* It is now possible to search for more than 1 search time at a time in an index search. These hit counts are based on the current settings for the search hit list that is on the screen, take all filters into account, the explored path, any active AND combination etc. * It's now possible to see and copy the hit counts for selected search terms in the search term list. * Option to exclude the time-consuming search for FILE records outside of the $MFT from the particularly thorough data structure search in NTFS. Useful if you are interested or not supposed to look at deleted files. * Option to exclude deleted files from volume snapshots when the they are taken. Please don't confuse it with so-called deletion timestamps that other forensic tools may show you on NTFS volumes, for files that have not even been deleted from the file system. These is a very unique features, available for NTFS volumes. Even more deletion timestamps can be found when viewing/previewing $UsnJrnl:$J. * Often X-Ways Forensics can now also retrieve a true deletion timestamp for previously existing files during the particularly thorough file system data structure search. This deleted files can be listed with filenames, path, timestamps etc. * Even more deleted files can now typically be found on NTFS volumes and included in the refined volume snapshot when running the particularly thorough file system data structure search.
Please note that the volume snapshot format has changed, so that earlier versions cannot open volume snapshots saved by v15.4 and later. volume snapshot with a lot of files), allowing to open and analyze volumes with many more million files than in earlier versions (roughly 100% more) with the same amount of available main memory. * Considerably reduced main memory requirements for large volume snapshots (i.e. The download link can be retrieved by querying one's license status. A preview version of X-Ways Forensics 15.4 is now available.
0 kommentar(er)
