Try Buy
 
 
 

Evimetry X-Ways Plugin

NATIVE AFF4 ITEROPABILITY FOR X-WAYS FORENSICS.

 

 

Evimetry's filesystem bridge provides a straightforward and efficient way of consuming AFF4 images from any commercial forensic tool, and results in faster analysis & processing than legacy E01 forensic images. Despite this, it is convenient to be able to open AFF4 images directly from tools without having this dependency.

In October 2017 we worked closely with Stefan Fleischmann of X-Ways to define a plug-in API to support new forensic image formats, which X-Ways integrated in the 19.5 beta releases. We followed this up with the public release of this plugin in December 2017.

 
 

Usage

Make sure you are using X-Ways 19.6 or above. We recommend the x64 buid.

Download the current Evimetry AFF4 Reader Plugin for X-Ways (v2.0.7), and copy the contents into the X-Ways installation folder. Make sure you have the Visual C++ 2015 Runtime installed.

Dowload the Evimetry AFF4 Reader Plugin for X-Ways

 
 

Source code

The source code of the plugin is distributed under a liberal open source licence along with Evimetry's aff4-cpp-lite reader library. Improvements and patches are welcome.

 
 

History

v2.0.721 Aug 2019Add compatibility checks to ensure incompatible AFF4 images are gracefully dealt with.
v2.0.63 Jul 2019Add compatibility for non standard MQ Volume class type, so shift-open works in X-Ways.
v2.0.52 Jul 2019Support for out of order map entries generated by MQ/C-AFF4.
v2.0.425 Jun 2019Bump version and add more instructions to README. No changes in code.
v2.0.318 Jun 2019Revised release of plugin to support backward compatibility with pre-AFF4 Standard v1.0 images.
v2.0.29 Dec 2017First public release of plugin.

 

Want to learn more?

See Evimetry in more detail.