WinHex is in its core a universal hexadecimal editor, particularly helpful in the realm of computer forensics, data recovery, low-level data processing, and IT security. An advanced tool for everyday and emergency use: inspect and edit all kinds of files, recover deleted files or lost data from hard drives with corrupt file systems or from digital camera cards.
- The virtual "Path unknown" directory on NTFS volumes is now
often much better organized. It identifies files and subdirectories whose
original parent directories are unknown but known to be the same. Such
files and subdirectories are now collected in the same generically named
virtual directory, which makes it easier to get an idea what that
directory might have been and more quickly identify relevant and
irrelevant files. Applies to newly taken volume snapshots only.
- The thorough file system data structure search on NTFS volumes now often
turns up even more traces of previously existing files than before,
including even more earlier names and earlier paths of renamed/moved
files. (forensic license only)
- Support for dynamic volumes defined on GUID partitioned (GPT) disks.
Such dynamic volumes can be used under Windows Vista and the 64-bit
versions of Windows XP and Windows 2003 Server.
- Now automatically finds all partitions on hard disks that have both
valid GPT and MBR partition definitions.
- Ability to conveniently find the e-mail message that contains the
selected attachment, via the directory browser context menu, not for AOL
PFC. (forensic license only)
- Extracted metadata were previously added to the Comments column. Now
there are a separate column and a separate filter for metadata, and the
Comments columns is now reserved for the examiner's own comments.
- Metadaten extraction from RTF, MP4, 3GP, M4V, M4A, RIFF files (.wav,
.avi, ...) and IE cookies. (forensic license only)
- Intelligent file size detection for MP4, 3GP, M4V, M4A, MOV, DBX during
file header signature search.
- File Header Signatures.txt further expanded.
- PDF documents with old, invisible versions of the same document are now
associated automatically with a special report table once viewed in
Details mode or once internal metdata has been extracted from them.
(forensic license only) Once aware that old versions exist, well-versed
users can make them visible if needed.
- Extracts the internal creation timestamp from Internet Explorer cookies,
Norton Ghost .gho and PGP pubring.pkr keyring files. (forensic license
- Ability to preview/view INFO2 files as well as most SPL printer spool
files. Ability to automatically extract EMF files from multi-page SPL
printer spool files (see Refine Volume Snapshot). (forensic license only)
- Ability to control NTFS compression for raw image files in File | Create
Disk Image: none, sparse, or normal.
- Correct conversion from/to the Windows code pages between 50220 and
- When viewing a file externally that was already copied to the directory
for temporary files before for viewing and still exists there, it is not
copied again any more.
- New investigator.ini option: Prevent taking new volume snapshots.
- Fixed an exception error that could with very long image file paths and
- Same fix level as v14.6 SR-2.
- Several minor improvements.
Tools and Utilities
Product page: here