Jedson Technologies

Products/Services

X-Ways Forensics X-Tension: XwaysKPF_x64.dll (Semantics 21 variant: Semantics21_x64.dll) (ZIUZ variant: XTension_ZIUZ_x64.dll)

The baseline X-Tension for X-Ways Forensics (a single DLL file) was designed for law enforcement agencies and requires a licensed version of X-Ways Forensics to be running. This DLL is called from within X-Ways Forensics, normally after a volume snapshot has been refined. The baseline X-Tension produces XML reports and copied file folders that are compatible with 'C4All'. The additional 'variants' were added in response to specific needs, based on the advanced features available in various follow-on categorization applications. These variants provide output files and folder layouts that are slightly different from the original 'KPF' variant.

For those that are curious, this DLL (or Dynamic Link Library) is similar to an executable in that it is compiled machine code which runs as quickly as a normal executable, but shares its program space with the executable which loads this DLL. Because it is not a script which must be parsed and processed at run-time, the speed and performance of the DLL can be astonishing.

Essentially, X-Ways loads the DLL, then is able to call specific functions in the DLL in response to user actions and the refinement process. The DLL in turn, can call a host of functions in the X-Ways Application Programming Interface (or API) as per here. Calling these API functions from within the DLL, and the link provided back to X-Ways Forensics. is the root of the processing power of the DLL and is what allows it to run 'as-one' with X-Ways Forensics. Thus the DLL can extend the functionality of the main X-Ways Forensics executable for specialization and product customization, thus the concept of the 'X-Ways Forensics Extension', or more simply, 'X-Tension'.

The latest version of the X-tension can be found here, and the revision history can be seen here. To register your email address for update notifications, navigate to here.

For those who are members, a link to an article on Forensic Focus can be found here.

Here is a link to the presentation given at the 2018 Ontario Forensics Investigators Association (May) in Niagara Falls, ON, Canada:

OFIA - X-ways X-tension 2018

Enhancements

The following enhancements to the baseline version of the DLL are available in the full unlocked version:

Ability to include additional video file types beyond those originally processed by C4All (103 types versus 20 types)
Consolidation of multiple partitions into a reduced number of parent folders, namely one for each physical drive. This allows the X-Tension to be run against multiple cases with the results for each case (physical drive) placed into its own folder. For the baseline version, a single folder is created for each partition, regardless of their host physical drive
For image files which support more than one thumbnail (such as JPEG), the unlocked version will search the additional thumbnail images and compare against the hash database to find notable files. If one is found, the parent file (i.e. the JPEG) will then be promoted to notable if not already. This parent and the notable thumbnail will be added to a 'Verify' table for quick inspection from within X-Ways
Currently implementing support for ProjectVIC® which will change the format of the output files to JSON (rather than XML used for C4All), and also change slightly the organization of the output folders. Additionally, embedded thumbnails will be stored in the same folder system as the rest of the images, using the thumbnail's own hash name rather than that of the parent from which the thumbnail was extracted. The first release to support JSON output is now posted as version 3.6.8.e. The next release will name those JSON files using a more generic 'ProjectVIC_xxx.JSON' to denote the output is not particular to any specific end-user application.
We will soon be adding support for LACE Image Mark calculations directly from within this DLL. To accomplish this, you must have a full license for the DLL, and another DLL issued by BlueBear LES, namely BBlaceIM_x64.dll. This additional DLL must be copied to the same folder as the Xways_KPF_x64.dll, and is only available as an option when ProjectVIC® Output is selected. The result will be a new entry in the JSON report for each image file, giving the ImageMark code which can then be exploited in the LACE software application.

The 'key' file

If you run the DLL as the baseline version, it will create a 'request' file (with the format XwaysKPF_NewKey_XXXXXX.req) where 'XXXXXX' are the first 6 characters of the X-Ways license ID. A full unlock 'key' file is generated based on this 'req' file, and thus becomes unique for your licensed X-Ways dongle (or your network license). It is not associated with any particular machine, and can thus be copied to any machine on which you plan to run your licensed copy of X-Ways. Simply copy the 'key' into the same folder as the DLL, and the DLL will find it. The 'key' file will unlock future releases of the DLL, as it is not tied to a particular version. Note that a 'key' generated for a particular variant (i.e. for a particular exploitation product) will not work with other variants.

Multiple licenses? No problem. Simply copy all of your 'key' files into the DLL folder on each machine, and the DLL will find the most recent, valid key. If it finds an expired key, it will even rename the extension to 'key_expired'. This allows you to see which keys are outdated and can deleted at your convenience.

Cost for a single, full license is US$250 per year, with discounts for additional licenses. Keys 2 through 10 for a single agency are discounted by US$35 each, with further discounts for subsequent licenses. For users with network licenses for X-Ways, the number of users for your network license determines the number of licenses you will need for the DLL, however only one key will be generated. In this case, the 'key' will unlock the DLL so long as the number of concurrent X-Ways users does not exceed the number of users authorized. The license does not need to be updated as new versions of the X-Tension are released.

If your agency is interested in larger numbers, please contact us at 'sales@jedsontech.com' to discuss an agency unique version of the X-Tension.

Currently the licenses can only be purchased directly from Jedson Technologies, as per the licensing information that can be found when the DLL is run and clicking the 'Full Version Info' button. This method also brings the user to the point where he can generate the 'request' file, which is required when purchasing a license.

Semantics 21 X-Tension: Semantics21_x64.dll

Under an agreement between Semantics 21 and Jedson Technologies we have produced a variant of the X-Tension designed to extract files and relevant metadata, and provide XML report files that can be used directly by Semantics 21 applications. By continuously working closely with Semantics 21, this DLL provides many benefits to both capability and performance tailored specifically to LASERi-p and LASERi-v. For more information on Semantics 21 products, visit here.

BlueBear LES LACE

LACE software provides back end analysis software as one of the options for the work flow currently using Xways and the XwaysKPF_x64 DLL. LACE is one of the first to take advantage of the JSON output now being produced by the DLL, and offers greater flexibility and features than the previous (legacy) C4All format of reports. In addition to supporting the ProjectVIC® compatible JSON files, we have collaborated with BlueBear LES such that they have created a DLL, provided by BlueBear specifically for their customers, which permits the XwaysKPF_x64 DLL to calculate LACE ImageMark codes on the fly (during DLL processing) and include these Image Mark codes into the JSON report in 'AlternativeHashes', alongside PhotoDNA if available.