WinHex 14.7

Posted on Saturday, January 19 2008 @ 20:26 CET by

WinHex is in its core a universal hexadecimal editor, particularly helpful in the realm of computer forensics, data recovery, low-level data processing, and IT security. An advanced tool for everyday and emergency use: inspect and edit all kinds of files, recover deleted files or lost data from hard drives with corrupt file systems or from digital camera cards.

What's new?
  • The virtual "Path unknown" directory on NTFS volumes is now often much better organized. It identifies files and subdirectories whose original parent directories are unknown but known to be the same. Such files and subdirectories are now collected in the same generically named virtual directory, which makes it easier to get an idea what that directory might have been and more quickly identify relevant and irrelevant files. Applies to newly taken volume snapshots only.
  • The thorough file system data structure search on NTFS volumes now often turns up even more traces of previously existing files than before, including even more earlier names and earlier paths of renamed/moved files. (forensic license only)
  • Support for dynamic volumes defined on GUID partitioned (GPT) disks. Such dynamic volumes can be used under Windows Vista and the 64-bit versions of Windows XP and Windows 2003 Server.
  • Now automatically finds all partitions on hard disks that have both valid GPT and MBR partition definitions.
  • Ability to conveniently find the e-mail message that contains the selected attachment, via the directory browser context menu, not for AOL PFC. (forensic license only)
  • Extracted metadata were previously added to the Comments column. Now there are a separate column and a separate filter for metadata, and the Comments columns is now reserved for the examiner's own comments.
  • Metadaten extraction from RTF, MP4, 3GP, M4V, M4A, RIFF files (.wav, .avi, ...) and IE cookies. (forensic license only)
  • Intelligent file size detection for MP4, 3GP, M4V, M4A, MOV, DBX during file header signature search.
  • File Header Signatures.txt further expanded.
  • PDF documents with old, invisible versions of the same document are now associated automatically with a special report table once viewed in Details mode or once internal metdata has been extracted from them. (forensic license only) Once aware that old versions exist, well-versed users can make them visible if needed.
  • Extracts the internal creation timestamp from Internet Explorer cookies, Norton Ghost .gho and PGP pubring.pkr keyring files. (forensic license only)
  • Ability to preview/view INFO2 files as well as most SPL printer spool files. Ability to automatically extract EMF files from multi-page SPL printer spool files (see Refine Volume Snapshot). (forensic license only)
  • Ability to control NTFS compression for raw image files in File | Create Disk Image: none, sparse, or normal.
  • Correct conversion from/to the Windows code pages between 50220 and 50230.
  • When viewing a file externally that was already copied to the directory for temporary files before for viewing and still exists there, it is not copied again any more.
  • New investigator.ini option: Prevent taking new volume snapshots.
  • Fixed an exception error that could with very long image file paths and names.
  • Same fix level as v14.6 SR-2.
  • Several minor improvements.

Program Information

Category:
Tools and Utilities
Type:
Shareware


Version:
14.7
Size:
1.31MB
Works on:
Windows


Product page: here

Download: WinHex 14.7



Loading Comments