X-Ways Software Technology Products

X-Ways Software Technology AG is a business incorporated under the laws of the Federal Republic of Germany as a stock corporation.

X-Ways is the leading developer and supplier of computer forensics software in Europe. Our software is used for computer forensics, electronic discovery, data recovery, low-level data processing, and IT security. Plus we offer computer forensics training and courses for our software and data recovery services.

Our main products WinHex and its forensic edition X-Ways Forensics have more than 35,000 registered users all over the world, including home computer enthusiasts as well as professionals in all kinds of businesses, public administration, education, U.S. federal law enforcement, government and intelligence agencies, and in the military. Excerpt from our official customer list (referenced with permission): Microsoft Corp., Hewlett Packard, Toshiba Europe, Novell Inc., National Semiconductor, Ontrack Data International Inc., KPMG Forensic, Ernst & Young, Siemens AG, Siemens Business Services, Siemens VDO AG, Infineon Technologies Flash GmbH & Co. KG, Lockheed Martin, BAE Systems, Ericsson, TDK Corporation, Seoul Mobile Telecom, German Aerospace Center, Visa International, Commerzbank AG, Technical University of Vienna, Technical University of Munich (Institute of Computer Science), Oak Ridge National Laboratory in Tennessee, German Aerospace Center, German federal bureau of aviation accident investigation, law enforcement agency of Lower Saxony, Australian Department of Defence.

X-Ways Forensics is an advanced work environment for computer forensic examiners and our flagship product. It runs under Windows 2000/XP/2003/Vista*/2008*/7*. Compared to its competitors, X-Ways Forensics is more efficient to use after a while, often runs faster, is not as resource-hungry, finds deleted files and search hits that the competitors will miss, offer many features that the others lack, ..., and it comes at a fraction of the cost! It is based on the WinHex hex and disk editor and part of an efficient workflow model where computer forensic examiners share data and collaborate with investigators that use X-Ways Investigator.

WinHex is in its core a universal hexadecimal editor, particularly helpful in the realm of computer forensics, data recovery, low-level data processing, and IT security. An advanced tool for everyday and emergency use: inspect and edit all kinds of files, recover deleted files or lost data from hard drives with corrupt file systems or from digital camera cards.

Davory undeletes files and recovers files from logically corrupted or formatted drives. Incorporates some of the data recovery techniques from WinHex and concentrates on ease of use.

Evidor is software for lawyers, law firms, corporate law and IT security departments, licensed investigators, and law enforcement agencies.

What it does

Evidor allows to search text on hard disks and retrieves the context of keyword occurrences on computer media, not only by examining all files (the entire allocated space, even Windows swap/paging and hibernate files), but also currently unallocated space and so-called slack space. That means it will even find data from files that have been deleted, if physically still existing. Evidor is a small subset of just the search functionality in X-Ways Forensics. Please note that Evidor cannot access remote networked hard disks. For a more powerful solution please use X-Ways Investigator.

X-Ways Capture is a specialized computer forensics tool for the evidence collection phase of a forensic investigation which captures Windows and Linux live systems. X-Ways Capture gathers all data from the running computer e.g. on an external USB hard disk, such that during the analysis even encrypted or otherwise protected data can be examined that was unlocked at the point of time when the system was acquired. X-Ways Capture saves you from returning empty-handed after pulling the plug and imaging hard disks the conventional way when you discover that the relevant files are encrypted! Plus you may be able to find passwords in main memory that X-Ways Capture dumps for you.

X-Ways Investigator is a powerful investigation/document analysis/report generation application for law enforcement, intelligence agencies, and the private sector. It runs under Windows. It was designed for investigators who are specialized in areas such as accounting, building laws, money laundering, corruption, homicide, child pornography, etc., also for investigative analysts, agents, attorneys, paralegals, prosecutors, internal and external auditors, for the analysis part of computer forensics and electronic discovery. X-Ways Investigator is based on X-Ways Forensics and is a subset thereof. It's simplified user interface offers much fewer technical options than WinHex and X-Ways Forensics, so that investigators can better concentrate on the matter at hand.

X-Ways Investigator is part of a certain philosophy: Splitting up the workload into preparatory work done by forensic computing specialists (computer forensic examiners) with X-Ways Forensics and investigative work done by investigators can be a pivotal change, greatly accelerate the forensic process and improve its quality. It reduces the computer specialists' workload by allowing the investigators to take over much earlier.

X-Ways Security is the shredder for the digital age. To protect your organization's confidential data or your personal privacy, trust on X-Ways Security as a hard drive cleansing solution. To maximize security, X-Ways Security offers up to 9 fully configurable overwrite passes and the U.S. Department of Defense (DoD) standard for hard drive sanitization as specified in the 5220.22-M operating manual.

X-Ways Trace is a computer forensics tool that allows to track and examine web browsing activity and deletion of files through the Windows recycle bin that took place on a certain computer.

This 3 day course is focused on the systematic and efficient examination of computer media using our integrated computer forensics software “X-Ways Forensics”.

Complete and systematic coverage of all computer forensics features in WinHex and X-Ways Forensics. Hands-on exercises, simulating most aspects of the complete computer forensics process. Attendees are encouraged to immediately try newly gained insights as provided by the instructor, with sample image files. Many topics are explained along with their theoretical background (e.g. how .e01 files work internally, how hash databases are internally structured, how deleted partitions are found automatically, with what methods X-Ways Forensics finds deleted files). Other topics are forensically sound disk imaging and cloning, data recovery, search functions, dynamic filtering, report creation, ... Emphasis can be put on any aspect suggested by the participants. You will receive complete printed training material for later repetition. Prerequisite: basic knowledge of computer forensics.

This 5 day course starts by following the 3 day X-Ways forensics course followed by focusing on File Systems for 2 days.

Extensive introduction to the file systems FAT12, FAT16, FAT32 (1/2 day), NTFS (1 day), and Ext2/Ext3 (1/2 day). By fully understanding the on-disk structures of the file system, you are able to recover data manually in many severe data loss scenarios, where automated recovery software fails, and to verify the correct function of computer forensics software and to collect meta information beyond what is reported automatically, which might yield clues for the given case. In general, this also leads to a better understanding of the data presented by forensic software, of how computer forensics software works and of its limitations.