Today editors are more flexible compared to those in earlier days. Among them, WinHex has a unique place because of its versatile built-in features. The list of the features available will vary depending on the version you licensed.
WinHex comes with a bundle of tools which can save your time and work. On the one hand, WinHex is not a regular editor - it can edit executable files in hex mode showing you even those non-printable characters, such as carriage returns, tabs, and some other special characters. On the other hand, you can perform data analysis from pieces of data recovered via Scandisk or Chkdisk. You can easily perform file recovery and undelete tasks by using its File Recovery utility.
Memory editing is a great bonus for gamers, who can cheat by changing some of the values in order to level up, or by boosting up the energy to be used during the game. Besides, you can check your system’s physical memory searching for malicious activity. This is truly helpful when you are performing forensic works on the system.
If you get tired of making identical disks for a standard installation, try with the Disk Cloning feature inside WinHex. With this tool, you can clone any physical media connected to your system. Furthermore, it allows you to choose which sectors you wish to clone, and compare files or full disks. Its permanent deletion utility will give you extra privacy when sharing your system. WinHex supports deconstructing RAID 0-5 with a maximum of 16 components.
Take some time to read the manuals and the tips provided by experts before using this tool - inexperienced persons may easily make a mess of their computers when using this powerful tool.
v18.5 [Sep 2, 2015]
Disk & Image Support
Support for Virtual Box disk images (VDI) of the default subtype "sparse" and the subtypes "fixed size" and "diff" (snapshots). Snapshot images as usually can only be interpreted if the parent is available and open and interpreted itself.
It is now possible to interpret images of various kinds (unsegmented raw images and most VHD/VMDK/VDI) and nature (disk/volume) even if they are stored within other images (forensic disk images created by yourself), without copying them off the outer image first. That can save a considerable amount of time, especially if after interpreting the contained image you can quickly see that it is not really relevant, and of course also drive space. First right-click the image in the directory browser and open it with the context menu's Open command in a separate data window. After that, use the command Specialist | Interpret Image File As Disk in the main menu to interpret the image. And then, once the volume snapshot has been taken, if you think that the image is relevant, you can add it to the active case as usually with the "Add to active case" command in context menu of the data window's tab or with the Add command in the Case Data window's File menu.
When adding new evidence objects to the case, X-Ways Forensics now includes technical information about more than one Windows installation per partition in the evidence object properties if traces of more than one are found. That can happen for example if a Windows.old backup directory exists because of a Windows upgrade.
If partitions overlap, for example because one previously existing partition was partially overwritten by another partition, then a note is now displayed in the Messages window (only if you have the program number partitions by disk location). This note should make unsuspecting users aware of the possible consequences, for example make them realize that potential errors when parsing the file system in the overwritten partition might be normal and not a reason to ask for assistance.
Support for HFS /HFSJ/HFSX when searching for lost partitions. An extra effort is made to reject false positives automatically. Supports sector sizes 512, 4096, and 8192 bytes.
Some improvements for parsing exFAT volumes.
Support for Ext4 journals with 64-bit block numbers.
Usability
The Export List command now remembers its own notation settings, separate from the notation settings in the General Options. That is useful because the database or spreadsheet program of your choice in which you wish to import the data may not like the formatting that you prefer to see in the directory browser (e.g. fractions of seconds in timestamps, time zone bias, weekdays in dates, delimiter between date and time, integer digit grouping, ...). While the Export List dialog window is on the screen, the directory browser in the background reflects the notation settings of the Export List command, as a kind of preview.
For your 9 most important report tables, keyboard shortcuts are now defined also to remove associations from the selected files. Ctrl n adds the selected files to the related report table, Alt n removes the associations. Useful if you accidentally press the wrong key combination or if you change your mind about the classification of a file, and wish to preserve associations with several other report tables (otherwise you could of course simply press Ctrl 0).
Menu command to close the active case without saving it. Usually the case and volume snapshots of all open evidence objects are always saved, at latest when the evidence objects and the case are closed. This may be undesirable for example if you accidentally lost your carefully set tag marks (by untagging all, with a misdirected click in the column header) or if you accidentally lost report table associations (by pressing Ctrl 0 for all selected files). In such a situation it is just important to invoke the new menu command as soon as possible, before the auto-save interval elapses next time. Afterwards you can open the case again, and find everything as it was last time when the case was saved, which means that on average you will only lose half the amount of work that you get done within the auto-save interval, not everything.
Share images, video and music between your Android and Windows devices
