X-Ways Forensics, X-Ways Investigator, WinHex 20.9 released

What’s new in v20.9

What’s better than 5 hash databases? Right, 6 hash databases. In addition to 2 conventional hash databases, a block hash database, a FuzZyDoc database and (if eligible) a PhotoDNA hash database, you can now maintain a database of recurring files that you have descriptions of. For example that may be useful if you are required to include descriptions of illegal photos in your case reports for the court. If the same photos occur in multiple cases, the new database can save you work and make it unnecessary to view the photos again. Whatever you enter as comments can be saved in the database along with the corresponding hash value. For that to happen you select the relevant files and invoke the command “Include in Hash Database” in the directory browser context menu. Whether hash values were already computed for the selected files is not important. They are computed on the fly if not. You can get the same comments back in another case if you match the hash values in the other case against the database as part of volume snapshot refinement.

The database is stored in the file “Hash Comments.txt”. You can easily share the database by simply sharing that file with other users. The file is independent of the conventional hash databases, meaning it does not matter which user has which conventional hash database with hash sets from which source(s). You do not need a conventional hash database at all to create a “Hash Comments.txt” file or match the hash values in your cases against the “Hash Comments.txt” file of someone else. So the “Hash Comments.txt” is quite universal and suitable for inter-agency exchange.

You can merge text files of different colleagues/sources with your own database in the user interface: Open the Tools | Hash Database dialog window and click the Import button. If X-Ways Forensics detects duplicate entries (same hash value), it will either keep the previous comment or adopt the new comment, depending on the state of a checkbox in the same dialog window. Keep that in mind when importing entries from other users. The rule also has an effect if duplicate entries are found within the same text file because you have merged entries manually.

Since we are talking about a simple text file, you can merge “Hash Comments.txt” files from different sources easily in a simple text editor, or edit the descriptions as needed, get them automatically translated etc. Just keep the general layout of 1 hash value + description per line intact. The first line (header line) in “Hash Comments.txt” must contain the designation of the hash type in ASCII (e.g. “MD5” or “SHA-1”), followed by a tab and the ASCII letters “Cmt”, and this is all case-sensitive. All the following lines start with a hash value in hex ASCII (both upper or lower case allowed), followed by a tab and the description in UTF-8. Both Windows and Unix/Linux line breaks are allowed.

Now 40,000 definitions of photo generating devices.

Support for compressed files with inline storage in APFS.

Some minor improvements.

Some of the fixes and improvements of v20.8 SR-1.