• Редактор для жестких дисков, дискет, CD-ROM/DVD, ZIP, Smart Media, Compact Flash и других
• Собственная поддержка для FAT, NTFS, Ext2/3, ReiserFS, Reiser4, UFS, CDFS, UDF
• Встроенное интерпретирование систем RAID и активных дисков
• Различные техники восстановления данных
• Редактор RAM, обеспечивающий доступ к физической RAM и виртуальной памяти прочих процессов
• Интерпретатор данных, опознающий 20 типов данных
• Редактирование структуры данных, используя шаблоны
• Объединение и разбивка файлов, соединяя и разделяя случайные байты/слова
• Анализ и сравнение файлов
• Полностью гибкий поиск и функции замещения
• Программирование интерфейса (API) and написание сценариев
• Кодировка AES, контрольных сумм, CRC32, случайных данных (MD5, SHA-1, ...)
• Надежное удаление частных файлов, очистка жесткого диска для защиты вашей частной жизни
• Перенос всех буферных форматов, включая ASCII hex
• Преобразование между бинарными, hex ASCII, Intel Hex и Motorola S
• Набор знаков: ANSI ASCII, IBM ASCII, EBCDIC, Unicode
• Мгновенное переключение между окнами
• Печать
• Генератор случайных чисел
• Поддержка файлов больше 4 Гбайт
• Высокая скорость работы.

File type detection and categorization significantly revised.

New metadata extraction feature, which allows to restore original file system metadata (such as filename, timestamps) when found in certain file types such as $I* recycle bin files and iPhone mobile sync backup indexes (Manifest.mbdx). Original filenames are typically much more meaningful than random names that are assigned just to guarantee uniqueness in a single directory for backup purposes. Examples of such random names are 3a1c41282f45f5f1d1f27a1d14328c0ac49ad5ae (for a file in an iPhone backup) or $RAE2PBF.jpg (Windows recycle bin). Support for more file types will follow. The current filename according to the file system is not completely lost, it can still be seen in square brackets in the Name column, as well as in Details mode, and the Name filter will conveniently find both the original and the current name.

Improved ability to uncover thumbnails from Windows thumbcaches. The process is now faster and produces much less redundant thumbnails especially for Windows 8 and 8.1 installations (only the highest resolution available for a set of thumbnails for the same picture). The new method is used when targeting thumbcache_idx.db files (which will in turn target the corresponding thumbcache*.db files) via the provided mask and not the thumbcache*.db files directly as in previous versions of X-Ways Forensics.

Support for a variant of thumbs.db files found in Windows 7 in certain constellations.

Performance of uncovering thumbnails in large JPEG files improved.

More precise truncation of incomplete or fragmented PNG files when carving.

Ability to extract embedded files from Photoshop thumbnail caches (Adobe Bridge Cache.bc), Canon ZoomBrowser thumbnail collections (.info), and Paint Shop Pro caches (.jbf).

Ability to uncover embedded pictures from the caches of Google's Picasa 3 image organizer and viewer software (thumbindex.db and related files).

Event extraction from Picasa 3.

Metadata extraction from IconCache.db files. Important Windows artifact that can help to prove executions of programs for example in malware investigations.

Extraction of forensically valuable metadata from PhotoShop PSD and INDD (Adobe InDesign) files.

Internal file carving algorithms for INDD, Bridge Cache and Picasa3 index files implemented.

Improved support for Magix Photo Manager Cache .mxc2 and .mxc3 and other files.

Internal graphics viewer now supports certain .bmp graphics with larger headers.

Some other improvements in the internal graphics viewer.

More metadata is now extracted from AVI video files, for example the codec and the IDIT creation timestamp or original filename, where available.

Metadata and internal file carving support for AMR voice recording files.

Ability to uncover various potentially relevant resources in 32-bit and 64-bit Windows PE executables (programs and libraries) as child objects, in particular RCDATA, named objects, bitmaps, icons and manifests. Useful for example for malware analysis. This does not happen automatically, only if you specifically target executable files via a suitable series of file masks.

Support for even more deeply nested (recursively forwarded) e-mail messages in OST/PST e-mail archives.

Ability to reconstruct e-mail messages from the Livecomm.edb database, which is used by the Windows Mail client (Windows 7 and newer) as part of the "uncover embedded data" operation. Also extracts contact and account information.

Unicode support for e-mail excerpt reconstruction from Thunderbird indexing databases.

Some minor fixes for EDB processing.

Fixed an exception error that could occur when processing SQLite databases.

[center] [/center]