Today editors are more flexible compared to those in earlier days. Among them, WinHex has a unique place because of its versatile built-in features. The list of the features available will vary depending on the version you licensed.
WinHex comes with a bundle of tools which can save your time and work. On the one hand, WinHex is not a regular editor - it can edit executable files in hex mode showing you even those non-printable characters, such as carriage returns, tabs, and some other special characters. On the other hand, you can perform data analysis from pieces of data recovered via Scandisk or Chkdisk. You can easily perform file recovery and undelete tasks by using its File Recovery utility.
Memory editing is a great bonus for gamers, who can cheat by changing some of the values in order to level up, or by boosting up the energy to be used during the game. Besides, you can check your system’s physical memory searching for malicious activity. This is truly helpful when you are performing forensic works on the system.
If you get tired of making identical disks for a standard installation, try with the Disk Cloning feature inside WinHex. With this tool, you can clone any physical media connected to your system. Furthermore, it allows you to choose which sectors you wish to clone, and compare files or full disks. Its permanent deletion utility will give you extra privacy when sharing your system. WinHex supports deconstructing RAID 0-5 with a maximum of 16 components.
Take some time to read the manuals and the tips provided by experts before using this tool - inexperienced persons may easily make a mess of their computers when using this powerful tool.
v18.3 [May 14, 2015]
What's new in v18.3?
(please note that most changes affect X-Ways Forensics only)
Usability
Conditional cell background coloring is now available as an option in Options | Directory Browser. Helps to draw your attention to items of interest without having to filter out all non-matching items. Matching items are found through a substring search in the cell contents of a selected column. Substring expressions may be up to 15 characters long. If a match is detected in a cell, either only the background of that particular cell can be colored (called "cell-targeted coloring") or the entire line. To color an entire column, regardless of the cell contents, activate cell-targeted coloring for that column and specify an empty condition string, i.e. no condition at all.
If a cell meets multiple cell-targeted conditions or multiple line-targeted conditions, only the first condition of each group will be applied. If different conditions apply to the same cell (one cell-targeted and one line-target color), that cell will be shown in a mix of both colors. For line-targeted coloring, only the first 255 characters in the respective cell are guaranteed to be searched.
Conditions cannot be defined for search hit specific columns, but for event specific columns. That can prove useful when trying to identify patterns in events. For example, you could color all events of type "Program started" in red and log-in events in yellow and see more easily how far apart from each other they are.
Conditional cell background coloring is case-specific if "Store directory browser settings in cases" is selected. The definitions are stored in a separate .cfg file named "Conditional Coloring.cfg". They are also included in .settings files. .settings files continue to be compatible with previous versions. Up to 255 conditions may be defined.
Some conditional color definitions for event lists that follow the SANS color scheme for activities are available for download to users of X-Ways Forensics and X-Ways Investigator (query your license status for the latest download instructions).
Automatic progress notifications via e-mail revised. If this feature didn't work for you in previous versions, in particular in the 64-bit edition, you may want to try again. You can now freely specify the SMTP port (by default 25, with 587 also being common) and conduct a test right from the dialog window with the settings (Options | General | Progress notification...). Remember to check your spam folder when looking for incoming automatically generated e-mail messages.
Larger thumbnail sizes supported in the gallery. Could be useful for users who prefer really large thumbnails and have a very high resolution display.
Ability to more easily print at least the cover page for file types which the viewer component does not support, for which it shows the message "The display engine for this format is not installed", e.g. Corel Draw or Wave files.
Ability to enable or disable the representation of a loaded viewer X-Tension in situations where it was not supported before.
Combined tag status now initially displayed in Name column header even in search hit lists and event lists.
Ability to totally remove excluded items from the volume snapshots of all the evidence objects that are included in an existing recursive exploration in the case root window, in a single step. Previously, that had to be done separately for each evidence object.
Automatically selecting the next item in the list after associating the current item with a report table is now optional. A 3-state checkbox allows you to do that either never or only for associations created with keyboard shortcuts or for all association methods.
No longer lists previously existing printers in print dialogs.
Chinese translation of the user interface updated.
Share images, video and music between your Android and Windows devices
