F-Response Collect, X-Ways, and You

Jun 09, 2026

I wanted to take the time today to circle back around to something we talked about last year. For those of you using F-Response Collect to perform automatically resuming, long distance forensic collections, last year saw the inclusion of a new integration with X-Ways Forensic. While you could already use the device (volume, disk, memory, and mft) images F-Response Collect creates in X-Ways, it was not possible to do the same with profile and custom collections.

Our standard format for these collections is something we call FCTAR. It's an internally designed archive similar to the historical Tape Archive Format (TAR). We provide functionality in F-Response Collect to extract these FCTAR archives to the destination of your choice. However, we've had some Collect customers ask about extracting individual files or doing more in-depth processing of the FCTAR archive contents without extraction.

To do this we needed a more robust analytical tool.

So, we reached out to our strategic partner, X-Ways, and asked about how we could go about getting the two products working better together to process FCTAR files. What we wanted was a simple way for X-Ways to understand our format and allow an end user to leverage the analytical powers of their tool in combination with the data F-Response collects.

They recommended building an "X-Tension" dynamic link library (DLL) that understood the FCTAR format and could help X-Ways display and process the contents.

So that's exactly what we did. You'll find details on the new DLL, including how to leverage it in X-Ways on our website. The library itself is part of your F-Response Collect Examiner tool installation.

All you need is F-Response Collect, X-Ways Forensics, and the following mission guide on how to make them all work together.

F-Response Collect and X-Ways Forensic In Action

Thanks!

Warmest Regards,

Matt