I read the manual to understand that encrypted file contents and names in 7Z archives are not currently supported in XWF. XWF is capable of using an associated program to manually review these archives.
Category: digital forensics
Totally Remove Excluded Items in XWF, Selectively
Using report table associations to totally exclude selected items from a XWF volume snapshot.
Metaspike CTF, Week 2
Week 2 of Metaspike's CTF 2022 competition. Now with more guessing!
Metaspike CTF, Week 1
Week 1 of Metaspike's CTF 2022 competition.
XWF Tool Tip, File Existence
The symbol ∃ means “there exists.”
Extracting Data from the Event Payload from .evtx Event Logs with X-Ways Forensics
Today I learned that quotation marks in the Event Log Events.txt file is not a good thing, and what text qualifiers are.
BitLocker and Connected Storage Devices
BitLocker use and related prefetch files for connected storage devices.
Selectively Hashing Files in X-Ways Forensics
Hashing file(s) with X-Ways Forensics.
Initialize $MFT Records… with WinHex
Using WinHex to initialize $MFT records.
Previous Versions of the X-Ways Forensics/WinHex Manual
Using Wayback Machine to look at previous versions of the X-Ways Forensics/WinHex user manual.
mr_eerie 