mails with TNEF/winmail.dat attachment style.
* Better representation of meeting requests extracted from Outlook PST/OST files.
* Generally slightly improved representation of e-mail in OST files.
* Some few generated .eml files were displayed without body in the viewer component and in Thunderbird (but OK for example in Outlook Express). This was improved.
* Files with miscellaneous Outlook data such as contacts appointments etc. now have the icons of virtual files.
* Ability to import automatic analysis results (e.g. from DoublePics) back into a case even if evidence objects have been removed or added after the export.
* Memory utilization was inefficient when taking a volume snapshot of Reiser file systems in v15.6 through v15.8 SR-2. This was fixed.
* The progress notification option could not be activated. This was fixed.
* Some minor improvements.

* Recover/Copy: Now the same options that are known from the normal directory browser are also available when copying files from a search hit list. For example, you can automatically copy child objects of selected files and embed attachments in .eml parent files.

* Error messages in message boxes are now additionally logged in messages.txt.

* Some other minor fixes and improvements.

What's new?

* Improved and more informative Windows Registry report that can output selected portions of the key path in addition to the values. This is helpful for the interpretation of many registry values and renders it unnecessary for users to search for relevant information in the key path themselves.

* Generally accelerated registry report generation.

* Additional information is extracted for the registry report from Windows 7 registries about volume shadow copies, legacy programs, and Default Gateway MAC.

* Ability to save and load lists of report table names from the report table association dialog window. Useful to start right away with a set of predefined report tables as typically needed for a certain kind of case.

* Ability to import the valid data length of files that originate from NTFS volumes from evidence file containers as created by v15.4 SR-4 and later.

* Kerio Connect store.fdb files that can be processed like PST/OST files added as supported e-mail archive type.

* When creating a case report and copying files for inclusion in the report, the same easily readable representation of $LogFile, $UsnJrnl:$J, restore point change logs, $I recycle bin and Windows XP prefetch files as known from Preview mode will be output instead of the original file.

* Tools | File Tools | Wipe Securely has been accelerated.

* Some other minor improvements.

* New investigator.ini option +35 prevents users of X-Ways Investigator from deactivating the strict drive letter protection. Before it was generally not possible to deactivate it in X-Ways Investigator, now it is generally possible.

* New investigator.ini option +36 prevents users of X-Ways Investigator from creating case reports.

* New investigator.ini option +37 prevents users of X-Ways Investigator from creating cases.

* Recipients on Bcc in received e-mail (rare and illogical, but apparently possible and seen in real life) are now included in the Recipient field of the directory browser.

* Fixed an error of Preview 1 that could prevent the user from closing the Simultaneous Search dialog window.

* A sophisticated new search algorithm tremendously accelerates conventional (non-index) searches with many search terms and search variants (i.e. character sets/code pages, case insensitivity). Forensic license only. For example, for a case-insensitive search for 6 search terms in code page 1252 and Unicode, the new search algorithm can be twice as fast. With 18 search terms, it can be 8 times as fast. With 40 search terms, it can be 20 times as fast. (Please note that this comparison is for the mere search algorithm only and excludes the time needed for disk I/O.) In this beta version you can explicitly choose between the new and the old search algorithm.

* With the new search algorithms, the word boundary anchor \b now works in Unicode, too (for English, German, and French letters, just like in code page 1252).

* Two new directory browser columns have been introduced (forensic license only). After you have run keyword searches, the "#ST" column tells you for each file the number of search terms that have been found in it. The "Search terms" column lists up to 10 of these search terms (in a random order). Note that this happens for all search hits that have not been deleted and for all search terms ever used in a case, not for only the search terms that may have been selected in the search term list. The benefits of these two additional columns are that you can see contained search terms even in the normal directory browser (not only in the search hit list) and that you can sort by the #ST column to get files listed first that are likely more relevant (because they contain more of the search terms that you were looking for). These columns are populated only for evidence objects of a case.

* The number of actually contained chunks in .e01 evidence files is now output in the evidence object properties. Useful to know for incomplete images.

* Fixed erroneous output that could occur when searching in an index for characters that were not indexed, when actually no output should been produced.

* Fixed error message that was output in Beta 1 when invoking the General Options dialog.

* PST/OST e-mail extraction slightly revised.

* Ability to display the name of the evidence object name where SID/username combinations were found, if recorded.

* Ability to convert Motorola S files to binary that define data in a range of more than 2 GB.

* Ability to export report table associations created in an evidence file container, such that they can be imported back into the original case. That means when you split up the workload in large cases across multiple investigators who work simultaneously, you can now automatically and more easily reconcile their results!

* It is also now possible to export report table associations from original evidence objects (not containers), so even when not working with containers, multiple examiners can work with their own copy of the same case and exchange results with each other or reconcile all results in the main copy of the case, all that by exporting and importing report table associations.

Both commands, the export and import of report table associations, can be found in the context menu of the case tree. Export is supported at the case and evidence object level, import at the case level.

Please note that you cannot import report table associations in the original case any more if you have taken a new volume snapshot after the creation of the evidence file container(s) or if you have removed objects from the volume snapshot.

* Attachments can now be embedded in their respective .eml parent files also when creating a case report, not only when using the Recover/Copy command.

* Usage of the option to embed attachments in .eml files as Base64 code already when extracting e-mail from e-mail archives was discouraged already for some years, for good reasons. The option now has been finally completely removed. The alternatives have already been pointed out over and over again because they were ignored by some users until today.

* When matching hash values against the hash database, if X-Ways Forensics finds a hash value in different hash sets that belong to different categories, a warning is output (since v15.6). Now it is guaranteed that the category that is returned in such a case is always "notable".

* The standard registry report definition file was split into 8 parts, so that any time you create the report you can choose which parts you need. As before, you can change the definition files as you see fit, or create your own ones for specific purposes/for different kinds of cases.

* Better prepared for certain PST files.

* Ability to carve, confirm, and view Outlook 2011 for Mac e-mails and extract attachments from them.

* Memory leak in file header signature search fixed that was specific to v15.9 Beta.

* Memory leak of v15.9 Beta in search engine fixed.

* Registry report errors fixed.

* Filter for the new search term column introduced.

* Displays the number of search hits that would be listed based on current settings for search terms if they were selected.

* Byte-level signature searches did not work before in v15.9 Beta. This was fixed.

* The external virus check did not work correctly (and informed the user about that) in v15.6 through v15.8. This was fixed.

* Fixed a memory leak in e-mail extraction.

* Some minor improvements and fixes.

SR-3:

* The hash set filter did not work in v15.9. That was fixed.
* Avoided an exception error that could occur under certain circumstances when running a byte-level signature search.
* If the context preview of search hits in files in large archives is too slow, it can now be disabled by unselecting the existing option "Gallery: Show pictures in archives".
* Some minor improvements.

SR-2:

* The "List 1 hit per file only" option did not work correctly in v15.9. This was fixed.
* Improved function to delete duplicate search hits. When in doubt, X-Ways Forensics will now keep the longer search hit (as a hit for "Smithsonian" for example is more specific than "Smith") and favors search hits in existing files.
* Accelerated time to list millions of search hits.
* The Open Disk dialog window was wrong when not working with a case. That was fixed.
* Some minor improvements.

SR-1:

* General support for sector sizes up to 8 KB (previous maximum: 4 KB).
* Support for GPT partitioning on media with 4 KB and 8 KB sector sizes.
* Ability to deal with HFS+/HFSX volumes on media with sector sizes larger than 2 KB, as seen in iPhones and iPads.
* Ability to auto-detect the sector size in raw images of GPT-partitioned disk with sector sizes of 4 KB and 8 KB.
* Ability to auto-detect the sector size in most raw images of MBR-partitioned disks with a sector size of 4 KB.
* Partial progress of volume snapshot refinements is now saved when the case auto-save interval elapses.
* Some minor improvements.

SR-7:
* HFS+ partition size detection on disks with Apple partition table fixed.
* Ability to deal with volumes with cluster sizes of more than 128 sectors, which seem to be not uncommon in the exFAT file system.
* Fixed an exception error that could occur in certain situations with the new v15.9 search algorithm.
* In WinHex 15.7 through 15.9 with a specialist license, the simultaneous search function was unable to run a case-insensitive search correctly. That was fixed.
* Improved handling of the internal volume snapshot files if reading or writing these files fails because of insufficient drive space or other system resources, file system errors, or other reasons.
* More complete assignment of drive letters in the "Attached Devices" section of the registry report.

SR-6:
* Avoids an exception error that occurred in v15.9 SR-5 when trying to refine the volume snapshot without a case.
* Fixed erroneous disappearance of partitions in the case tree when removing hidden items from the volume snapshot of a physical disk.
* Avoided an exception error that could occur when starting to use the Recover/Copy functionality.
* Fixed an error that occurred with .e01 evidence files that have more than 775 segments.
* Japanese translation updated.
* Some minor improvements.

SR-5:
* With the new search algorithm, GREP expressions of variable length were found in v15.9 with their shortest matches instead of their longest possible matches as before. This was changed.

SR-4:
* Avoided an exception error that could occur when the case root window was automatically opened at start-up.
* Avoided (potentially annoying, but harmless) messages that could be displayed by Windows when working with images on write-protected drives.
* Fixed an error that could occur when loading volume snapshots with more than 6 million objects.
* Drive letters were missing in the special tables of the registry report in earlier releases of 15.9. That was fixed.

What's new?

* There is no performance penalty any more for selecting many or all file types for the file header signature search. File header signature searches are now considerably faster and basically limited in speed only by the medium from which the data is read.

* Ability to interpret data in the text column as text encoded in an arbitrary code page. That is very useful for East Asian code pages, Eastern European code pages and UTF-8 if the text is found outside of files that can be nicely viewed by the viewer component, e.g. floating around in free drive space. The character set/code page for the text column can now be selected via View | Character Set. Please note that you may need to select a font in General Options that contains all characters that you intend to read, and for East Asian characters you need to have support for these kinds of languages installed in Windows.

* Ability to view Windows Vista and Windows 7 event log files (.evtx), based on work by Andreas Schuster.

* Completely revised and more robust registry hive handling. Ability to find deleted keys and values in hives that contain unused space and lost keys/values in damaged/incomplete hives. If no complete path is known for keys, they will be listed as children of a new virtual key called "Path unknown". The search function in the registry viewer is now more thorough and robust.

* Analysis of free space in registry hives with the report definition file "Reg Report Free Space.txt". The free space can be as large as several MB, especially as a consequence of the use of virus scanners and registry cleaning programs.

* Windows registry report: New data type %I (ITEM list) covers not only Shell Bag (as in previous versions), but also for example desktop shortcuts. Format adjusted for Windows Vista and 7.

* When switching from File mode to Partition/Volume mode, X-Ways Forensics will now automatically point you to the offset from the point of view of the partition/volume that is equivalent to the offset within the file where the cursor was positioned last, even if the file is fragmented, if there is an equivalent position (not if the file is a compressed or virtual attached file or an extracted e-mail message or an exported video still etc.).

* New investigator.ini option +38 allows to prevent imports of report table associations.

* Ability to specify the directory in which to create a case when creating a new case, for that particular case only.

* File header signature searches are now even faster.

* Registry report function further improved and revised. Deleted values are now highlighted in red in the report.

* Directories with search hits that are copied from a search hit list now receive a special name when they are created as files in the output folder.

* Ability to open an evidence object even if the disk or image is not currently available, via a special command in the evidence object's context menu, to see the volume snapshot. That means you can see all the file metadata stored in the volume snapshot (filename, path, file size, timestamps, attributes, etc.), can use all filters etc., but cannot see any data in sectors and cannot open/view any files.

* Improved thumbnails extraction from Windows Vista's and Windows 7's thumbcache_*.db files. Ability to assign original filenames, file paths, and modification timestamps to certain thumbnails that were previously just named with a 16-digit hex number.

* Ability to customize the notation of dates, times, and numbers (see new button in Options | General). Useful to be independent of the settings of live system that you want to preview. Ability to display years with 2 digits only.

* The registry viewer now allows to recursively explore all the keys and values in a hive and sort them in a chronological order.

* Better Unicode support in the registry report for Asian registry hives.

* Tray notifications artifacts from Windows 7 registry hives are now supported and decoded. The timestamps render these artifacts useful for computer forensics.

* Further improved support for shell bags.

* Support for two new zip subtypes: APK Android smartphone packages and KEY Apple iWork keynote presentation files.

* Sorting by search term count column has been accelerated.

* An exception error was fixed that could occur when viewing EVTX event log files.

* Fixed an exception error that could occur when extracting metadata from carved MP4 and ASF files.

* Hash database functions internally reworked. When importing the NSRL RDS hash database, X-Ways Forensics now checks for records with the flags "s" (special) and "m" (malicious) so that these hash values are not erroneously included in the same internal hash set that should be categorized as irrelevant.

* Technical information about segmented .e01 evidence files could occur repeatedly in the evidence object properties. This was fixed.

* It is now possible to abort lengthy sort operations. The directory browser is now unsorted after start-up by default. This new behavior can be turned off in the directory browser options.

* The grouping options now have an effect even if the directory browser is not sorted.

* The option to display fractions of seconds in high resolution timestamps has been moved from the directory browser options to the new notation options. The option to display the time zone bias has also been moved to the notation options.

* The report table filter has a new option that allows to additionally include siblings of the associated files, i.e. files in the same directory as the files that are part of the selected report table(s). Useful, especially when exploring recursively and sorting by path, to check whether there are any further notable files in the neighborhood.

* Ability to optionally also add any known duplicates of the selected file(s) in the same evidence object to a report table (files which have been identified as duplicates based on hash values and marked as such in the Attr. column).

* Ability to identify animated GIFs. Animated GIFs will be added to a special report table during the file type verification.

* Ability to select the character set/code page for Disk/Partition/File mode in X-Ways Investigator (tentatively included).

* Licensed users of X-Ways Forensics with active update maintenance can now conveniently find older versions for download if needed.

* Registry value slack has a relevant size in NTUSER.DAT hives. This fact is now exploited with 2 measures:

1) If the slack contains text strings, it will be output in the registry report (in green). This new feature can optionally be turned off the registry viewer context menu.

2) For values that contain item lists (i.e. are binary) you can use the "Reg Report Free Space.txt" definitions to output registry report will output lists of filenames with timestamps in green. The first timestamps is an access date, the second one is a creation date. If no timestamps can be output, these are artifacts from "RecentDocs".

* Deleted registry values are now highlighted in the report in red color.

* Tools | Disk Tools | Clone Disk now allows for reverse disk cloning and reverse disk imaging (requires a specialist or forensic license). Useful if the disk to acquire has severe physical defects that for example cause a disk imaging program or the entire Windows system to freeze or crash when reaching a certain sector. In such a case you can create an image in reverse order, by reading sectors from the end of the disk backwards, and it is even possible to automatically fill an existing incomplete ordinary ("forward") image additionally backwards to get an image that is as complete as possible, with only a small zeroed gap somewhere in the middle that represents the unreadable damaged spot on the source hard disk. Yes, X-Ways Forensics is quite a sophisticated disk imaging tool not only because of its speed, and we would like to remind everyone that additional dongles just for disk imaging are available for much less than the cost of a full license (see http://www.x-ways.net/forensics/dongle.html#imaging).

* With additional dongles for X-Ways Forensics just for disk imaging you can now additionally use the Tools | Disk Tools | Clone Disk functionality.

* Some further improvements in registry report generation.

SR-5:
* File header signature searches in v16.0 did not find file types whose signatures were defined at relative offsets larger than 0. That was fixed.
* Unicode support in registry hives further completed, now also covers usernames and the Owner column in the directory browser.
* Support for Windows Image Acquisition folder MRU in registry report.
* The option to not overwrite an already existing index when starting to index again did not work. That was fixed.
* Some minor improvements.

SR-4:
* The style "level 5 forward parity dynamic" could not be selected when reconstructing RAIDs since v15.8. That was fixed.
* Exception errors avoided in metadata extraction.
* In v16.0, X-Ways Forensics did not correctly resolve usernames when adding evidence objects with Windows installations to the case. That was fixed.
* Some minor improvements.

* Additional information included in imaging log.
* New version of the internally used graphics viewing library.
* More powerful and convenient batch processing thanks to an option to automatically trigger logical searches (previously only indexing) after volume snapshot refinement and thanks to an option to trigger the volume snapshot refinement (and therefore indirectly also logical searches) immediately after adding images to the case. That means you click through all the dialog windows initially and then run the selected operations without further user interaction. The operations will be run in this order: First all images are added to the case. Then the volume snapshots will be taken and refined if selected. After that, for selected evidence objects (previous or newly added ones) a logical search will be run if selected. Finally for each selected evidence object an index can be created.

* Ability to invoke the menu commands to refine volume snapshots and run logical searches in selected evidence objects even when no data window is open at that time. As always, these operations will open data windows themselves when needed and close them automatically when no longer needed, to avoid unnecessary main memory utilization by loaded volume snapshots.

* A new case tree context menu command that allows to export any portion of the tree to a Unicode text file. The tree will be represented exactly in its current state of expansion and can span all evidence objects. To export a subtree, right-click a directory while holding the control key. Use a fixed font to view the text file. Remember to fully recursively expand a portion of the tree that you want to export, you can click the root of that portion and press the asterisk (multiplication) key on the numeric keypad.

* Some errors fixed in Exchange EDB processing, support for some more Exchange EDB variants, and more output about conditions when Exchange EDB processing does not succeed.

* New version of the internally used library for archive decompression.

* During lengthy Exchange EDB processing, the main window of X-Ways Forensics now remains responsive, and the progress indicator window provides updates. Also EDB extraction can now be aborted liked any other length operation.

* More efficient memory management for EDB processing.

* Filename conflict fixed that could occur in case report creation in v16.0 SR-3 through v16.0 SR-6.

* Case Report: File naming conflict fixed that existed in v16.0 SR-3 through v16.0 SR-6. And filenames are now truncated at latest at 127 characters.

* Ability to change the order of evidence objects in the case tree, via the properties dialog window, except for "dependent" evidence objects (partitions that belong to a physical disk).

* Many additional file signature definitions, mostly for file type verification only.

* The thorough file system data structure search will now check for INDX buffers for index records referencing existing files that are not referenced in the $MFT any more because the $MFT is in a corrupt or incomplete state, for example because the image is incomplete.

* Further improved Exchange EDB support. We ask for more testing. Thank you very much!

* Ability to interpret VMware's Virtual Machine Disk images (VMDK) in addition to .e01 evidence files, raw/dd images, ISO images and VHD images.

* New Export List command in the registry viewer context menu allows to export all values in the selected hive to a tab-delimited text file.

* Additional edit window in the registry viewer that tells you the logical size of the selected value and the size of its slack. It also interprets registry values of the following types, as known from the registry report: MRUListEx, BagMRU, ItemPos, ItemOrder, Order (menu), ViewView2, SlowInfoCache, IconStreams (Tray notifications), UserAssist, Timestamps (FILETIME, EPOCHE, Epoche8). More to come.

* New special table "External Memory Device" included in registry report that can be retrieved from Software hives of Windows Vista and later that lists external media with access timestamps, hardware serial number, volume label, volume serial number and volume size (size often only under Vista). Select the definition file "Reg Report Devices.txt" to get the table.

* Extracting e-mail from Exchange EDB databases: Memory requirements reduced and further improvements.

* You can now conveniently close viewer windows (whose contents are provided by the viewer component) by hitting the Esc key on your keyboard.

* Notification when opening a case if it can only be opened as read-only because of the read-only file attribute or because of insufficient file permissions.

* It is now possible to close filter dialogs by clicking the "x" in the upper right corner or by pressing Alt+F4 without deactivating the filter if its active and without losing selection and scroll position in the directory browser.

* When using the Recover/Copy command and the output filename has to be shortened to fit in the maximum path length specified by the user, the filename is now shortened in a nicer way, by preserving the extension whenever possible. (forensic license only)

* Ability to automatically hibernate the system after disk imaging, image restoration and disk cloning. (Previously the only option was to shut down the system.) If Windows signals that hibernation fails, X-Ways Forensics will instead try to shut down the system.

* Better response during lengthy Exchange EDB extractions.

* Registry Viewer: Special interpretation of MountedDevices, OpenSavePidlMRU, and LastVisitedPidlMRU

* Indexing slightly accelerated.

* Imaging with compressed .e01 evidence files as the output format accelerated for disks that contain large areas of binary zeroes, for example because they were wiped by the user some time or zeroed out by the manufacturer and never completely filled.

* New "sparse" compression option for .e01 evidence files that only compresses large areas of zero value bytes in a very efficient way.

* Ability to edit files without using operating system file write commands, directly on a disk/in a raw disk image in any file system supported, even if not supported by Windows, even files not seen by Windows (e.g. deleted files), even in partitions not seen by Windows (e.g. by damaged or deleted), without changing any timestamps or attributes, in in-place mode. For this new editing capability, the file must been opened from within the already opened volume that contains it, via the Open command in the directory browser context menu or in File mode (forensic license only). Compressed files or generally files within other files (e.g. e-mails and attachments in e-mail archives) cannot be edited, except in an evidence file container if they have been copied there from the original disk/image.

Previously it was only possible to edit files when opened via File | Open, using operating system file write commands or indirectly by editing disk sectors. In File mode (forensic license only) and when opening files from within already opened volumes, the only available mode so far was read-only mode. All of this has changed. Note that files cannot be shortened or expanded that way, only the data in already allocated areas can be modified. Editing files opened directly from within disks/raw images as described above is possible in WinHex only, not in X-Ways Forensics or X-Ways Investigator, where sector level write access (to which file editing is internally translated) is disabled and where the only mode available for disks and interpreted images and files opened from within volumes continues to be read-only mode. For owners of a license for X-Ways Forensics, this change only affects the special WinHex version that they receive additionally, not X-Ways Forensics itself.

In forensic computing, electronic discovery and IT security, the new edit capability can be helpful to manually redact (e.g. overtype) specific data that should not be examined/disclosed/seen or to securely erase specific areas within files (e.g. define as a block and fill the block). Note that evidence file containers are raw images if they have not been converted to the .e01 evidence file format and thus allow for retroactive file editing, which, however will invalidate any accompanying hash values.

It is even possible to edit directories, i.e. the clusters with directory data, e.g. INDX buffers in NTFS, for example if you need to redact the names of certain files.

* New file wiping functionality for files that are selected in the directory browser, via a command in the context menu. The data in the logical portion of the file (i.e. excluding the file slack) will be erased/overwritten with a hex value pattern of your choice. The existence status of the file in its file system will not be changed. No file system level metadata such as timestamps or attributes will updated because no operating system file level write commands are used. No file system data data structures are changed, and no filenames will be erased, only the contents of files will be overwritten. Compressed files or generally files within other files (e.g. e-mails and attachments in e-mail archives) cannot be erased. Previously existing files whose clusters are known to have been reused will not be erased. Note that by erasing deleted files you might erase data in clusters that belong to other files, so only select existing files if you want to avoid that (assuming consistent file systems). Also note that by erasing carved files you may erase too much or not enough data, depending on the detected file size and depending on whether the file was originally fragmented. This functionality is only available in WinHex, not in X-Ways Forensics.

Useful for example if copies of images are forwarded to investigators/examiners who are not allowed to see the contents of certain files. Useful also if you have to return computer media on which child pornography has been found to the owner after clearing these files. Also useful if you are preparing images for training purposes that you would like to publish and would like to retroactively erase the contents of copyrighted files (e.g. operating system or application program files).

Both successfully erased files and files that could not be successfully erased will be added to separate report tables by which you can filter to verify the result.

* The metadata extraction functionality has been removed from the directory browser context menu. It is now part of the Refine Volume Snapshot command and thus cannot be applied to selected files any more, but to either all files, tagged files or not hidden files.

* The new wiping functionality in the directory browser context menu now also erases data of selected directories, not only file contents.

* Cool new function to create hard links of files on NTFS volumes. Useful for example to play around with hard links during our File Systems Revealed training, or if you would like to add the same image to the same case again, which is only possible under a different name. The hard links will be created in the same directory and of course can be renamed and moved by you after they have been created. Tools | Disk Tools | Create Hard Link.

* Shorter and language-independent case subdirectory names in all cases created by v16.1 and later.

* More convenient procedure when the path or drive letter of an image in a case has changed, especially if the image was added to the case in v16.1 and later and you have updated the standard directory for images in the General Options already.

* New special table in the registry report called "Browser Helper Objects", compiled with data from the hives NTUSER.DAT and SOFTWARE, about browser usage.

* The number of data types that are interpreted by the new edit window further increased. The new edit window now also displays the access rights/permissions of the registry keys if (Default) is selected. Several small improvements in the registry viewer/report.