Menu
  • Home
  • Brett's Blog
  • My Books
  • Courses
  • About Me
  • Contact
  • Home
  • Brett's Blog
  • My Books
  • Courses
  • About Me
  • Contact

Brett Shavers | Ramblings

Brett's Ramblings

Subscribe to blog
Unsubscribe from blog
Settings
Sign In
If you are new here, Register
  • Forget Username
  • Reset Password
Font size: + –
Subscribe to this blog post Unsubscribe
Report
Print
1 minute reading time (255 words)

X-Ways Forensics & eDiscovery

Digital Forensics
Brett Shavers
Saturday, 09 December 2017
3204 Hits
1 Comment

Following up on a discussion with an eDiscovery consultant, I wanted to show how X-Ways Forensics is a good (if not better at times) tool to have for the eDiscovery folks in ESI collection jobs.  Not that XWF can replace eDiscovery tools, but certainly can complement collection efforts.

I would even go as far to say that an entire eDiscovery matter can be done by solely using X-Ways Forensics depending on the case matter.  For example, if the collection just involves workstations and laptops (even many aspects of server collections), you may not only ‘get by’ using XWF, but can do a more thorough job of collection.  However, when you get into the cloud, XWF is not going to be your best choice for a collection tool.

Here is a short video on how you can use XWF to collect data in a given eDiscovery matter.  

And, Case Studies #5 is published. 

The promo for this week is $75 for the Case Studies series which includes:

  • X-Ways Forensics Practitioner’s Guide Online Course for FREE, and
  • Placing the Suspect Behind the Keyboard Course for FREE, and
  • Advanced Internet Investigations Course for FREE.

Register here (discount will be applied automatically) for the 2-day promo: http://courses.dfironlinetraining.com/series/training-bundle-psbkxwfaitcs?pc=cs-bundle-02-11-17

This promo is only good for 2 days!  The first time I did this promo, it was for 2 weeks and I under estimated the number of registrations.  From now the promos will be a lot shorter.  Get in while you can, you have 2 days this time and the clock has started….

Tweet
Share on Pinterest
0
Don’t look back.  Try to keep up.  This is #DFIR.
When you think you know enough

About the author

Brett Shavers

Brett Shavers

 

Comments 1

Brett Shavers
Brett Shavers on Thursday, 14 December 2017 05:20

Great, but no one will accept XWF skeleton images on ED cases. It may be easier to export data while keeping MAC time in tact and then re-image as an AD1 as I know a law firm will not want to or even be capable of doing such a thing. Forensic Imaging whole volumes is OK as E01 or even some others.

0 Cancel Reply
Great, but no one will accept XWF skeleton images on ED cases. It may be easier to export data while keeping MAC time in tact and then re-image as an AD1 as I know a law firm will not want to or even be capable of doing such a thing. [url=https://compute-forensics.com/forensic-imaging/]Forensic Imaging[/url] whole volumes is OK as E01 or even some others.
Cancel Update Comment
Guest
Tuesday, 28 June 2022

Captcha Image

By accepting you will be accessing a service provided by a third-party external to https://brettshavers.com/

direct link

DFIR Training

Be sure to check out my DFIR Training website for practically the best resources for all things Digital Forensics/Incident Response related.


Brett's blog

© 2022 Brett Shavers