WinHex is in its core a universal hexadecimal editor, particularly helpful in the realm of computer forensics, data recovery, low-level data processing, and IT security. An advanced tool for everyday and emergency use: inspect and edit all kinds of files, recover deleted files or lost data from hard drives with corrupt file systems or from digital camera cards.
- Better structured and more visually appealing representation of internal
file metadata in Details mode for various file types.
- Support for true Unicode filenames for the examination of Zip, RAR, and
7zip archives. Note that for Zip archives with true Unicode filenames to be
processed correctly, you need to pick the correct code page in the case
properties first. E.g. for Zip archives created under Linux, that's likely
UTF-8. For Zip archives created under Windows in Asia, that's likely a
regional code page.
- Better support for very large archives in excess of 2 GB. Some other minor
improvements in relation to archive handling.
- Some minor improvements/fixes for e-mail processing, concerning filename
conflicts, e-mails with unusual line-break formats, Pegasus Mail and
- The option to not include free drive space in otherwise complete
sector-wise images of partitions/volumes is now available in X-Ways
Forensics, too, not only in WinHex when run with a specialist or forensic
license. It's now included in X-Ways Forensics because more selective
instead of complete acquisitions may be preferable or even required in
certain jurisdictions and because certain prosecutors wish to limit
examinations to existing files anyway. Special precautions help to avoid
unintentional use of this option.
- Ability to filter out those previously existing items only whose first
cluster is known to be unavailable (most notably the so-called "X
files"), by using a new third state of the checkbox entitled "List
previously existing items".
- Ability to focus on files that have child objects with the Attribute
- Whenever one or more filters are active that actually filter out items in
the currently displayed directory browser, the two blue filter symbols in
the directory browser's caption line are now clickable and allow you to
deactivate all filters with a single mouse click, to ensure you are not
missing any file. This was a frequently requested feature. Comments on the
actual implementation are welcome, by e-mail or in the computer forensics
section of the forum.
Tools and Utilities
Product page: here