Here it comes!

After a long and unexpected delay, the newest update to the X-Ways Forensics Practitioner's Guide online course is starting on February 1, 2022.

The course will be live streamed, two days a week, for the entire month of February with a few extra sessions of live interaction to discuss XWF (X-Ways Forensics) and workflows.

Course Goals

- Learn how to use to use XWF in the shortest time possible.

- See how to use shortcuts, workflows, and 'just show me how to do this' for all things XWF

- Integrate XWF with your other tools as no one tool does it all

- Go from Zero to XWF Hero in a stress-free environment

After course completion, the X-Ways Forensics Practitioner's Guide/2E (book) will be in print and sent to those who attended the course.  Attendees will also have a time limited access to the recorded sessions after the course is complete for reviewing sessions as needed.

Dates: Feb 1 - Mar 1

10:00AM - 12:00PM (PST)

Every Tuesday and Friday through March 1, 2022.

Who is this course for?

If you have never used XWF or tried and gave up, this course is for you. If you "occasionally" use XWF for one or two things, then you are missing out on some great features and this course is great for you too.

If you have considered using XWF, but are hesitating to jump in due to cost, this course will do you well to get started at a reasonable price (software is not included in this course, but the cost of this course will save you a lot of time and money!).

If you have been using XWF and want documented training, this is a chance to have documented XWF training from one who has been licensed and used XWF since it's inception, written a book about using XWF, and has been teaching XWF for a decade in university and corporate settings.

X-Ways Forensics is painful to use

There is no way to sugar coat it.  Many DFIR tools are difficult to use without training and XWF ranks in the tops of being difficult to figure out.

The frustration of paying thousands of dollars for a software, only to realize that you need more thousands of dollars to pay for training to learn it, after spending dozens of hours fighting with the software is difficult to accept.

But there is no other way unless you want to hammer XWF through hours and hours of trial and error, and even then, missing some of the most important features that you never knew existed.

My personal story with XWF

In DFIR, we can usually tell when someone started their time in the community by the version of the tools that began with.  For me, it was Norton DiskEdit, WinHex, FTK v1 and EnCase v3.  In my first college course for forensics, my exposure was pushing buttons with FTK and EnCase.  No one taught working in hex.  I struggled with WinHex and did not like it one bit.

WinHex didn't have any training courses and it was not even marketed as a "forensic" software. But, it was the best (only) option at the time for what it did.

Then X-Ways Forensics v12 was released!

Still, no training and the manual was (is) terrible for learning how to use it. That's when I decided to ask about hosting a training course in XWF, in the USA. My LE partner and I then made arrangements to host the first XWF course.  This was one of the better decisions in my life, since it made using XWF all the better.

I have seen many purchase and try to use XWF, only to give up and let their license lapse due to frustration. XWF is not a push button tool.  It does not automatically correlate data points with dozens of other devices or create picture-perfect timelines of interconnected devices.  You can make XWF do these things, but honestly, there are other tools better suited for those purposes.

XWF does was only XWF does. XWF gets deep in the data and you have hands on access unlike any other forensic tool. Knowing how to effectively use XWF adds a forensic skill that few, if any, other forensic tools can provide.

I look forward to seeing you in the course!