X-Ways crash after ...
 
Notifications
Clear all

X-Ways crash after keyword search Win 8.1

3 Posts
3 Users
0 Likes
581 Views
(@jrobert)
Posts: 12
Active Member
Topic starter
 

I just acquired a new forensic PC. It has a Asus Z97-PRO Desktop Motherboard - Intel Z97 Express Chipset - Socket H3 LGA-1150 and 16GB RAM and Windows 8.1.

I processed a case on my new PC, that I started on my old PC which was running Windows 7. After a keyword search on my new PC, when I tried to navigate to the hit list, X-Ways crashed. Repeated attempts resulted in the same crash. Upon restart I could navigate X-Ways but no hits were displayed. However, there is a search hit file in my case folder.

Today, I created a piece of test media, a 126MB USB drive. I put one MS word document on it containing two words to search for. I executed a keyword search for those words, X-Ways indicated that it found them, but when I tried to view the hits, X-Ways crashed.

In a second attempt, I indexed, and executed the keyword search in the index. Hits were displayed and I saved the case and closed X-Ways. When I reopened and tried to look at the hits, X-Ways crashed.

The Windows event log says "Faulting Application Name Xwaysforensics.exe" and Event ID 1000.

I have updated X-Ways to 18.2 and disabled my anti-virus.

I'm confident that this is a Windows 8.1 issue. Has anyone else experienced this?

 
Posted : 01/04/2015 12:16 am
EricZimmerman
(@ericzimmerman)
Posts: 222
Estimable Member
 

did you report it to x-ways? do you have the latest service release?

where is your case file saved? on a local drive?

 
Posted : 04/04/2015 8:46 pm
TuckerHST
(@tuckerhst)
Posts: 175
Estimable Member
 

In a second attempt, I indexed, and executed the keyword search in the index. Hits were displayed and I saved the case and closed X-Ways. When I reopened and tried to look at the hits, X-Ways crashed.

A lot of people don't know that X-Ways supports multiple instances. If X-Ways crashes, another instance can be started to analyze and/or recover the previous instance. You'll find emailing X-Ways with the error information and the forum at winhex.net (use your X-Ways license credentials) are your best resources for resolving any crash issue. Stefan and his team are very responsive.

 
Posted : 04/04/2015 10:11 pm
Share: