Technology
X-Ways Forensics
X-Ways Forensics works close to the structure of the storage medium. That is valuable wherever the question is not what a processed view shows, but what the file system metadata actually records.
Where it is used
- Analysis of NTFS, FAT, exFAT, APFS, HFS+, ext file systems and disk images
- Evaluation of several timestamp sets and detection of inconsistencies between them
- Recovery of deleted files through directory entries and through file signatures
- Verification of results produced by other tools
Limits
- Overwritten areas remain unrecoverable, regardless of the tool used.
- Signature-based carving produces files without reliable metadata.
- Encrypted volumes require the key or a lawful means of access.