Evidence file containers

* A new evidence file container format was introduced. The new format can be understood by computer forensic tools other than from X-Ways. Older versions of WinHex (with a specialist license or higher), X-Ways Forensics and X-Ways Investigator can also understand it. They can all read the contents of all files and show the most essential metadata (e.g. filename, path, many attributes, most timestamps, existing or deleted). To see the maximum amount of metadata as known from the old format, however, please use WinHex/XWF/XWI 16.3 and later. For compatibility purposes you can still create containers in the old format.

* The new format will prevent that the same files will be erroneously copied twice to the same container.

* Writing and reading very large containers could be faster with the new format (still to be verified).

* Artificial directories can be optionally created in containers of the new format to accommodate child objects of files, for compatibility with tools that do not accept files as child objects of other files in the new container format (non X-Ways tools and WinHex/XWF/XWI 15.9 and earlier). WinHex/XWF/XWI 16.0 and later (latest release, respectively) do not need such artificial directories.

* Containers (both the old and the new format) now remember the valid data length of a file that originates from file systems that support this field even if it is not smaller than the logical file size.

* Files that are encrypted in NTFS or in Zip/RAR archives are no longer completely skipped when selected for inclusion in evidence file containers. They are now included with their metadata, so that the recipient of the container can easily see that there were encrypted files originally. The encrypted data is still not copied for such files. The outer Zip/RAR archives that use encryption for some or all files that they contain are fully copied, of course, and have always been copied.

* Initial zero values bytes are now skipped when copying the slack of a file to an evidence file container separately, and marks that object in the container as an excerpt.

File header signature search

* The individual default file sizes of the file header signature search are now specified in bytes instead of KB for more precise carving. That is useful especially when not carving complete files, but just records, entries, micro-formats, main memory network traffic artifacts etc.

* Ability to search certain file types at the sector level and other file types at the byte level simultaneously. For that purposes, the flag "b" can be set in a new last column of the file header signature definition. Allows to search for whole files and entries at the same time.

* File header signature searches at the byte level can now also be applied to evidence objects that are physical disks (where partitioned areas are skipped because partitions are treated as additional evidence objects separately).

* Another flag "f" can be set in the new last column to indicate that the specified footer signature is used to find data that is not part of the file any more and should excluded. Ordinary footers are included in the carved file.

The "f" flag is useful for file formats that do not have a well defined footer, where the end of the file can be detected by the occurrence of data that does not belong to the file any more. That could be the same signature as the header (if files of that type occur typically in groups, back to back) or just \x00 (for file formats such as text files that do not contain zero-value bytes, where however \x00 can be expected with a high likelihood in the RAM slack). Such footer signatures should be marked as exclusive because the data matched by it is not part of the file itself.

* The option to search for file header signatures just a cluster boundaries has been discontinued.

* Some minor improvements.

upgrade ffmpeg to 0.9

Several minor bug fixes

* Updated "Put IE icon on Desktop" under Tweaks tab to work with Win7 and IE9.
* Due to popular demand, replaced HijackThis with OTL on the Malware tab and added to Ketarin default profile.

Music Keys In The Pattern Editor Can Now Be Played With The Mouse To Hear A Note Or Voice Play Without Having To Add A Note To The Pattern And Play The Pattern To Hear It.

Fixed Problems With VST PlugIns With A Non-Unique UniqueID By Loading Of Correct Machine By Comparing PlugIn Name When Loading A Project. The Project File Format Has Changed To Support This And So Older Versions Of DarkWave Studio Will Not Be Able To Load Projects Saved By This Version.
Fixed Playing Of Notes With The Mouse With The Pattern Editor Not Responding To Quick Successive Clicks.
Fixed A Bug In The WaveOut Driver Of The 64 Bit Version Which May Have Caused Crashes Or Inability To Play Audio Output On Some Systems.