Online Live Training / Virtual Class

Date: June 29-July 2, 2020 (4 days), Language: English.
Courses: File Systems Revealed

Online class hours, 2 sessions per day:
US Central Time (Chicago) 7:15-10:45am and 11:30am-3:30pm
US Eastern Time (New York) 8:15-11:45am and 12:30-4:30pm
UTC 12:15-15:45 and 16:30-20:30
GMT (London) 13:15-16:45 and 17:30-21:30
Central European Time 14:15-17:45 and 18:30-22:30
Attendees in other time zones are also welcome (help).

Course content

When Ses-
Content Avail-
1st session
1 Basics, data storage principles, navigating raw disk structures, templates, Data Interpreter, on-disk structures of MBR, GPT, and LVM2 Yes
2nd session
1 FAT12, FAT16, FAT32 Yes
Tuesday 2 NTFS and (~20 minutes) XWFS2 Yes
1st session
1 exFAT Yes
2nd session
1 Ext2, Ext3, Ext4 Yes
Thursday 2 XFS (full version, including more recent revisions using CRCs) Yes



You can sign up for any number of sessions between 1 and 8. 1 session is half a day. Please enter this number as the quantity. The more sessions you sign up for, the more you save. You can only sign up 1 attendee at a time, and would let us know your selected sessions by e-mail. We will reply and confirm your choice unless we are overbooked.

*availability not updated in real time


Rates & Terms

See price / sign up:  Gov   Regular 
Request formal quote:   Gov   Regular 

Please follow the above links to see the prices. Rates may change or become unavailable at any time! (And we do not announce in advance when that might be.) Please sign up early. The training is sold by our partner company cleverbridge. The number of seats is limited. First come, first served. A quote does not mean that a seat will be reserved for you! So please do not be surprised if you receive a notice saying that your quote was cancelled. It probably means that the class is fully booked (or maybe that the class itself was cancelled). A seat is reserved only when payment or a formal purchase order is received! With the purchase order option, payment must be received within 28 days from the date of the invoice. If you sign up someone else, please enter his or her name as the delivery contact. Thank you! 

How it works: Attendees will connect using the GoToMeeting application (free). Questions can usually be asked orally or in the chat window. All verbal and textual interchange is between all attendees and the instructor. You may be asked to share your screen with the instructor if you run into problems. To facilitate a virtual classroom environment more akin to that in a real one, course participants are asked to join the meeting with a webcam and microphone / headset, making them both visibly and audibly present in the course. X-Ways will not record the class. Participants are also asked to refrain from any voice or video recordings, for both copyright and privacy reasons.

Further details about required downloads (X-Ways Forensics software, images, training manuals, ...) will be provided in advance. Please make sure you will be undisturbed for the duration of the training!

Training provided by X-Ways Software Technology AG, Germany, the makers of WinHex and X-Ways Forensics.

Preconditions: To attend, you need to be able to set up X-Ways Forensics and know how to create cases and add disk images. If you choose not to attend the very first session, you should already be familiar with fundamentals of data storage (signed/unsigned integers, raw date formats like FILETIME or UNIX timestamps, Big/Little Endian), using the disk navigation functionality in XWF ("Go To Sector", "Seek FILE Record", etc.), and using the Data Interpreter and Templates for raw data interpretation. If you are not familiar with those, attending the first session is recommended. For participants in the XFS course, attending the Ext2/3/4 course on the preceding day is recommended.

Important: You need to use your own computer running Windows 7 or 10. You need to be connected to the Internet. Ideally you will use 2 computers or 2 screens, one for the presentation and one to run the application. A headset would be perfect to have so that you can give spontaneous oral feedback and ask questions, and do not transmit ambient noise as an ordinary webcam microphone would. We offer a temporary license for X-Ways Forensics with BYOD or BYOD+ for the duration of the class in case you don't have a dongle at hand.

Each training event needs to be confirmed by X-Ways. If the minimum number of attendees is reached, the class will be confirmed. If the event is not confirmed, you will get a full refund. The decision is made no later than 7 days prior to the first day of class (usually earlier), and if you are signed up you will be notified immediately. Status right now: confirmed

If no more spots are available and you would like to be on the waiting list (with no obligation for you), please send e-mail to Thank you!