Быстро, однако, новый релиз вышел. Нашёл информацию о том что нового:
WinHex and X-Ways Forensics again run on Windows 98/Me. However, full functionality under Windows 98/Me is not guaranteed, and we can't assist with problems that are specific to these OS versions.
* Indexing: With a forensic license, it is now possible to create an index of all words in all or certain files in a volume snapshot, for partitions that have been associated with a case as an evidence object (see Search menu). This is a time-consuming process and will require large amount of drive space. However, once completed, the index will allow you to conduct searches very quickly and spontaneously.
As a unique feature, our indexing procedure optionally supports substrings, which is particularly useful for languages like German, Dutch and Swedish that make heavy use of solid compound words, enabling you to find e.g. "paper" in "newspaper" and "card" in "bankcard".
Please note that the indexing algorithm is still in a testing stage.
* A totally new concept for reviewing search hits has been introduced. Available when working with a case. It supersedes the two main output methods known from logical searches before and combines the best of both worlds:
From the former "List search hits" output option it inherits the ability to see search hit offsets and a context preview, the ability to see more context in Sectors or File mode by simply clicking a search hit, and to specially flag important search hits.
From the former "Table of files with hits" output option it inherits the ability to see all properties of the files that contain the hits (i.e. all columns known from the directory browser), the ability to use a filter in conjunction with the search results, e.g. to view hits in all .doc and .xls files with certain timestamps only, and the ability to copy, view, tag or comment on files.
* The new search hit review concept allows to list search hits based on any position and level in the directory tree, e.g. all search hits in files in \Documents and Settings and subdirectories of the same, and even search hits from all evidence objects of the entire case at the same time, using the case root window.
* Also it's possible to conveniently select one or several search terms for search hit viewing, in the search term list in the Case Data window. Like that it's also an easy task to find out how many search hits there are for any given search term for any hierarchy level in the case tree.
* The new search hit lists are "dynamic" in that they are composed "on the fly" depending on selected search terms, current filter settings etc. and in that they can be non-destructively "thinned out" with the directory browser's context menu such that each file with at least one hit is listed no more than once. This allows to use the search hit list conveniently to copy files to one's own hard disk or to an evidence file container without duplicates.
* Search hits can be marked as notable with the directory browser context menu or by pressing the Space key. With the Space key you may also remove such a mark. The keyword list allows to create a quick overview of all hits marked as notable.
* Ability to enter Unicode-based search terms (e.g. in Chinese, Russian, ...) directly for physical and logical simultaneous search.
* There is now a true Unicode context preview for search hits.
* Context preview now also available for hits in free space.
* Display for error messages in message boxes and the messages window improved that involve Unicode filenames.
* There is a new display mode "File", a mixture of the Sectors mode and the Open command in the directory browser context menu. It utilizes the lower half of the screen just like all other modes do and looks similar to Sectors mode, but only covers the clusters/contents of the currently selected file, not all sectors of a volume. Just like the Open command in the directory browser context menu, File mode has an offset column relative to the beginning of the file, it follows file fragmentation, and it shows the decompressed version of NTFS-compressed files. It's generally more convenient than the Open command, e.g. to navigate to file slack, because it takes fewer clicks to get there and leave again.
* Clicking search hits that are associated with relative offsets only (i.e. results of a logical search, with no corresponding physical offset, which can be seen for NTFS-compressed files, and generally results of an index search) will automatically activate File mode as in Sectors mode such search hits cannot be shown at all. Also for those rare hits in a file that are fragmented across non-contiguous clusters only File mode will highlight the hits and show their context correctly, Sectors mode can't.
* Fragmented files on UDF volumes now supported.
* User-defined comments on a file can now be viewed even if the Comments column is not visible, when the mouse cursor hovers over the file's icon.
* Ability to copy selected text in the messages window to the clipboard. The text will be available in both Unicode and ASCII.
* Ability to recognize BitLocker volumes of Windows Vista Beta as such.
* Ability to tag files in a recursively explored case root.
* Multiple sessions on a CD formatted with CDFS/ISO9660/Joliet are now listed simultaneously instead of only one at a time. Optionally (see Directory Browser Options), X-Ways Forensics can now list the ISO9660 directory tree even if a Joliet directory tree is present, too, which is useful e.g. if the Joliet part is damaged because of bad sectors.
* Ability to export a list of all words that are contained in the above-mentioned search index, e.g. to create a custom dictionary for an individual dictionary password attack. Search | Export Word List.
* Evidence files that are images of large disks can now be opened much faster.
* Ability to _group_ tagged and untagged items. Allows to conveniently review tagged items as a whole.
* X-Ways Forensics now shows the directory browser even for volumes with unsupported, unknown or unrecognizable file systems. In such a case, there will be just a fictitious "Idle space" file that covers all drive space. The Refine Volume Snapshot command, however, can then be used to find files based on header signatures, to be listed with generic names in the "Path unknown" directory. Also Preview mode and Gallery mode will be available. (forensic license only)
* Ability to conveniently list thumbnails that are directly incorporated in JPEG pictures, using Refine Volume Snapshot's search for embedded pictures. Those will be listed as fictitious JPEG files with the original filename and "Thumbnail" appended.
* When copying files from the Case Root including the path, the names of the disks/images involved are recreated in the output location as directories, so that there can be no doubt about which files originate from what evidence object.
* X-Ways Forensics now issues warnings when it takes a snapshot of a FAT volume and when in existing directories it encounters active FAT directory entries that appear to be corrupt for certain reasons.
* On bootable CDs that are compliant with the El Torito specifications, X-Ways Forensics can now usually find and list the boot volume if a recognizable file system on its own.
* Entropy test for encryption fine-tuned (less false positives).
* Fixed an error in the search scope option "Up".
* When decoding the text in PDF documents for a logical search and no text is found (e.g. because the PDF document is composed of graphical data only, which can be readable text but will not be recognized as text), the ability to detect this situation and issue a warning has been improved. (since v12.9 SR-1)
* Most PDF documents can now be recovered "by type" with their original, correct size. (since v12.9 SR-2)
* Problem with heavily fragmented $MFTs on NTFS volumes with certain characteristics addressed. This may have caused incomplete file listings. (since v12.9 SR-12)
* Many other minor improvements and fixes.
Список впечатляет.
)
