Is anyone using Windows 7 or Vista with Xway forensic suite?
I am looking to buy a new PC but it looks like it's questionable how it will run on there. Can someone clarify if they are using it and what specs they have?
Thanks again
reedsie,
I haven´t tested XWF on Vista or Windows 7, but see bottom of
I'm running X-Ways on a Win 7 machine. There are limitations as mentioned on the X Ways site…
*Full functionality supported on Windows 2000/XP/2003 Server. Compatibility with Windows 98/Me lost gradually since v12/v13. Limitations under Windows Vista/2008 Server/7 Physical RAM currently cannot be opened. Ability to write sectors in partitioned disk areas not guaranteed. HPAs and DCOs cannot be detected. Slightly less information on physical hard disks in technical details report. Colored path feature in Case Data window not available. Install WinHlp32.exe (for Vista/for 7) to be able to use the program help. If you would like to execute X-Ways Forensics under Windows Vista with administrator rights, then please make sure that you do that explicitly."
Sounds like I should buy a used laptop with XP or do a dell downgrade. I can't see much benefit if there are limitations with Vista and Win 7. Hopefully Xways isn't a dud, sure seems like they would have fixed these issues since Vista has been out for a long while. Makes me wonder…
Sounds like I should buy a used laptop with XP or do a dell downgrade. I can't see much benefit if there are limitations with Vista and Win 7. Hopefully Xways isn't a dud, sure seems like they would have fixed these issues since Vista has been out for a long while. Makes me wonder…
Those issues listed relate to using X-Ways to acquire from a live Vista/Win7 system, not to conducting examinations on forensic images with X-Ways which thus far seems fine. X-Ways will use all the memory you give it, so you're going to want to use a 64bit OS anyway. The issue is that Vista and up seriously protect their resources in a way that XP didn't by limiting access to raw devices.
As for the HPA/DCO issue, you should have more acquisition methods than just X-Ways, including some way to deal with protected areas. Support for these features is currently not universal amongst forensic tools. Part of this is that to access a DCO requires making an alteration to the source disk. Depending on your school of thought, this is a bad thing, but then you're generally going to have to weigh up the competing issues of not making changes versus ensuring you obtain a complete image.