WinHex is in its core a universal hexadecimal editor, particularly helpful in the realm of computer forensics, data recovery, low-level data processing, and IT security. An advanced tool for everyday and emergency use: inspect and edit all kinds of files, recover deleted files or lost data from hard drives with corrupt file systems or from digital camera cards.

Changelog:

* Support for the exFAT file system. (requires a specialist license or higher)

* Ability to interpret dynamic Virtual PC VHD images. (requires a specialist license or higher) Such images can also be edited (in WinHex, not X-Ways Forenscis), but not expanded.

* Ability to interpret .e01 evidence files with an internal chunk size of up to 256 KB (previously up to 128 KB). Useful for example for memory dumps created by other software.

* Old versions of files that are found as part of the thorough file system data structure search in volume shadow copies are now marked as (SC) in the Attribute column and can be filtered. The old contents of old versions of large files will be correctly represented in a future release. The file system level metadata of old versions and the contents of small files are already usually correctly represented.

* Old names/paths of renamed/moved files in NTFS as discovered by the thorough file system data structure search are now by default no longer listed as additional items in the volume snapshot and in the directory browser. Instead, they are mentioned as comments that are attached to the renamed/moved files. This keeps directory browser listings smaller and makes searches quicker than before.

* The Simultaneous Search now supports case-insensitive searches generally, not just for English and German letters.

* GREP expressions may now contain true Unicode characters, and it is now possible to search in specific code pages when using GREP syntax.

* The most important MS Office 2007/2010 and OpenOffice 2/3 document types are now by default decoded for the logical search, and (in conjunction with the recommended data reduction) their main XML files are omitted from the search. That ensures that you get search hits in the documents and not in the XML files, which is more convenient, and that you don't get them twice unnecessarily. The other XML files, which may contain important metadata, are still searched (provided that you have included the contents of archives in the volume snapshot).

* Metadata extraction improved for Windows 7 .lnk files.

* Catalogs of JumpList files are now output in Details mode.

* Ability to recursively delete directory with subdirectories that cannot be deleted with Windows Explorer or other Windows tools and commands because of illegal characters, via Tools | File Tools | Delete recursively.

* Improved behavior when encountering already running instances. A new middle state allows to decide on a case-by-case basis whether to start another instance.

* There is now an option to filter by internal ID. Useful for example and very easy to use if you would like to focus on the x files that were added to the volume snapshot last or if you would like to resume a logical search with internal ID y (and filter out files that have already been searched).

Program Information Category: Tools and Utilities Type: Shareware Version: 15.7 Size: 1.51MB Works on: Windows Product page: here