StorageDigital Storage ForensicsHDD ForensicsImage hard drives through a write-blocker, find hidden areas and recover deleted data.X-Ways Software Technology AG
X-Ways Forensics
X-Ways Forensics is the German examination tool that runs light, starts fast and gives the examiner the raw disk alongside the parsed view. Version 21.9 was current when this page was checked.
SoftwareCommercialCurrentWindows
Profile
- Manufacturer
- X-Ways Software Technology AG
- Category
- Computer forensics
- Product type
- Software
- Platforms
- Windows
- Licensing
- Commercial
- Product status
- Current
- Educational level
- Advanced
- Last verified
- 2 November 2026
The maker's page lists version 21.9, supported Windows versions from 7 to 11 and Server 2008 to 2025 in 32-bit and 64-bit and states that the software is protected by a local dongle, a network dongle or BYOD. X-Ways Investigator is the reduced-interface version for non-specialist investigators. Perpetual or per-examiner terms are not spelt out on the pages checked.
What X-Ways Forensics is
X-Ways Forensics grew out of the WinHex hex and disk editor and still feels like one. The whole program installs in a small folder, runs from a USB stick if needed and shows every structure on a disk down to the byte. Its maker lists native support for FAT, NTFS, exFAT, Ext2 to Ext4, HFS+, APFS, XFS, Btrfs and others, interpretation of RAID, LVM2 and dynamic disks, disk cloning and imaging with read and write support for E01, logical acquisition into evidence file containers and fast physical and logical search. Carving, the recovery of files from unallocated space by their signatures, is a strong point.
Hashing is handled in bulk with MD5, SHA-1, SHA-256 and others, with hash set imports, FuzZyDoc for near-duplicate documents and PhotoDNA for law enforcement users. Viewers cover the registry, event logs, browser databases and email. An event list builds a timeline from file system, operating system and content timestamps. Report tables let the examiner tag items for the report. The licence is protected by a local dongle, a network dongle or a bring-your-own-device option, downloads are for customers only and trial licences are given only on request to law enforcement, government and certain corporations. The maker lists Windows 7 through 11 and Server 2008 through 2025, 32-bit and 64-bit, including PE and FE builds for boot environments.
Primary applications
Where it is used
- Detailed examination of computer images where the examiner needs the raw bytes as well as the parsed view
- File carving from unallocated space and slack
- RAID reconstruction and interpretation of complex volume layouts
- Hash matching against known-file sets and near-duplicate detection
- Timeline analysis from file system and content timestamps
- Running from a boot environment on a live machine with the PE or FE builds
Who uses it
- Experienced computer forensic examiners
- Data recovery specialists working on damaged file systems
- Laboratories that need a second, independent tool to verify another tool's results
- Advanced students of file system forensics
Capabilities and limits
Major capabilities
- Native support for FAT, NTFS, exFAT, Ext2 to Ext4, HFS+, APFS, XFS, Btrfs, ISO 9660 and UDF
- RAID, LVM2 and dynamic disk interpretation
- Disk cloning and imaging with E01 read and write, logical acquisition to evidence containers
- File carving and physical and logical search
- Mass hashing with MD5, SHA-1, SHA-256, hash set imports, FuzZyDoc and PhotoDNA (law enforcement only)
- Registry, event log, browser database and email viewers
- Event list timelines and a calendar view of activity
- Report tables, multi-examiner case management and an X-Tensions API for add-ons
- AI photo analysis through Excire Forensics
Technical limitations
- The interface assumes the examiner understands disk and file system structures; it is not a guided tool
- Memory analysis is listed only for older Windows versions and physical RAM cannot be opened under Windows Vista and later
- Downloads are for customers only and trial licences are not public
- Mobile device support is not a focus; phone extractions belong in another tool
- A dongle or network dongle is needed unless the BYOD option is used
Learning with DFRTI
Independent professional education covering the principles and workflows of X-Ways Forensics. DFRTI is not a vendor training centre and its courses are not vendor certifications.
Before you learn it
- File system internals: MFT, directory entries, allocation and slack
- Hexadecimal reading and basic data structure interpretation
- Hashing and carving principles
Disciplines
Related tools
- OpenText Forensic (EnCase)EnCase Forensic, one of the oldest names in computer forensics, is now called OpenText Forensic (EnCase). OpenText says it is the same product, renamed to fit its cybersecurity portfolio.OpenText
- Exterro FTK Forensic ToolkitFTK is the Forensic Toolkit that AccessData built and Exterro has owned since late 2020. Today Exterro sells it as Exterro FTK in a standalone form and as FTK Central for teams, with FTK Imager alongside.Exterro
- Magnet AxiomAxiom is Magnet Forensics' main examination platform. It takes images and extractions from computers, phones, cloud accounts and vehicles into a single case and presents the artefacts side by side.Magnet Forensics
- AutopsyAutopsy is a free, open source examination platform that puts a graphical interface and ingest modules on top of The Sleuth Kit. For a student it is the first tool that shows a whole case from image to report at no cost.Sleuth Kit Labs
- The Sleuth KitThe Sleuth Kit, usually written TSK, is a C library and a set of command line tools for examining disk images and file systems. Autopsy is its graphical face. Working with TSK directly teaches what the graphical tools hide.Sleuth Kit Labs
- Arsenal Image MounterArsenal Image Mounter, or AIM, mounts a disk image in Windows as a complete disk rather than a share, so Windows itself sees partitions, shadow copies and BitLocker volumes. The free mode covers mounting; Professional Mode adds virtual machine launch and more.Arsenal Recon
Courses that cover this tool
StorageDigital Storage ForensicsHDD ForensicsImage hard drives through a write-blocker, find hidden areas and recover deleted data.
StorageDigital Storage ForensicsFile System AnalysisRead NTFS, FAT, exFAT, ext4 and APFS at the structure level and build timelines.
StorageDigital Storage ForensicsRAID / NAS ForensicsImage RAID members, rebuild arrays virtually and examine NAS boxes after ransomware.
StorageDigital Storage ForensicsSSD / NVMe ForensicsHow TRIM, garbage collection and wear levelling change evidence on SSD and NVMe drives.Related reading
- SSDs, TRIM and What Happens to Deleted DataOn a hard disk a deleted file usually sits where it was until something overwrites it. On an SSD the drive itself may clear it within minutes. This explainer covers TRIM, garbage collection and wear levelling, what a forensic image of an SSD really contains and why file carving so often comes back empty.Explainer
- Hash Verification in Digital EvidenceA hash value is the one number that lets a court trust that the copy examined is the copy seized. This tutorial covers which algorithms to use and why, when to hash, how hash sets work, how to verify an image against its source and how to write hashes into the chain of custody and the report, with a worked synthetic example.Technical tutorial
Official source
Product names and trademarks belong to their respective owners. DFRTI is an independent educational and research institute. Inclusion in this directory does not imply manufacturer endorsement, partnership or authorisation. Facts are checked against the manufacturer's public documentation on the date shown and may have changed since.
Go deeper with DFRTI
Free pages explain the ground. Structured courses, lab work and a mentor take you from knowing about it to doing it on a case.