Order now, get quotes

Find out more about X-Ways Forensics X-Ways Forensics
Integrated computer forensics software
Find out more about X-Ways Investigator X-Ways Investigator
Investigator version of X-Ways Forensics
Find out more about WinHex! WinHex
  License types
  Forensic features
  All features
Find out more about X-Ways Imager X-Ways Imager
Disk imaging
Find out more about X-Ways Capture X-Ways Capture
Seize evidence
Find out more about X-Ways Trace X-Ways Trace
User activity
Find out more about Davory Davory
Data recovery
Find out more about X-Ways Security X-Ways Security
Permanent erasure

Contact X-Ways Contact X-Ways
User forum
Corporate info Corporate info
Find us on Facebook Find us on Facebook
  X-Ways Software Technology AG  

WinHex FAQ
(frequently asked questions)

How are the various user interface elements called?

Labelled here (German). The resizable rectangular area that appears when you open a file or disk is called a data window hereafter. Data windows are managed by the MDI interface that is common to many standard Windows programs.

Can you explain the menu structure?

1. Menu commands that help to manage the current case can be found in Case Data window's File menu and in the context menu that opens when you right-click the name of the case in the Case Data window.

2. Menu commands related to an evidence object can be found in the context menu that opens when you right-click the name of the evidence object in the Case Data window.

3. Menu commands that affect an entire search hit list or bookmark list or contents table can be found in their respective context menus in the Case Data window.

4. Menu commands that affect individual items displayed in the directory browser or in a search hit or bookmark list can be found in the context menu that opens when you right-click such items. You won't find such commands in the main menu.

5. Menu commands that either affect the binary data in a data window or the data window as such (and these are a lot), or that affect files or disks that are still to be specified (e.g. for opening, cloning, concatenating, ...), can be found in the main menu.

6. Menu commands specifically needed for computer forensics or IT security purposes can be found in the Tools and Specialist sections of the main menu. The commands in the Specialist section are only available with a specialist or forensic license.

How can I read or print the WinHex manual?

To open PDF files, please use Adobe Acrobat Reader or GSView.

What is the maximum file size WinHex can handle?

WinHex itself theoretically supports file sizes up to several thousand GB (no typo). Practically, file sizes are limited by the file system:

  • FAT16: 2 GB
  • FAT32: 4 GB
  • NTFS: virtually unlimited (several TB?)

Please note that removing/deleting or pasting/inserting bytes within such a large file may require the creation of a huge temporary file of almost the same size.

What is the maximum disk size WinHex can handle with its disk editor?

Up to about 1000 GB (WinHex 10.82 and before) or 2000 GB (WinHex 10.9 and later).

How can I recover all the files in a folder with the directory browser at the same time?

Right-click the folder instead of each file individually and select Recover/Copy. Please note that the ".." folder represents the parent folder, not the folder itself. To recover the folder, go to the parent folder and right-click the folder there.

An exception occurs at address 0012F... when I try to use the RAM editor. Why?

Other users who encountered this problem solved it like this:

“For nVidia users, in the Control Panel should be 'NVIDIA nView Desktop Manager'. Open it and uncheck the 'Enable nView Desktop Manager' and hit Apply and OK. Now, open the WinHEX and if you need, you can reverse the step above and check the 'Enable nView Desktop Manager'. Now you should have RAMedit and nView Desktop Manager active at the same time if you desire so. It seems that for RAMedit to work you need to disable the 'Enable nView Desktop Manager' when you open the winHEX.”

“My solution is: Remove all nVidia enhancements from windows(desktop explorer, etc). Now RAM editor works fine.”

“It was the Nvidia drivers, in particualar, I was getting other error messages from other programs pointing to nview.dll (ver  I uninstalled the drivers and upon rebooting installed fresh drivers and now it works fine.”

“I have the NVIDIA GeForce4 MX 420 card and the driver is version When my problem arouse with WinHex, it was also effecting a program called RamDisk XP by SuperSpeed Software. I also could not uninstall certain software using the uninstaller in the Control Panel. I then was receiving error messages pointing to nwiz.exe, and Nvidia file. I then uninstalled the Nvidia drivers and assorted files. Upon rebooting, Windows found new hardware and reinstalled the most current versions which were downloaded from Microsoft Update. I am not sure if the update benefited me or the reinstall of the Nvidia drivers, which could have become
corrupted. But upon reinstalling Nvidia drivers, WinHex, RamDisk and the Windows XP uninstaller all worked perfectly from that point on.”

How can I unpack the winhex.zip file?

Please use WinZip from http://www.winzip.com, WinRAR from http://www.rarsoft.com or an equivalent program to extract the files in the winhex.zip archive.

The text in edit windows moves strangely when moving the cursor. How to fix this?

Previous versions of WinHex in rare cases did not initialize with the correct font size. Select the font again in the General Options dialog. 

WinHex behaves strangely, e.g. does not start up correctly, displays no window, etc... what can I do?

Please try to start Windows again. If this does not help, please try deleting (or renaming) your winhex.cfg file before starting WinHex for full initialization. If this does not help either, you may also want to try installing again, or downloading and installing again. 

All data windows are empty! No hex or text data and no offsets are displayed. What can I do?

This problem can occur under Windows NT or Windows 2000 if a previous instance of WinHex terminated abnormally or after upgrading from a version prior to WinHex 9.6 to WinHex 9.6 or later. Please restart your computer or select a different font in the General Options dialog.

How can I safely remove confidential data from my hard drive?

You can use the command “Delete irreversibly” in the File Manager menu to shred certain files. To wipe an entire hard drive (with the result of everything being deleted), fill all sectors of the hard drive with zero bytes, optionally more than once.

Can anyone edit any hard drive's sectors using WinHex?

You cannot access remote hard drives (in a network) with the disk editor. And under Windows NT/2000, administrator privileges are needed to access local hard drives.

The buttons in the MS Office shortcut bar open the Office programs in WinHex. How can I repair this?

This is an inconsistency in the behavior of the MS Office shortcut bar that occurs in some cases in conjunction with WinHex appearing in the shell's context menu. Note that you can still run the MS software by right-clicking a button in the shortcut bar and selecting “Open” in the popup menu. This menu item should still be printed in bold, so it is not obvious why it is not the default command for this button any more.

To get rid of this problem, please disable “Add WinHex to the context menu” in the General Options dialog in WinHex. If this does not help, please run regedit.exe (the Windows Registry Editor) and remove the following entry manually:
"Edit with WinHex" under HKEY_CLASSES_ROOT\*\shell\

The information supplied on this page applies to the current WinHex version unless stated otherwise. Please direct any questions not answered here via e-mail, or post them in the WinHex support forum.

Forum topics: 1, 2, 3, 4, 5, 6