X-Ways Forensics review
A deep Windows forensic toolkit with broad evidence analysis and case-management features.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
X-Ways Forensics is a Windows desktop application for computer forensic examiners handling investigations across law enforcement, government, corporate, and specialist settings. Its scope covers disk imaging and cloning, raw and virtual disk image analysis, filesystem examination, deleted-partition identification, file carving, data recovery, memory-dump analysis, keyword search, evidence tagging, reporting, and case work. The application can run from a USB stick without installation, which suits portable forensic workflows.
The licensing structure supports either a one-year non-perpetual license or a perpetual license for indefinite use. The non-perpetual option is immediately usable with BYOD or BYOD+ and was listed at AUD 2,130 during research. The perpetual option is dongle-based or available with BYOD and was listed at AUD 5,469. The pricing page states that sales are final and generally does not accept returns. Both options are paid, so X-Ways Forensics is primarily suited to professional teams and practitioners who need a dedicated forensic environment rather than a free investigative utility.
Its strongest fit is deep Windows evidence examination. The published capabilities extend from physical disks, RAIDs, and filesystems to ISO, VHD, VHDX, VDI, VMDK, iTunes backups, and data imported through compatible third-party mobile tools. Investigators can index and search evidence, export search hits, manage cases, collaborate with multiple users, and produce HTML, tab-delimited text, or XML reports. Memory forensics, RAID and dynamic-disk interpretation, carving, and the X-Tensions programming API add breadth for specialist work. However, the Windows-only platform and paid licensing narrow its audience, while mobile workflows rely on compatible third-party acquisition tools and add-ons. Choose it for comprehensive Windows-focused forensic examination; consider an alternative if cross-platform operation or a self-contained mobile workflow is the priority.
X-Ways Forensics pros and cons
- Where it wins
- Analyzes physical, raw, ISO, VHD, VHDX, VDI, and VMDK evidence
- Combines carving, memory analysis, search, tagging, and reporting
- Supports multi-user case collaboration and an X-Tensions programming API
- Where it doesn't
- Runs on Windows only
- No free plan; licenses are paid
- Mobile evidence analysis depends on compatible third-party tools and add-ons
X-Ways Forensics fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update