WinHex is in its core a universal hexadecimal editor, particularly helpful in the realm of computer forensics, data recovery, low-level data processing, and IT security. An advanced tool for everyday and emergency use: inspect and edit all kinds of files, recover deleted files or lost data from hard drives with corrupt file systems or from digital camera cards.
* Support for the exFAT file
system. (requires a specialist license or higher)
* Ability to interpret dynamic Virtual PC VHD images. (requires a specialist
license or higher) Such images can also be edited (in WinHex, not X-Ways
Forenscis), but not expanded.
* Ability to interpret .e01 evidence files with an internal chunk size of up to
256 KB (previously up to 128 KB). Useful for example for memory dumps created by
* Old versions of files that are found as part of the thorough file system data
structure search in volume shadow copies are now marked as (SC) in the Attribute
column and can be filtered. The old contents of old versions of large files will
be correctly represented in a future release. The file system level metadata of
old versions and the contents of small files are already usually correctly
* Old names/paths of renamed/moved files in NTFS as discovered by the thorough
file system data structure search are now by default no longer listed as
additional items in the volume snapshot and in the directory browser. Instead,
they are mentioned as comments that are attached to the renamed/moved files.
This keeps directory browser listings smaller and makes searches quicker than
* The Simultaneous Search now supports case-insensitive searches generally, not
just for English and German letters.
* GREP expressions may now contain true Unicode characters, and it is now
possible to search in specific code pages when using GREP syntax.
* The most important MS Office 2007/2010 and OpenOffice 2/3 document types are
now by default decoded for the logical search, and (in conjunction with the
recommended data reduction) their main XML files are omitted from the search.
That ensures that you get search hits in the documents and not in the XML files,
which is more convenient, and that you don't get them twice unnecessarily. The
other XML files, which may contain important metadata, are still searched
(provided that you have included the contents of archives in the volume
* Metadata extraction improved for Windows 7 .lnk files.
* Catalogs of JumpList files are now output in Details mode.
* Ability to recursively delete directory with subdirectories that cannot be
deleted with Windows Explorer or other Windows tools and commands because of
illegal characters, via Tools | File Tools | Delete recursively.
* Improved behavior when encountering already running instances. A new middle
state allows to decide on a case-by-case basis whether to start another
* There is now an option to filter by internal ID. Useful for example and very
easy to use if you would like to focus on the x files that were added to
the volume snapshot last or if you would like to resume a logical search with
internal ID y (and filter out files that have already been searched).
Program Information Category:
Tools and Utilities Type:
Shareware Version: 15.7 Size: 1.51MB Works on: Windows