Tyrhex 2.2

Tyrhex is a software designed to help users understand file systems forensics and compare the results produced by other forensic software. It can also be used to investigate damaged devices and explain the results in courtroom scenarios. The categories for Tyrhex include DB Tools, Debugging Tools, Distribution, Help, IDE, and Webmaster Tools.

v2.2 [Mar 24, 2016]
As reaction to latest terrorist attacks, and to support law enforcement efforts, Tyrhex becomes free.
2.2 :
- help now expanded, including all interface shortcuts and core concepts
- text reporting reviewed, including detailed report for data stream with allocation anomalies if any
- export text report to a text file using main menu
2.1 :
- exFAT "orphan" 32 bytes entries better handled
- blocks allocation checked when opening allocation details
2.0 :
- case file can now be open from the finder
- locked volume « Home » button allows to open straight root folder (NTFS, FAT, exFAT)
- enhanced file stream description in properties view
- MBR extended partition handled and Extend Boot Record automatically marked
- NTFS data runs color coded : compressed (red) and sparse (green)
- first FAT table location now automatically bookmarked for FAT16/32 and exFAT
- $Bitmap location now automatically bookmarked for exFAT and NTFS
- jump straight from one block to associated bitmap position and vice-versa
- FAT long file names now rebuild also for deleted entries
- exFAT fully implemented including bitmap allocation "file"
- exFAT deleted files can be recovered, including not overwritten fragmented ones
- enhanced exFAT entries detection on damaged volumes
- file system type detected or selected when analysing file entry shown in entry properties
- modification of allocated blocks for volumes « catalogs » file or file entries are now editable and stored. When modified, associated bookmark or volume entry is listed in red color
- when selecting an offset, existing bookmark and volume (if any) are automatically selected