- Complete case management: X-Ways Forensics manages your cases separately and will allow you to identify all sources and pieces of evidence related to your case.
- Automated activity logging (audit logs): Logging of all activity is enabled by default. This can be helpful when back-tracking your steps if you have to interrupt your work and take it up again sometime later.
- View all existing and deleted files on media by file type category: X-Ways Forensics supports the approach of looking for specific file types beyond looking for one file extension at a time. Many times, forensic examiners are specifically looking for office documents, but not specifically Word files, or for image files regardless of the actual type. X-Ways Forensics can create a drive contents table that disregards the actual directory structure of the file system and instead uses predefined categories like “images”, “office” or “Internet”.
- Gallery view for pictures: X-Ways Forensics offers a gallery view on image files contained in directories or the “images” category of the drive contents table. Viewing thumbnails of the images notably speeds up the search process for relevant images.
- Skin colour detection: In cases related to child pornography, it is clear from the start that relevant images most likely contain a notable amount of skin colours. To accelerate the examiner’s search for images with potentially relevant content, X-Ways Forensics features an option to sort images by skin colour percentage.
- Disk Cloning/Disk Imaging under DOS and Windows: X-Ways Forensics produces exact sector-wise copies of most media types, either to other disks (clones, mirrors) or to image files, using physical or logical disk access. It’s vital for forensic examiners because it allows working on a forensically sound duplicate.
- Hard Drive Cleansing/Disk Wiping: X-Ways Forensics can quickly fill every sector of a disk with zero bytes (or in fact any byte pattern you like, even random bytes), as often as you like (to maximize security). This effectively removes any traces of files, directories, viruses, proprietary and diagnostic partitions, etc.