DOCSLIB.ORG

X-Ways Forensics/ Winhex

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
X-Ways Forensics/ Winhex X-Ways Software Technology AG X-Ways Forensics/ WinHex Integrated Computer Forensics Environment. Data Recovery & IT Security Tool. Hexadecimal Editor for Files, Disks & RAM. Manual Copyright © 1995-2014 Stefan Fleischmann, X-Ways Software Technology AG. All rights reserved. Contents 1 Preface ..................................................................................................................................................1 1.1 About WinHex and X-Ways Forensics.........................................................................................1 1.2 Legalities.......................................................................................................................................2 1.3 License Types ...............................................................................................................................2 1.4 Differences between WinHex and X-Ways Forensics..................................................................3 1.5 Getting Started with X-Ways Forensics........................................................................................4 2 Technical Background ........................................................................................................................5 2.1 Using a Hex Editor........................................................................................................................5 2.2 Endian-ness...................................................................................................................................6 2.3 Integer Data Types........................................................................................................................6 2.4 Floating-Point Data Types ............................................................................................................7 2.5 Date Types ....................................................................................................................................7 2.6 ANSI ASCII/IBM ASCII..............................................................................................................8 2.7 Checksums ....................................................................................................................................9 2.8 Digests ........................................................................................................................................10 2.9 Attribute Legend .........................................................................................................................10 2.10 Technical Hints ...........................................................................................................................11 3 User Interface.....................................................................................................................................12 3.1 Overview.....................................................................................................................................12 3.2 Start Center .................................................................................................................................13 3.3 Directory Browser.......................................................................................................................13 3.3.1 General Description................................................................................................................13 3.3.2 Virtual Objects........................................................................................................................15 3.3.3 Options ...................................................................................................................................16 3.3.4 Filters......................................................................................................................................19 3.3.5 Columns and Column-based Filters........................................................................................21 3.4 Mode Buttons..............................................................................................................................28 3.5 Status Bar....................................................................................................................................31 3.6 Data Interpreter ...........................................................................................................................32 3.7 Position Manager ........................................................................................................................33 3.8 Useful Hints ................................................................................................................................33 4 Menu Reference .................................................................................................................................34 4.1 Directory Browser Context Menu...............................................................................................35 4.2 Data Window Context Menu ......................................................................................................42 4.3 File Menu....................................................................................................................................43 4.4 Edit Menu ...................................................................................................................................45 4.5 Search Menu ...............................................................................................................................46 4.6 Navigation Menu ........................................................................................................................47 4.7 View Menu..................................................................................................................................48 4.8 Tools Menu .................................................................................................................................50 4.9 File Tools ....................................................................................................................................52 4.10 Specialist Menu...........................................................................................................................54 4.11 Options Menu .............................................................................................................................56 4.12 Window Menu ............................................................................................................................57 4.13 Help Menu ..................................................................................................................................57 4.14 Windows Context Menu .............................................................................................................58 5 Forensic Features...............................................................................................................................58 5.1 Case Management.......................................................................................................................58 II 5.2 Multi-User Coordination For Large Cases..................................................................................60 5.3 Evidence Objects ........................................................................................................................64 5.4 Case Log .....................................................................................................................................65 5.5 Case Report.................................................................................................................................66 5.6 Report Tables..............................................................................................................................67 5.7 Internal Viewer ...........................................................................................................................69 5.8 Registry Report ...........................................................................................................................71 5.9 Simultaneous Search...................................................................................................................73 5.10 Logical Search ............................................................................................................................74 5.11 Search Hit Lists...........................................................................................................................78 5.12 Search Term List.........................................................................................................................79 5.13 Event Lists ..................................................................................................................................81 5.14 File Type Categories.txt..............................................................................................................83 5.15 Hash Database.............................................................................................................................84 5.16 Time Zone Concept.....................................................................................................................86 5.17 Evidence File Containers ............................................................................................................87 5.18 Related Items ..............................................................................................................................89
Load more

Recommended publications
  • Extraction of Creation-Time for Recovered Files on Windows FAT32 File System
    applied sciences Article Extraction of Creation-Time for Recovered Files on Windows FAT32 File System Wan Yeon Lee 1, Kyong Hoon Kim 2 and Heejo Lee 3,* 1 Department of Computer Science, Dongduk Women’s University, Seoul 02748, Korea; [email protected] or [email protected] 2 Department of Informatics, Gyeongsang National University, Jinju 52828, Korea; [email protected] 3 Department of Computer Science and Engineering, Korea University, Seoul 02841, Korea * Correspondence: [email protected]; Tel.: +82-2-3290-3208 Received: 16 November 2019; Accepted: 11 December 2019; Published: 15 December 2019 Abstract: In this article, we propose a creation order reconstruction method of deleted files for the FAT32 file system with Windows operating systems. Creation order of files is established using a correlation between storage locations of the files and their directory entry locations. This method can be utilized to derive the creation-time bound of files recovered without the creation-time information. In this article, we first examine the file allocation behavior of Windows FAT32 file system. Next, based on the examined behavior, we propose a novel method that finds the creation order of deleted files after being recovered without the creation-time information. Due to complex behaviors of Windows FAT32 file system, the method may find multiple creation orders although the actual creation order is unique. In experiments with a commercial device, we confirm that the actual creation order of each recovered file belongs to one of the creation orders found by the method. Keywords: creation-time; FAT32 file system; file allocation behavior; order reconstruction; recovered file 1.
    [Show full text]
  • Winhex White Paper
    X-Ways Software Technology AG Evidor Electronic Evidence Acquisition for Computer Forensics and Civil Discovery. Target group: lawyers, law firms, corporate law and IT security departments, licensed investigators, and law enforcement agencies. What it does: Evidor retrieves the context of keyword occurrences on computer media, not only by examining all files (the entire allocated space, even Windows swap/paging and hibernate files), but also currently unallocated space and so-called slack space. That means it will even find data from files that have been deleted, if physically still existing. Electronic discovery: Evidor is a particularly easy and convenient way for any investigator to find and gather digital evidence on computer media. Evidor also comes most handy in civil (pre-) litigation if one party wants to examine (inspect) the computers of the other party. Evidor can be used on site for electronic discovery, will not disclose irrelevant proprietary or confidential information and does not impose an undue burden on the responding party in terms of personnel, time and money. Evidor serves as an automated forensic examiner, saving you the cost of many hours of hard manual expert work. Evidor produces reliable, replicable, neutral, and simple results, just as needed before court. Powerful and fast. IT security: Evidor is also an excellent tool for proving the presence or absence of confidential data on computer media, either to detect a security leak or confirm a lack thereof. With Evidor you often finds remnants (or even intact copies) of classified data that should have been encrypted, securely erased, or should not have existed on a media in the first place.
    [Show full text]
  • Manual Winhex
    X-Ways Software Technology AG WinHex/ X-Ways Forensics Integrated Computer Forensics Suite. Data Recovery and IT Security Tool. Editor Hexadecimal de Archivos, Discos y RAM Manual Copyright © 1995-2006 Stefan Fleischmann. All rights reserved. Índice 1 Introducción ........................................................................................................................................ 1 1.1 Acerca de WinHex y X-Ways Forensics ..................................................................................... 1 1.2 Aviso Legal .................................................................................................................................. 1 1.3 Licencias ...................................................................................................................................... 3 1.4 Differences between WinHex and X-Ways Forensics................................................................. 4 2 Información General .......................................................................................................................... 4 2.1 Editores Hexadecimales............................................................................................................... 4 2.2 Bytes Significativos ..................................................................................................................... 5 2.3 Tipos de Datos Enteros ................................................................................................................ 6 2.4 Tipos de Datos Reales.................................................................................................................
    [Show full text]
  • File Allocation and Recovery in FAT16 and FAT32
    International Journal of Scientific & Engineering Research, Volume 7, Issue 12, December-2016 343 ISSN 2229-5518 File Allocation and Recovery in FAT16 and FAT32 Riya Madaan Department of Computer Science & Applications ,Kurukshetra University, Kurukshetra-136119 [email protected] Rakesh Kumar Department of Computer Science & Applications, Kurukshetra University, Kurukshetra-136119 [email protected] Girdhar Gopal Department of Computer Science & Applications, Kurukshetra University, Kurukshetra-136119 [email protected] --------------------------------------------------Abstract----------------------------------------------------- The data recovery is the fastest emerging dynamic technology with a huge market in the area of computer security and maintenance. In order to carry out the recoveryone is to be acquainted with the file management systems i.e. FAT, NTFS. FAT is the oldest file system which was used in MSDOS and early versions of Windows. In this paper, an exhaustive study has been performed for the two variants of FAT file systems like FAT16 and FAT32 with respect to data recovery. In addition the main differencesbetween FAT16 and FAT32 are discussed. Recovery issues are also addressed. Some techniques to recover the data that have been deleted accidently or maliciously have also been reviewed. Keywords- Digital Forensics, File Recovery, FAT, File System, Storage Principle I. Introduction The data is very vital in this current world because Over the years computers have been gradually but the data may be vanished either by users own wish to unavoidably became record keepers of human delete it due to some storage issues or by activity. This trend enhanced with the advent of PCs, accidentally. In future, if the user needs the same handheld devices such as mobiles, Internet, data, it will not be possible at that time to fetch it multimedia and telecommunications.
    [Show full text]
  • X-Ways Forensics & Winhex Manual
    X-Ways Software Technology AG X-Ways Forensics/ WinHex Integrated Computer Forensics Environment. Data Recovery & IT Security Tool. Hexadecimal Editor for Files, Disks & RAM. Manual Copyright © 1995-2021 Stefan Fleischmann, X-Ways Software Technology AG. All rights reserved. Contents 1 Preface ..................................................................................................................................................1 1.1 About WinHex and X-Ways Forensics.........................................................................................1 1.2 Legalities.......................................................................................................................................2 1.3 License Types ...............................................................................................................................4 1.4 More differences between WinHex & X-Ways Forensics............................................................5 1.5 Getting Started with X-Ways Forensics........................................................................................6 2 Technical Background ........................................................................................................................7 2.1 Using a Hex Editor........................................................................................................................7 2.2 Endian-ness...................................................................................................................................8 2.3 Integer
    [Show full text]
  • Forensics Steady State
    University of Rhode Island DigitalCommons@URI Open Access Master's Theses 2014 FORENSICS STEADY STATE Travis Scarboro University of Rhode Island, [email protected] Follow this and additional works at: https://digitalcommons.uri.edu/theses Recommended Citation Scarboro, Travis, "FORENSICS STEADY STATE" (2014). Open Access Master's Theses. Paper 457. https://digitalcommons.uri.edu/theses/457 This Thesis is brought to you for free and open access by DigitalCommons@URI. It has been accepted for inclusion in Open Access Master's Theses by an authorized administrator of DigitalCommons@URI. For more information, please contact [email protected]. FORENSICS STEADY STATE BY TRAVIS SCARBORO A THESIS SUBMITTED IN PARTIAL FULFILLMENT OF THE REQUIREMENTS FOR THE DEGREE OF MASTER OF SCIENCE IN COMPUTER SCIENCE AND STATISTICS UNIVERSITY OF RHODE ISLAND 2014 MASTER OF SCIENCE THESIS OF TRAVIS SCARBORO APPROVED: Thesis Committee: Major Professor Victor Fay-Wolfe Lisa DiPippo Stu Westin Nasser H. Zawia DEAN OF THE GRADUATE SCHOOL UNIVERSITY OF RHODE ISLAND 2014 ABSTRACT After finishing the process of investigating digital evidence on a forensic workstation, it is important for law enforcement to use a forensically sound machine when starting a new investigation. To prevent cross-contamination of remnants between cases, most law enforcement agencies seek to have a controlled operating environment that can be reset to a sterile state which ensures that all remnants of previous cases are not present. The discontinuation of Windows SteadyState™ has left forensic investigators without a viable automated solution for ensuring a controlled environment that protects the probative value of digital evidence. This thesis project forensically validates and modifies an existing open-source SteadyState™ solution, Forensics Steady State, which will provide law enforcement officers with a viable substitution to other costly products.
    [Show full text]
  • Winhex Manual
    X-Ways Software Technology AG WinHex/ X-Ways Forensics Integrated Computer Forensics Environment. Data Recovery & IT Security Tool. Hexadecimal Editor for Files, Disks & RAM. Manual Copyright © 1995-2007 Stefan Fleischmann, X-Ways Software Technology AG. All rights reserved. Contents 1 Preface ..................................................................................................................................................1 1.1 About WinHex and X-Ways Forensics.........................................................................................1 1.2 Legalities.......................................................................................................................................2 1.3 License Types ...............................................................................................................................3 1.4 Differences between WinHex and X-Ways Forensics..................................................................4 1.5 Getting Started with X-Ways Forensics........................................................................................5 2 Technical Background ........................................................................................................................5 2.1 Using a Hex Editor........................................................................................................................5 2.2 Endian-ness...................................................................................................................................6 2.3
    [Show full text]
  • Winhex/ X-Ways Forensics
    X-Ways Software Technology AG WinHex/ X-Ways Forensics Outil pour les expertises juridiques et la récupération de données Editeur hexadécimal de fichier, disque et RAM Manuel Copyright © 1995-2006 Stefan Fleischmann. All rights reserved. Sommaire 1 Préface ................................................................................................................................................. 1 1.1 A propos de WinHex et X-Ways Forensics ................................................................................. 1 1.2 Mentions légales .......................................................................................................................... 1 1.3 Types de licences ......................................................................................................................... 3 1.4 Differences between WinHex and X-Ways Forensics................................................................. 4 2 Informations générales....................................................................................................................... 5 2.1 Utilisation d'un éditeur hexadécimal............................................................................................5 2.2 Terminaison hexadécimale........................................................................................................... 6 2.3 Données à nombre entier.............................................................................................................. 6 2.4 Données du type flottant .............................................................................................................
    [Show full text]
  • Winhex and X-Ways Forensic
    CORE Metadata, citation and similar papers at core.ac.uk Provided by Portal Jurnal Universitas Serang Raya Jurnal PROSISKO Vol. 3 No. 1 Maret 2016 ISSN: 2406-7733 ANALISIS DATA RECOVERY MENGGUNAKAN SOFTWARE FORENSIC: WINHEX AND X-WAYS FORENSIC Vidila Rosalina1 , Andri Suhendarsah2, M. Natsir3 FTI Universitas Serang Raya Jl. Raya Serang-Cilegon Taman Kopasus 1)[email protected], 2)[email protected])[email protected] Abstrak - Segala bentuk kejahatan baik di dunia nyata maupun di dunia maya, sering meninggalkan jejak yang tersembunyi ataupun terlihat. Jejak tersebut yang kemudian dapat meningkat statusnya menjadi bukti, menjadi salah satu perangkat/entitas hukum.Data recovery merupakan bagian dari analisa forensik di mana hal ini merupakan komponen penting di dalam mengetahui apa yang telah terjadi, rekaman data, korespondensi, dan petunjuk lannya. Banyak orang tidak menggunakan informasi yang berasal dari data recovery karena dianggap tidak murni/asli/orisinil. Setiap sistem operasi bekerja dalam arah yang unik, berbeda satu sama lain (walaupun berplatform sistem operasi yang sama). Untuk melihat seberapa jauh data sudah dihapus atau belum, perlu memperhatikan segala sesuatu yang ada dalam raw disk. Jika data yang digunakan untuk kejahatan ternyata masih ada, maka cara yang termudah adalah menguji data dengan pemanfaatan tool yang ada pada standar UNIX, seperti strings, grep, text pagers, dan sebagainya. Sayangnya, tools yang ada tidak menunjukkan data tersebut dialokasikan di mana.Artikel ini akan membahas software forensic: winhex and x-ways forensic yang dapat melakukan data recovery dengan lebih sempurna. Kata Kunci: Data Recovery, Digital Forensic, Wihex, X-Way Forensic I. PENDAHULUAN hanya dilakukan ketika melakukan proses format.
    [Show full text]
  • User's Manual
    User's Manual © 2003 - 2020 Digital Atlantic Corp. I CDRoller - User's Manual Table of Contents Introduction. 1 1. Installing CDRoller. 3 2. Uninstalling CDRoller. 8 3. Opening and Closing CDRoller. 9 4. How to register the program. 10 5. How to upgrade CDRoller. 11 6. Recovering CD/DVD/BD Data. 12 Overview. ................................................................................................................................... 12 6.1. Disk recognition.................................................................................................................................... 12 6.2. Using Session................................................................................................................................... Selector. 14 6.3. Searching................................................................................................................................... the lost UDF files on CD-R/DVD-R/DVD+R disks. 15 6.4. Applying................................................................................................................................... Scan UDF Disc. 16 6.5. Recovering................................................................................................................................... files. 18 6.6. Recovering................................................................................................................................... DVD video and photos. 19 6.7. Recovering..................................................................................................................................
    [Show full text]
  • X-Ways AG Company and Product Overview
    X-Ways Software Technology AG Corporate and Product Overview Updated: Jan 17, 2004 1 Corporate Information X-Ways Software Technology AG Company homepage: http://www.x-ways.net/corporate/ Carl-Diem-Str. 32 Product homepage: http://www.x-ways.net 32257 Bünde Support forum: http://www.winhex.net Germany E-mail address: [email protected] Phone: +49 761-593 250 0 Fax: +49 721-151 322 561 Legal Issues, People X-Ways Software Technology AG is a stock corporation incorporated under the laws of the Federal Republic of Germany. DUNS number: 34-471-4881. NCAGE code : DJ465. Enrolled in CCR U.S. government contractor database. X-Ways is registered in the city of Bünde under No. HRB 1777. A branch office was opened in Freiburg, near the French and Swiss border. Stefan Fleischmann serves as CEO and your main contact person. He received the equivalent of a Master's degree in Information Systems from the University of Münster. Supervisory board: Dr. Marlies Horstmeyer (chairwoman of the board), Marcel Gogolin (vice chairman), and Renate Fleischmann. Line of Business X-Ways AG specializes in developing and marketing software technology for computer forensics, data recovery, low-level data processing, and IT security, all on the MS Windows platform. Our software products deal with binary files, hard disk sectors, CD-ROM, DVD, and various other media, main memory (RAM), and PCM-encoded digital audio. Plus X-Ways offers computer forensics training as of 2004. Our Customers The majority of our customers reside in the USA (42%), followed by Germany (24%), UK (7%), France (6%), Switzerland (3%), and Canada (3%).
    [Show full text]
  • Design-In Guide for Swissbit Flash
    Design-In Guide for Swissbit Flash Application Note BU: Flash Products Date: 9 November 2012 Revision: 5 Content 1 OVERVIEW .............................................................................................................................................................. 5 1.1 TECHNICAL DOCUMENTS, REFERENCES .............................................................................................................................. 5 1.2 SWISSBIT SUPPORT ....................................................................................................................................................... 5 2 FLASH DEVICES: INTERNAL OPERATION .................................................................................................................. 6 2.1 PRINCIPLES OF OPERATION ............................................................................................................................................. 6 2.2 FLASH MEMORY ORGANIZATION..................................................................................................................................... 6 2.3 FLASH MEMORY CONTROLLER AND FIRMWARE.................................................................................................................. 7 2.4 FLASH MEMORY MANAGEMENT ..................................................................................................................................... 7 2.4.1 Blocks and Block Mapping .............................................................................................................................
    [Show full text]