WinHex 12.85

Posted on Tuesday, March 14 2006 @ 13:22 CET by LSDsmurf

Changelog:

Support for Unicode characters in file and directory names in most parts of the user interface, notably in the directory browser and the directory tree.
Newly created evidence file containers can now optionally incorporate filenames in Unicode instead of ASCII. For compatibility with older versions of X-Ways Forensics, stick with ASCII.
Support for the platforms Windows 95/98/Me has finally been discontinued. v12.8 remains the last version to run under those Windows versions.
When verifying file types based on signatures, no fictitious items with the presumed correct extensions are listed any more. Instead, the detected type can be seen in the new optional Type column. Only initially the Type column shows the same as the Extension column. The Category column is now based on the Type column, no longer on the Extension column. When a mismatch between filename and type is detected, either when refining the volume snapshot, when previewing files, or when viewing files in the Gallery, both the Type and the Category column are updated and turn blue.
There is also a new filter that conveniently lets you address files of selected types, in addition to the Category filter. (forensic licenses only)
Another new optional column indicates the status of the file type column. Initially "not verified". After checking for filename/file type mismatches: If a file is very small, the status is "don't care". If neither the extension nor the signature is known to the file type signature database, the status is "not in list". If the signature matches the extension according to the database, the status is "confirmed". If the extension is referenced in the database, yet the signature is unknown, the status is "not confirmed". If the signature matches a certain file type in the database and the extension matches a different file type or none at all, the status is "newly identified". A filter can be used on this column, too. (forensic licenses only)
The separate viewer component has been updated on March 3, 2006.
Ability to display timestamps with tenths of seconds in the directory browser. Useful for the file systems NTFS and FAT that provide for and even exceed this precision in all or some timestamps.
The volume snapshot data format has changed. Previously created volume snapshots can be converted automatically for use with v12.85 and later, except for ReiserFS/Reiser4 volumes. Should you encounter problems importing old volume snapshots, you can either recreate the volume snapshot from scratch (thereby losing comments, tags, discovered orphaned files, etc.) or continue using v12.8 for that case/image. Backup copies of the original volume snapshot files are left in the metadata subdirectories.
Support for drive/directory contents table creation has finally been discontinued.
The priorities when sorting by the Attribute column have been redefined.
Ability to maintain custom sections of the file type signature database separate from the main file in an arbitrary number of files named "File Type Signatures *.txt". These files are loaded in addition to the main file. Their internal format must be the same. Usage of such user-defined files prevents that your own definitions will be overwritten when you install an update.
NetBSD UFS now supported.
The structure of deleted nested subdirectories on Ext2 volumes is now often better represented.
ReiserFS volume snapshots are now taken faster.
Ability to include the contents of archives in a logical search when in a recursive view.
Slack data added to evidence file containers is now marked and sortable as slack in the Attribute column. You can hold the Shift key as before to add a file plus its slack, and now alternatively the Ctrl key to add _only_ the slack.
Ability to tag or untag an unlimited number of items at a time in a recursive view.
Ability to print case reports optionally with a user-defined header line, a logo, and a preface (see Case Properties, Report Options).
Ability to treat and display archives exactly like directories once their contents have been included in the volume snapshot.
This is reversible and can also be applied retroactively. One benefit is that archives are not subject to dynamic filters any more as are ordinary files, so it's easier to navigate to the contents of the archives when a filter is active that would normally filter out the archives. Another benefit is that archives turned into directories behave like directories when it comes to tagging.
Ability to convert packed 7-bit ASCII to readable 8-bit ASCII with a script command.
Right-clicking a file in the directory browser now updates the Preview area. (since v12.8 SR-6)
.tif pictures now included directly in the HTML case report, not as a link, as they can be displayed by Firefox. (since v12.8 SR-6)
When adding files to containers with the indirect method, the name of the externally output file is now checked better for compliance with Windows filename restrictions. (since v12.8 SR-6)
An error was fixed that on certain partitions prevented the fictitious "Free space" file from being read. (since v12.8 SR-8)
An error was fixed that in certain situations prevented the prompt for an output filename when exporting a file list from a recursively explored Case Root window. (since v12.8 SR-9)
Several other minor improvements.

Program Information

Category:
Tools and Utilities
Type:
Shareware

Version:
12.85
Size:
1.22MB
Works on:
Windows

Product page: here

Download: WinHex 12.85

Loading Comments