X-Ways Forensics Alternatives for Computer Forensics

X-Ways Forensics is the forensic suite built on the WinHex hex and disk editor. It is alive and sold today: the X-Ways Forensics page lists version 21.9, says it runs under Windows 7 to 11 and Windows Server 2008 to 2025, and stresses that it is fully portable and runs from a USB stick without installation. The order page prices a non-perpetual licence at $1,560 and a perpetual one at $4,035, with dongle and update-period options on top.

Examiners leave for three common reasons. The interface is dense and assumes you know where every option hides. Mobile, cloud and app parsing is thin next to the big suites. And some buyers want a free tool, or a vendor that publishes prices. The picks below run from the free option through the large commercial suites, then to Oxygen for phone-heavy labs.

Wireshark is not here because it analyses network traffic, not disk images. For acquisition only, X-Ways Imager and other imagers are covered in our FTK Imager alternatives guide.

Prices below are as of November 8, 2026. Our method is on How we review tools.

Quick comparison

Autopsy and The Sleuth Kit

Budget is the usual reason an X-Ways user opens Autopsy. It is free and open source, and the download page offers version 4.23.1 as a Windows 64-bit MSI on top of Sleuth Kit Java 4.14.0. It is the same engine PALADIN bundles on its boot media, so results are easy to cross-check.

It also brings something X-Ways does not: an MCP server over STDIO, added in 4.23.0 in April 2026, so an AI assistant can query a case.

Best for: Examiners and students who need a free suite and can live without a portable build.

Pricing:

• Free and open source

Watch out for:

• Autopsy installs with an MSI, so it gives up the run-from-a-stick portability that X-Ways users rely on.
• On a corporate laptop with EDR, expect slow ingest unless you exclude case and image folders, a problem the 4.23.0 notes call out.

Official site: Autopsy and The Sleuth Kit. Our listing: Autopsy and The Sleuth Kit.

Magnet Axiom

Axiom works the opposite way to X-Ways. Instead of putting the raw disk first, Magnet sells it as one case that recovers, analyses and reports on mobile, computer, cloud and vehicle data together.

Axiom Cyber is the edition for corporate and incident response work, and the Premier licence adds Griffeye Advanced for media review. The Axiom page lists no price and offers a free trial through a contact form.

Best for: Labs where cases mix computers, phones and cloud accounts and reviewers need artifact views, not hex.

Pricing:

• No public price; contact sales
• Free trial on request
• Editions include Axiom Cyber and Axiom Premier

Watch out for:

• There is no price to compare with X-Ways' $1,560 until a quote comes back.
• Locked phones need Graykey, a separate Magnet product that private companies cannot buy.

Official site: Magnet Axiom.

Belkasoft X

For buyers who like X-Ways' perpetual option, Belkasoft X keeps that model. The Belkasoft X page describes a perpetual licence and a free trial, and covers computers, phones, drones and car systems from DD and E01 images.

Phone acquisition goes further than X-Ways can. Acquisition routes include checkm8 on iPhones and APK downgrade on Android, and passcode guessing works on some models of both. Its Live RAM Capturer and Belkasoft Triage are free downloads.

Best for: Private labs that want one perpetual licence for both computer and mobile work.

Pricing:

• No public price; request a quote
• Perpetual licence; free trial
• Live RAM Capturer and Belkasoft Triage: free

Watch out for:

• X Forensic is sold to government customers only. Companies and private examiners get X Corporate.
• Brute force covers a range of devices, not all, so check your models against the support list.

Official site: Belkasoft X.

OSForensics

PassMark's OSForensics is the paid alternative with prices you can read. The OSForensics pricing page lists $95 a month or $945 a year per user, or a perpetual licence at $1,680 with 12 months of support and $3,675 with 36 months. A 30-day trial is free. Version 11 is current, and v10 owners upgrade free within their support period.

Each licence covers two machine installs, such as a lab PC and a laptop, plus one USB install, which keeps some of the portability X-Ways users expect. Features include indexed file search, deleted file recovery, HPA and DCO detection, Volume Shadow Copy browsing and a timeline viewer.

Best for: Small labs and consultants who want a known price and the option to pay monthly.

Pricing:

• Trial: free for 30 days
• Subscription: $95 per user per month or $945 per user per year
• Perpetual: $1,680 per user with 12 months of support, $3,675 with 36 months
• Site licence: by enquiry

Watch out for:

• Card-paid subscriptions renew automatically. Cancel under My subscriptions before the period ends.
• It is Windows only, and the Bootable edition is priced on request.

Official site: OSForensics.

Exterro FTK

FTK, the Forensic Toolkit, is built around processing up front. Exterro says FTK uses "a persistent, database-driven architecture," so evidence is indexed once and several examiners can search the same case. The FTK page also lists FTK Central for centralised processing and collaboration, and FTK Enterprise.

X-Ways users often meet FTK through its free sibling, FTK Imager. The full suite targets larger labs that want shared review, while X-Ways favours one examiner on one machine.

Best for: Teams that share large cases between several examiners and reviewers.

Pricing:

• No public price; physical and virtual FTK licences are sold through the Exterro store without listed prices

Watch out for:

• A database-backed design needs more setup and hardware than portable X-Ways, which runs from a USB stick.
• Ask for the current version and system requirements with the quote.

Official site: Exterro FTK.

OpenText Forensic (EnCase)

EnCase Forensic has a new name. The OpenText Forensic page says it "is the same product as EnCase Forensic," renamed to match OpenText's cybersecurity line. It covers collection, triage, analysis and reporting for law enforcement, government and enterprises.

The main draw for an X-Ways user is familiarity in court and in agency procedures, where EnCase evidence files and workflows are long established. It is on-premises software, licensed by USB dongle, on the network or with an electronic key.

Best for: Agencies and labs whose written procedures and training already name EnCase.

Pricing:

• No public price; contact OpenText

Watch out for:

• No price and no trial are offered on the product page, so evaluation starts with sales.
• The page lists "Off cloud" and "Private cloud" deployment while the FAQ calls it on-premises, so pin down the deployment model in the quote.

Official site: OpenText Forensic (EnCase).

Oxygen Forensic Detective

If phones, not hard drives, fill most of your case list, Oxygen Forensic Detective fits better than any computer suite. Oxygen claims support for over 35,000 devices and more than one hundred cloud services, and it also parses Windows, Linux and macOS artifacts, drone logs and IoT data.

Licensing is perpetual. Labs can share seats: one USB dongle can carry a network licence for 5, 10, 20 or 50 examiners at once. For other phone-focused suites, see the Oxygen Forensic Suite alternatives page.

Best for: Labs where mobile extractions outnumber computer images.

Pricing:

• No public price; contact sales
• Perpetual; single-user or network licence (5, 10, 20 or 50 connections)

Watch out for:

• The install guide sets a floor of 12 GB of DDR4 memory on 64-bit Windows with admin rights, far more than portable X-Ways needs.
• Neither a trial nor a price is shown on the product page, so the first step is a sales conversation.

Official site: Oxygen Forensic Detective. Our listing: Oxygen Forensic Detective.

How to choose

When to stay with X-Ways Forensics

Stay with X-Ways if you value its light resource use, which the vendor contrasts with heavier suites, a portable build that runs from a stick, and file system reach that covers APFS, Btrfs, XFS, ReiserFS and QNX next to the usual Windows formats. Its perpetual licence with updates to November 2027 is easier to plan for than a quote. The order page also sells X-Ways Investigator at $2,075 perpetual for reviewers who do not need the full toolset.

Frequently asked questions