Exploring X-Ways Forensics 20.6 Beta 1b, Auto-Resume

Have you returned to a case you left to process overnight only to discover it was no longer running because of a crash? I have.

On 07/03/2022, 20.6 Beta 1 introduced a new feature that will enable X-Ways Forensics to automatically resume the volume snapshot refinement processes following a crash. I took a few moments to explore how the auto-resume feature works in 20.6 Beta 1b x64 and discover what I might anticipate using this feature when 20.6 is officially released.

Set-up

Auto-resume may be enabled by checking “Restart automatically after crash” in Options | Security.

The announcement for Beta 1 named two volume snapshot refinement operations that currently supports auto-resume: “file header signature search” and “processing of individual files”.

When enabled, the RVS process will resume from the last auto-save following a crash. The auto-save interval may be changed in case properties under Case Data | Edit | Properties.

In Preview and Beta releases only, repeatable crashes may be simulated by providing XWF a case-sensitive filename in the Security Options window. Optionally, non-repeatable crashes may be simulated by terminating XWF with the Task Manager.

Note: If, along with XWF, the watcher.dat process is terminated, XWF will not auto-resume.

Brief Observations

After setting up the auto-resume feature and initiating the volume snapshot refinement process, I simulated a crash by terminating XWF from the Task Manager. In a separate RVS process, I also simulated a crash by specifying a filename in the Security Options window. I explored this feature from the graphical user interface.

1. When XWF was terminated while performing a file header signature search, the msglog.txt file noted the file type and sector, then auto-resumed. Subsequent crashes added sectors to a list of sectors to omit.

2. When XWF was terminated while processing individual files, the msglog.txt noted the internal ID of the file. If parallelization was enabled, the msglog.txt file also noted the internal IDs of the files processed by each thread and the sub-operation. XWF resumed the process with no additional threads.

3. When XWF was configured to simulate a crash on a specific filename (Beta/Preview only), the msglog.txt file noted the internal ID of the file, then auto-resumed. Further, the filename was added to the report table, “Omitted, Reason for crash?”

Comment

Auto-resume capability, which may save time and potential headaches, is among many new functions/improvements to look forward to in XWF 20.6.