Some Of The Features In More Detail
- Disk Editor, File Editor, RAM Editor
WinHex is an advanced binary editor that provides access to all files, clusters, sectors, bytes, nibbles, and bits inside your computer. It supports virtually unlimited file and disk sizes up to the terabyte region (thousands of gigabyte)! Memory usage is minimal. Speed of access is top-notch.
- Directory Browser for FAT, NTFS, Ext2/Ext3, ReiserFS,
CDFS/ISO9660, UDF
Similar to and as easy to use as the Windows Explorer's right-hand list. This browser lists existing as well as deleted files and directories, with all details. Allows to list cluster chains, to navigate to files and directories in the disk editor, and to copy files off the drive. Works on image files and partitions even if not mounted in Windows because of native file system support!
- Disk Cloning/Disk Imaging under DOS and Windows
WinHex produces sector-wise copies of most media types, either to other disks (clones, mirrors) or to image files, using physical or logical disk access. The copies are forensically sound, they include all slack space and all free space. Very important for forensic examiners because it allows to work on the copy. Image files can optionally be compressed or split into independant archives. WinHex can silently generate log files that will note any damaged sector it encounters during cloning. All readable data will make it into the mirror. WinHex lets you check the integrity and authenticity of image files before restoring them.
Besides, a DOS-based hard disk cloning and imaging tool is included. Most Windows environments tend to access a newly attached drive without asking, thereby e.g. altering the last access dates of some files. This is avoided under DOS. Requires a specialist or forensic license. X-Ways Replica
- Data Recovery
With its sophisticated disk editor, WinHex not only provides for manual file recovery. WinHex is also able to automatically recover files and even entire nested directory structures. There are several data recovery mechanisms integrated:
1. “File Recovery by Name”: Simply specify one or more file masks (like *.gif, Smith*.doc, etc.) and have WinHex do the rest. Works on FAT12, FAT16, FAT32, and NTFS.
2. “File Recovery by Type”: WinHex can recover all files that can be recognized by a certain file header signature (e.g. JPEG files, MS Office documents). This works on practically all file systems. Details
3. With the above-mentioned directory browser you can conveniently and selectively recover listed files and directories.
4. There is a special automatic recovery mode for FAT and NTFS drives, accessible via the Access button menu. Details
- Partition Recovery/Boot Record Recovery
WinHex lets you edit FAT12, FAT16, FAT32, and NTFS boot sectors as well as partition tables using tailored templates.
- Hard Drive Cleansing/Disk Wiping
WinHex can quickly fill every sector of a disk with zero bytes (or in fact any byte pattern you like, even random bytes), as often as you like (to maximize security). This effectively removes any traces of files, directories, viruses, proprietary and diagnostic partitions, etc and renders a disk “forensically clean”. Works in accordance with the standard outlined in DoD 5220.22-M (for details, please see this white paper).
WinHex can also securely erase specific files or unused space on a drive only. Besides, you can fill sectors with a byte pattern that stands for an ASCII string such as “Bad Sector” on the destination disk before cloning: This will make those parts of the destination disk easily recognizable that have not been overwritten during cloning because of unreadable (physically damaged) source sectors or because of a smaller source drive. (Alternatively, unreadable source sectors can be written as zero-filled sectors on the destination disk.)
- File Slack Capturing
Slack space occurs whenever a file's size is not evenly divisible by the cluster size (which is practically always the case). The unused end of the last cluster allocated to a file still contains traces of other, previously existing files, and often reveals leads and evidence. WinHex gathers slack space in a file, so you can examine it conveniently and coherently. Works on FAT12, FAT16, FAT32, and NTFS. Tools | Specialist Tools | Gather Slack Space. Requires a specialist or forensic license.
- Unused Space Capturing
Unused clusters, currently not allocated to any file or directory, also may still contain traces of other, previously existing files. WinHex can gathers free space in a file, too, for later examination. Works on FAT12, FAT16, FAT32, and NTFS. Tools | Specialist Tools | Gather Free Space. Requires a specialist or forensic license.
Please also visit our partners sites :
