X-Ways
·.·. Computer forensics software made in Germany .·.·
   
 


WinHex & X-Ways Forensics Newsletter Archive

(You may sign up for the newsletter here.)

#63: WinHex 11.2 released

December 16, 2003

This mailing is to announce a noteworthy update, WinHex 11.2.

Download URLs:
http://www.winhex.com/winhex.zip (all languages)
http://www.winhex.com/winhex-e.zip (English only)

-------------------------------------------------------------

What's new?

* Specialist | Create Drive Contents Table now allows output to the directory browser in WinHex in addition to MS Excel. That means you have an "all files view" of a logical drive or partition and can interactively sort by date, filename extension, etc., move to the clusters where the file is stored, recover a file, delete irrelevant items from the list, etc. However, the tab-delimited text file is still the more complete way of output.

* You can accelerate Create Drive Contents Table because the "thorough" search mode is now optional.

* Image file segments that are treated like a single disk image can now be written back to a disk in one swing. While the spanned image is open, it can be selected in the Clone Disk dialog window just as any other logical drive or physical disk. Also partitions individually opened in WinHex are listed as a logical drive in Clone Disk, even if not recognized by Windows.

* The option "Search in all open files" has been replaced with the more powerful "Search in all open windows", so even multiple disks or image files interpreted as disks can be searched at the same time.

* Templates now officially support a special flexible integer data type "uint_flex" that is composed arbitrarily from any of the 32 bits in a 4-byte range in any order. uint_flex is fully documented and supersedes "int_extract".

* Cluster list windows now offer another command in their context menu that copies the list to a text file.

* There is now a script command IfGreater that works analogously to IfEqual, but is meant for integer values only.

* Support for massively fragmented files on NTFS improved.

* Several minor improvements.

WinHex 11.2 is a free update for all users who purchased WinHex 10.5 or newer (e.g. online after July 30, 2002). If you do not qualify any more, please find out about online upgrading at https://www.x-ways.net/winhex/upgrade.html . Purchasing the current version (or upgrading) entitles you to receive updates released at least in the following 15 months at no cost. 

 

#62: WinHex 11.15 released

November 9, 2003

This mailing is to announce a minor update, WinHex 11.15.

Download URLs:
http://www.winhex.com/winhex.zip (all languages)
http://www.winhex.com/winhex-e.zip (English only)

-------------------------------------------------------------

What's new?

* An error was fixed that caused slack space initialization to erase allocated space if two or three overwrite passes were selected instead of the default single pass.

* Slack space initialization and extraction as well as highlighting slack space is now considerably faster on NTFS. Slack space initialization and extraction is now also available on NTFS partition image files and NTFS partitions opened from within a physical disk.

* X-Ways Replica 1.2, a DOS-based disk cloning tool that is free for owners of a WinHex specialist license, is now able to image disks and produce file segments of any size (e.g. 2 GB on FAT16). Such spanned image files can be interpreted by WinHex as a physical disk or logical drive. ( https://www.x-ways.net/replica.html )

* Some minor improvements.

WinHex 11.15 is still a free update for all users who purchased WinHex 10.47 or newer (e.g. online after June 4, 2002). If you do not qualify any more, please find out about online upgrading at https://www.x-ways.net/winhex/upgrade.html . Purchasing the current version (or upgrading) entitles you to receive updates released at least in the following 15 months at no cost.

 

#61: WinHex 11.14 released

November 3, 2003

This mailing is to announce a noteworthy update, WinHex 11.14.

Download URLs:
http://www.winhex.com/winhex.zip (all languages)
http://www.winhex.com/winhex-e.zip (English only)

There will be a public chat, hosted by the developer, on
Nov 5, 2003 at 17:30 CET +0100 (Berlin) =
Nov 5, 2003 at 11.30 am EST -0500 (New York) =
Nov 5, 2003 at 8.30 am PST -0800 (Los Angeles).
For details please see https://www.x-ways.net/winhex/forum/chat.html .

-------------------------------------------------------------

What's new?

* The scope of File Recovery by Type with the "thorough" option enabled can now be limited to certain sectors of a disk or image file.

* Integration with X-Ways Trace via menu commands. WinHex can now invoke X-Ways Trace and have X-Ways Trace open the currently active file or disk. Requires X-Ways Trace 1.5 SR-1 for full functionality.

* An error was fixed that caused WinHex to complain of the file type definition file for File Recovery by Type under certain circumstances although it was correct.

* An error was fixed that caused WinHex to save files recovered by File Recovery by Name in a folder other than the specified output folder on NTFS drives if the "thorough search"option was enabled.

* An error was fixed that caused WinHex to terminate itself or to show some other unnormal behavior when inspecting rare NTFS file record with circular references. (since v11.1 SR-3)

* An error was fixed that may have caused slack space initialization or extraction to be incomplete on an NTFS drive if the custer scan was outdated. (since v11.1 SR-4)

* Some minor improvements.

WinHex 11.14 is still a free update for all users who purchased WinHex 10.47 or newer (e.g. online after June 4, 2002). If you do not qualify any more, please find out about online upgrading at https://www.x-ways.net/winhex/upgrade.html . Purchasing the current version (or upgrading) entitles you to receive updates released at least in the following 15 months at no cost.

 

#60: WinHex 11.1 released

October 10, 2003

This mailing is to announce a major update, WinHex 11.1.

What's new?

* File Recovery by Type can now recover files of multiple types at the same time.

* Recovered files of each type can automatically be put in their own subfolder.

* File Recovery by Type can now also search for file signatures at _all_ offsets, not just at the beginning of clusters. This is useful when recovering files from backup conglomerate files or backup tapes where they are not aligned at cluster boundaries. This option also renders the recovery method easier to use because you don't
have to care about sector and cluster sizes. The downside of this approach, though, is an increased number of false positives (file signatures occurring randomly, not indicating the beginning of a file).

* File Recovery by Type is now easier to use anyway because most the parameters to recognize files by their headers and footers have been moved to a file type definition file.

* There are now 30 predefined file types, and the definition file may be fully customized and expanded, too.

* Compressed files are now displayed in blue color in the directory browser, encrypted ones in green. The cluster list is now more complete for compressed files and includes sparse segments. (since v11.0 SR-3)

* WinHex is now able to interpret even a *spanned* image file as a physical disk or logical drive and provide access to the partition and file system structure. (Tools | Disk Tools | Interpret File As Disk) Image file segments may be of any size. The first segment may have an abritrary name and a non-numeric extension or the extension ".000". The second segment must have the same base name, but the extension ".001", the third segment ".002",
and so on. The next version of the DOS cloning tool X-Ways Replica will be able to image disks and produce such file segments. This is useful because the maximum image file size supported by FAT16 and FAT32 is 2 GB or 4 GB, respectively.

* When converting a binary file to Intel Hex or Motorola S, memory regions still initalized with hexadecimal FFs will not be translated, so the resulting file is kept compact. (since v11.0 SR-4)

* In the WinHex API, the function WHX_SetErrorMode is still available for compatibility reasons, but has been renamed to WHX_SetFeedbackLevel. Use this function to suppress error message boxes as before, and also to suppress the small progress window that allows the user to abort or pause a running operation and may annoyingly steal the focus from your own application's window.

* Better support for very large and highly fragmented MFTs on NTFS drives.

* Several other improvements. For example, the "Invalid input" error makes it more obvious now what parameter exactly needs to be checked. Also display errors in message boxes on some rare computers with large systems fonts have been fixed now.

WinHex 11.1 is a free update for all users who purchased WinHex 10.47 or newer (e.g. online after June 4, 2002). If you do not qualify any more, please find out about online upgrading at https://www.x-ways.net/winhex/upgrade.html . Purchasing the current version (or upgrading) entitles you to receive updates released at least in the following 15 months at no cost. 

 

#59: WinHex 11.0 released

August 12, 2003

This mailing is to announce a major update, WinHex 11.0.

What's new?

* The disk cloning dialog window has been visually improved and more features have been added:

* Bad sectors often occur in contiguous groups, and each attempt to read a bad sector usually takes a long time. You may now have WinHex optionally avoid such damaged disk areas. When a bad sector is encountered, WinHex can skip a number of subsequent sectors you specify (25 by default). This is useful if speed is your primary concern and you do not care if a few actually readable sectors do not make it to the clone.

* In previous versions, sectors on the destination disk could optionally be filled with zero bytes in case of unreadable sectors on the source disk. Now you may specify any ASCII pattern of your liking, up to 32 characters long, such as your initials, or something like "BAD " (4 characters) or "!DAMAGED SECTOR!" (16 characters). The chosen pattern will also be used when the contents of an unreadable sector is displayed in the disk editor.

* The Access button menu now provides new menu items to "explore" a currently displayed FAT directory or NTFS file record of a directory. This allows to conveniently display a directory in the powerful directory browser even if it is no longer referenced from any other directory! You just have to find it in the disk editor.

* The preset file types for File Recovery by Type now allow to recover Outlook Express .dbx files, to recover the two JPG sub-types JFIF and Exif simultaneously, and to recover AVI and WAV files separately.

* File Recovery by Name has a new option that allows to recover files only that are *not* marked as deleted. This is useful if your files got lost other than by deletion, e.g. because of file system corruption. With that option you will recover only those files that existed at the time when the corruption occurred with no duplicates (like previously existing working copies, temporary files etc. that were deleted because they were no longer needed).

* Earlier versions of WinHex had problems initializing free drive space on compressed NTFS drives. This has been fixed.

* There are two new WinHex API functions: WHX_OpenEx and WHX_GetStatus. Please see https://www.x-ways.net/winhex/api/ for a description.

* During WinHex API usage, the automatic creation of internal backups is now completely disabled.

* X-Ways Replica 1.0 (included in a specialist license of WinHex) now has the option to log read errors silently in a file, without requiring user input, thereby writing a complete and reliable report about the cloning process, which sectors were copied successfully, which sectors were bad, etc. ( https://www.x-ways.net/replica.html )

WinHex 11.0 is a free update for all users who purchased WinHex 10.4 or newer (e.g. online after March 3, 2002). If you do not qualify any more, please find out about online upgrading at https://www.x-ways.net/winhex/upgrade.html . Purchasing the current version (or upgrading) entitles you to receive updates released at least in the following 15 months at no cost. 

 

#58: WinHex 10.92 released

July 14, 2003

This mailing is to announce noteworthy update, WinHex 10.92.

What's new?

* WinHex 10.92 contains all the improvements and corrections introduced with the WinHex 10.9 SRs. E.g. a multiple file encryption bug and the temporarily existing details panel's FAT interpretation bug was fixed. Warnings during initialization of slack space no longer require the user to click OK, so that the process can be run unattended over night.

* In X-Ways Replica 0.95 the "ignore al(w)ays" option for damaged source disk sectors was fixed. (X-Ways Replica is included in a specialist license of WinHex.)

WinHex 10.92 is still a free update for all users who purchased WinHex 10.25 or newer (e.g. online after Jan 22, 2002). If you do not qualify any more, please find out about online upgrading at http://www.winhex.com/winhex/upgrade.html . Purchasing the current version (or upgrading) entitles you to receive updates released at least in the following 15 months at no cost.

 

#57: WinHex 10.9 released

June 14, 2003

This mailing is to announce major update, WinHex 10.9.

What's new?

* The directory browser has become more powerful. Now it has a context menu with commands for
- opening a file or directory in WinHex,
- exploring a directory,
- locating the beginning of a file or directory on the drive,
- locating the corresponding directory entry or file record (respectively),
- listing the allocated clusters, and for
- easily recovering a lost or existing file or directory.

The latter allows to recover entire directory trees even on NTFS!

* When an NTFS file record is displayed on the screen, the Access button menu's Recover command is now also available if the file record defines a directory.

* On NTFS drives, the directory browser now conveniently lists all deleted files on the drive of which traces can still be found in a single dedicated virtual folder "Lost & Found". These are the same files that are also recoverable using File Recovery by Name with the "thorough search" option disabled.

* WinHex now supports extremely high screen resolutions with up to 128 lines (instead of 64) and 256 bytes per line (instead of 128) at maximum.

* The maximum physical disk and logical drive size supported by WinHex is now 2,000 instead of 1,000 GB.

* There is a new specialist tools menu command "Media Details Report" that lets you view and copy information about the active disk or file, e.g. for a report you are writing. Most extensive for physical hard disks, it points out details for each partition and even unallocated gaps on a disk between existing partitions.

* There is another specialist tools menu command that gathers unused inter-partition space on a hard disk in a file, for quick inspection if something is hidden there or left from a prior partitioning.

* Restoring compressed disk backups is now up to 5 times faster!

* Restrictions with respect to resizability of the main window and the edit windows have been lifted.

* A display bug was fixed that occured under certain conditions when moving other windows over edit windows in WinHex.

* The commands "Simultaneous Search" and "Drive Contents Table" now have their own toolbar buttons.

* The "Parameter is incorrect" error that occurred in some configurations when reading or writing disk sectors should be even more rare now. (since v10.82 SR-1)

* An error was fixed that occurred when restoring a multiple-volume backup to a drive other than the original drive. (since v10.82 SR-1)

* Scripts: where in doubt because hex values and text strings (and possibly even integer numbers) are accepted as parameters, you may now use inverted commas to enforce the interpretation of a parameter as text.

* Optionally, you may now pass a second parameter with the Open script command that defines the edit mode in which to open the file or media ("in-place" or "read-only"). No such parameter means default edit mode (as before).

* An error was fixed in recognizing a hard drive's model no. and size under certain circumstances.

* Several minor improvements.

WinHex 10.9 is a free update for all users who purchased WinHex 10.25 or newer (e.g. online after Jan 22, 2002).
If you do not qualify any more, please find out about online upgrading at http://www.winhex.com/winhex/upgrade.html . Purchasing the current version (or upgrading) entitles you to
receive updates released at least in the following 15 months at no cost.

 

#56: WinHex 10.82 released

May 21, 2003

This mailing is to announce minor update, WinHex 10.82.

What's new?

* The ability to display hard drive model and serial no. under Windows 2000/XP was improved (since v10.8 SR-3).

* The error handling for physically damaged disks has been improved (since v10.8 SR-4). It is convenient to have the possibility to have WinHex ignore all read errors after the first one reported. Internal sector buffering is now automatically disabled on a disk where damaged sectors are encountered.

* An error has been fixed that occurred when dealing with large FAT32 drives.

* A spin-off forensic product has been released: X-Ways Trace is based on WinHex and allows to track the web browsing activity on a certain computer ex post by deciphering Internet Explorer's ever-growing internal history log file index.dat. Please see https://www.x-ways.net/trace/ for details.

WinHex 10.82 continues to be a free update for all users who purchased WinHex 10.1 or newer (e.g. online after Dec 6, 2001). If you do not qualify any more, you may find out about upgrading at http://www.winhex.com/winhex/upgrade.html . Purchasing the current version (or upgrading) entitles you to
receive updates released at least in the following 15 months at no cost.

 

#55: WinHex 10.8 released

May 2, 2003

This mailing is to announce noteworthy update, WinHex 10.8.

What's new?

* Find Hex Values can now search for "non-matches". Specify a hex value with an exclamation mark as a prefix (e.g. !00) to make WinHex search for byte values that are different (e.g. from 0x00).

* The Simultaneous Search facility now allows to search for the same text string(s) in Unicode and ASCII simultaneously. The Unicode checkbox must be "half" checked for this.

* By default, File Recovery by Name on an NTFS drive is now tremendously faster. Only if the file you are looking for cannot be found by that, it may help to enable the "thorough" search that was the standard in previous versions.

* The directory browser now works with tool tips if any item is not fully visible. (since v10.75 SR-2) Tool tip display in the dialog windows has been improved.

* Copying a file off a drive using the context menu of a cluster list window now omits the slack space at the end of the last cluster. (since v10.75 SR-4)

* The WinHex programming interface can now be tested even with the evaluation version of WinHex. Only the Save commands are disabled. http://www.winhex.com/winhex/api/

* Several minor improvements and bug fixes.

* A new version of X-Ways Replica is now available that will correctly deal with hard disks with no partitions defined. X-Ways Replica is included in a WinHex specialist license. http://www.winhex.com/replica.html

WinHex 10.8 is a free update for all users who purchased WinHex 10.1 or newer (e.g. online after Dec 6, 2001). If you do not qualify any more, please find out about online upgrading at http://www.winhex.com/winhex/upgrade.html . Purchasing the current version (or upgrading) entitles you to receive updates released at least in the following 15 months at no cost.

 

#54: WinHex 10.75 released

Apr 15, 2003

This mailing is to announce major update, WinHex 10.75.

What's new?

* A directory browser, which resembles the Windows Explorer's right-hand list, is now optionally part of an disk edit window for the file systems FAT and NTFS. It lists existing files and directories first, then deleted files and directories. Also works on image files when interpreted as logical drives and on partitions opened from within a physical disk, even if not mounted in Windows. Right-clicking any item in the directory browser causes the disk editor to move to this item's file record (NTFS only). Double-clicking any item in the directory browser lists all clusters allocated to that item and allows to navigate to these clusters in the disk editor and to copy the file off the drive. The directory browser is also a great way to access NTFS drives from Windows 95/98/Me.

* WinHex can now tell the contents of a currently displayed cluster for a NTFS drive that was opened as a partition or an image file. Often WinHex can tell which deleted file was last stored in a currently displayed free cluster.

* The simultaneous search facility now supports hex values if they are specified with the 0x prefix.

* When restoring a backup that was split into several volumes, WinHex now allows to restore all volumes subsequently without user interaction, and it allows to restore all volumes into a single flat image file.

* The Synchronize & Compare feature now supports up to four windows at the same time (instead of only two).

* In the disk selection dialog, physical hard disk numbering now starts with 0 instead of 1, as known from Windows NT's and its successors' disk manager. Also a disk's total size is displayed to avoid confusion.

* Under Windows 2000/XP, the model no. of a physical hard disk and optical drive can now often be displayed in the details panel, in the Clone Disk dialog window, and in the Make Disk Backup dialog.

* The drive contents table is slightly more complete now on NTFS drives (size of directories, resident files).

* The RAM editor dialog now provides process IDs along with the names of the processes.

* The hex converter window will remember its presence in the next WinHex session.

* Some other minor improvements.

WinHex 10.75 is a free update for all users who purchased WinHex 10.0 or newer (e.g. online after Oct 21, 2001). If you do not qualify any more, please find out about online upgrading at http://www.winhex.com/winhex/upgrade.html . Purchasing the current version (or upgrading) entitles you to receive updates released at least in the following 15 months at no cost.

 

#53: WinHex 10.7 released

Jan 31, 2003

This mailing is to announce major update, WinHex 10.7.

What's new?

* Two specialist tools options have been introduced that allow to highlight slack space and free space on a drive: offsets and data are displayed in softer colors (light blue and gray, respectively). Helps to easily identify these special drive areas.

* The "Turbo On" script command accelerates the execution of a script. In turbo mode, most screen elements are not updated while a script runs and you are not able to abort (e.g. by pressing Esc). This makes the script up to 75% faster, especially if a lot of simple commands such as Move and NextObj are executed in a loop.

* WinHex can now recover the file described in a currently displayed NTFS file record. The command for this is located in the Access button menu, as known from FAT drives. To find the NTFS file record for a particular file (which always begins with the letters "FILE"), search the drive for the filename in Unicode.

* File Recovery by Name now offers to "intercept" invalid filenames. For example when you wish to recover files that had filenames in a non-western language, the filenames may be considered invalid by a western-language Windows version. This option will rename such a file if necessary to ensure a more complete recovery.

* When gathering slack space, WinHex can now optionally mask non-printable characters by replacing them with spaces.

* The ReplaceAll command can now be applied to disks if in in-place edit mode.

* Two more script commands introduced, InitFreeSpace and InitiSlackSpace, that allow to clear unused areas on many drives at a time without user interaction.

* Lower-case letters allowed as hexadecimal digits in parameters of the Find and ReplaceAll script commands.

* Including alternate data streams in an NTFS drive contents table is now a dedicated option.

* Various minor improvements.

WinHex 10.7 is a free update for all users who purchased WinHex 9.92 or newer (e.g. online after July 12, 2001). If you do not qualify any more, please find out about online upgrading at http://www.winhex.com/winhex/upgrade.html . Purchasing the current version (or upgrading) entitles you to receive updates released in the following 15 months at no cost.

 

#52: X-Ways Security released and WinHex 10.65 released

Jan 5, 2003

This mailing is to announce both a noteworthy update of WinHex, v10.65, and a brand-new data removal software based on WinHex: X-Ways Security.

What's new WinHex?

* Wiping disk sectors, files, free drive space, slack space, and unused NTFS file records has been improved. It is now possible to specify multiple passes with different settings. In particular, the DoD (Department of Defense) 5220.22-M standard for sanitizing hard disks has been implemented.

This functionality and more is now also available in a dedicated and particularly easy-to-use IT security tool: X-Ways Security. With just a few mouse clicks you can securely shred confidential data or protect your privacy. https://www.x-ways.net/security/

* WinHex can now interpret and treat disk image files both as logical drives or physical disks. If interpreted as physical disks, WinHex can access and open the partitions contained therein individually as known from "real" physical hard disks. All of this is useful if you wish to examine the contents of disk images without copying them back to a disk, or to extract files from it. When an image file is open, use Tools | Disk Tools | Interpret File As Disk.

* The Clone Disk dialog has been optimized. Selecting image files as the source or destination is easier now.

* A new command in the Specialist Tools section allows to Bates-number all the files within a given folder and its subfolders. A constant prefix and a unique serial number are inserted between the filename and the extension in a way attorneys traditionally label paper documents for later accurate identification and reference in discovery or evidentiary use.

* Allows hex ASCII and ASCII text to be specified as the 2nd parameter of the Assign script command.

* Some minor improvements.


> Archive of the year 2002 <

> Archive of the year 2001 <

> Archive of the year 2000 <