F-Response Collect and X-Ways Forensics - New X-Tension DLL coming soon

Jul 15, 2025

Quick update today for those of you using F-Response Collect to perform automatically resuming long distance forensic collections. While you could already use the device (volume, disk, memory, and mft) images F-Response Collect creates in X-Ways Forensics, it was not possible to do the same with profile and custom collections.

Our standard format for these collections is something we call FCTAR. It's an internally designed archive similar to the historical Tape Archive Format (TAR). We provide functionality in F-Response Collect to extract these FCTAR archives to the destination of your choice. However, we've had some Collect customers ask about extracting individual files or doing more in-depth processing of the FCTAR archive contents without extraction.

To do this we needed a more robust analytical tool.

So, we reached out to our strategic partner, X-Ways, and asked about how we could go about getting the two products working better together to process FCTAR files. What we wanted was a simple way for X-Ways to understand our format and allow an end user to leverage the analytical powers of their tool in combination with the data F-Response collects.

They recommended building an "X-Tension" dll that understood the FCTAR format and could help X-Ways display and process the contents.

After a few days of design and testing, I'm pleased to report we've got exactly that ready for F-Response Collect customers to test.

All you'll need is F-Response Collect, X-Ways Forensics, our new dll, and an upcoming mission guide on how to make them all work together.

Sound interesting? Reach out and let us know. We'd be happy to give you early access!

Thanks!

Warmest Regards,

Matt