Compared to heavily automated forensic suites, X-Ways continues emphasizing transparency, deep artifact access, carving precision, and technical control, which is why many advanced examiners still prefer X-Ways for deeper artifact validation and analysis.
Here are several reasons to update
- Advanced MPEG and AVIF Carving
X-Ways 21.8 introduces major improvements to carving support for MPEG video variants along with dedicated carving support for AVIF image files. This helps investigators recover fragmented, partially deleted, or damaged media files that may not be recoverable with traditional carving methods.
- Native AVIF and Improved HEIC Support
The internal graphics display engine now supports native loading and analysis of AVIF image files while also improving HEIC compatibility and rendering. Updated PNG and JPEG library support further improves handling of modern image evidence.
- AI-Generated Image Detection
X-Ways 21.8 improves the identification of AI-generated or synthetically modified images using additional micropattern recognition techniques and enhanced picture analysis capabilities.
- Automated BitLocker Decryption
The software can now automatically apply previously discovered BitLocker recovery keys to newly opened encrypted partitions within the same case.
- Enhanced BitLocker Security Option
A new security option controls whether BitLockers passwords and keys that you enter manually or that are found automatically (BEK and recovery key files) or that match when trying out passwords from a list are centrally stored in the case (on disk).
- Enhanced UFDR Mobile Artifact Extraction
X-Ways can extract certain messages in UFDR archives as events from databases categorized as:
- Instant Messages: Android
- Instant Messages: Phone
- Chats: Native Messages
- Chats: Kik Messenge
- OCR and Decoded Text Portability
Decoded document text and OCR-derived text can now be stored directly inside evidence file containers. Recipients of those containers can immediately perform fast logical searches without rerunning OCR or text extraction.
- Improved Windows Event Log (EVTX) Parsing
X-Ways 21.8 includes revised parsing of Windows Event Log files with improved output of event data and greater stability when handling damaged or corrupt EVTX files.
- exFAT Recovery and Filesystem Resilience
The software can now detect and work with exFAT file systems even when the primary boot sector has been overwritten, provided the backup boot sector remains intact.
- Sector-Based File Size Diagnostics
A new sector-aware notation system allows file sizes to be displayed in sector-aligned units. This helps investigators quickly identify potentially truncated, carved, or partially corrupted files.
- Long Path and Enterprise Storage Support
X-Ways now supports overlong UNC network paths that exceed traditional Windows path limitations.
- Advanced Stability and Processing Recovery
The software can now monitor potentially hung processing threads during volume snapshot refinement and automatically terminate and resume stalled operations when needed.
Additional Important Improvements
- configurable binary report output
- improved hash database auditing
- TAR hardlink and symlink recognition
- enhanced .eml attachment extraction
- Improved interpretation of picture aspect ratios