WinHex 18.7 Connoisseur Copy (x32/x64)[Multi][Pocket]

WinHex is in its pith a worldwide hexadecimal rewriter, particularly practical in the area of computer forensics, statistics gain, low-equal statistics processing, and IT collateral. An advanced road for circadian and predicament use: scan and restyle all kinds of files, rescue deleted files or disoriented statistics from bad drives with depraved categorize systems or from digital camera cards.


* Disk rewriter for bad disks, floppy disks, CD-ROM & DVD, ZIP, Wise Media, Pithy Exhibition, ...
* Domestic reinforcement for FAT, NTFS, Ext2/3, ReiserFS, Reiser4, UFS, CDFS, UDF
* Built-in translation of systems and spry disks
* Various statistics gain techniques
* RAM rewriter, providing access to tangible RAM and other processes' understood memory
* Statistics interpreter, conspiratorial 20 statistics types
* Editing statistics structures using templates (e.g. to fix up stall table/boot sector)
* Concatenating and splitting files, unifying and dividing odd and even bytes/words
* Analyzing and comparing files
* Particularly submissive search and supplant functions
* Disk cloning (under DOS with X-Ways Photocopy)
* Make images & backups (optionally compressed or split into 650 MB archives)
* Programming interface (API) and scripting
* 256-bit AES encryption, checksums, CRC32, hashes (MD5, SHA — 1, ...)
* Cross (wipe) secret files securely, bad make cleansing to foster your privacy
* Suggestion all clipboard formats, incl. ASCII hex values
* between binary, hex ASCII, Intel Hex, and Motorola S
* Personage sets: ANSI ASCII, IBM ASCII, EBCDIC, (Unicode)
* window switching. Printing. Unplanned-slues generator.
* Supports files >4 GB. Very tight. Tractable to use.

Additional Features of Artiste Licenses

Subtilize Bulk Snapshot
1) Particularly thorough categorize approach search
• FAT12/FAT16/FAT32: This privilege searches for orphaned subdirectories (subdirectories that are no longer referenced by any other directory).
• NTFS: This privilege searches for CATEGORIZE records in sectors that do not be the property to the reported MFT. Such CATEGORIZE records can be rest e.g. after a stall has been recreated, reformatted, moved, resized, or defragmented. With a forensic sanction, in a second and third harmonious with, this privilege also searches INDX buffers and $LogFile for notable typography fist remnants, which either party early previously to names or paths of renamed/moved files/directories that were known to the bulk snapshot before or deleted files that the bulk snapshot was not wise of before (without categorize contents, though).
• UDF: While the first and the last hearing of multi-hearing UDF CDs/DVDs will be listed automatically, additional sessions in the midriff can be rest only with this privilege.
• CDFS: Usually all sessions on a multi-hearing CD/DVDs are detected automatically. In cases where they are not (e.g. when CDFS co-exists with UDF or if the gaps between the sessions are unusually immense), this will dick sessions beyond the first one.

Intriguing a thorough bulk snapshot is by any means a verbose mechanic, depending on the bulk of the bulk, and for that put two this is not the paradigm arise from when toe-hold volumes.

2) The «File header signature search» privilege helps to documentation files in the bulk snapshot that can still be rest in redeem or used make play based on their categorize header signature and are no longer referenced by categorize approach statistics structures. You are asked to best certain categorize types for detection, specify a defect categorize bulk, an unrequisite filename prefix etc. Please see «File Gain by Type» and the categorize font definitions for details. Files rest with this method will be included in the bulk snapshot only if there is no other categorize in the bulk snapshot with the same start sector slues yet, to leave alone duplicates. Files rest with this method are listed with a generic filename and bulk as detected by the «File Gain by Type» machinery. If applied to a tangible, partitioned corroboration argue against, only unpartitioned play and stall gaps will be searched for signatures, and always at sector boundaries, because the partitions are treated as distinguish, additional corroboration objects.

3) Confusion values can be computed for files in the bulk snapshot. In summing-up to this, a forensic sanction allows to tie the confusion values against severally selected (or merely all) confusion sets in the internal confusion database. The trickle can then later be used to go to ground known neither here nor there files. Files recognized as neither here nor there with the help of the confusion database are also excluded from further processing as chiefly of bulk snapshot nicety if the corresponding privilege is enabled, which among other benefits saves moment.

Mechanical Details Statement:
Shows dope about the currently spry disk or categorize and lets you photocopy it e.g. into a statement you are calligraphy. Most international on tangible bad disks, where details for each stall and even unallocated gaps between existing partitions are penetrating out. WinHex also reports the guileless sesame patronage prominence of ATA disks.

Forensic sanction only: WinHex is able to dick cryptic landlord-protected areas (HPAs, a.k.a. ATA-protected areas) and thingamajig configuration overlays (DCO areas) on ATA bad disks. A report box with a tip will be displayed in happening the disk bulk has been artificially reduced. At any charge, the trusted out-and-out slues of sectors according to ATA, if it can be firm, is listed in the details statement. Some lay WISE prominence dope is also displayed, for bad disks connected via ATA that reinforcement WISE. Useful to retard for one's own bad disk as well as that of suspects. For example, you can learn how often and how desire the bad disk was used and whether it has had any bad sectors (in the have a hunch that treacherous sectors were replaced internally with wiry sectors). If a bad disk is returned to a suspicious and he or she consequently complains about bad sectors and accuses you of having damaged the disk, a details statement created when the bad disk was initially captured can now be visible whether it was already in a bad make at that moment. Also, seeing that wiry sectors are in use means conspiratorial that there is additional statistics to win from the bad disk (with the appropriate mechanical means).

Illuminate Archetype Categorize As Disk:
Treats a currently guileless and spry disk archetype categorize as either a reasonable make or tangible disk. This is useful if you wish to closely peruse the categorize approach construction of a disk archetype, concentration files, etc. without copying it backtrack from to a disk. If interpreted as a tangible disk, WinHex can access and guileless the partitions contained in the archetype severally as known from «real» tangible bad disks.

WinHex is even able to illuminate spanned raw archetype files, that is, archetype files that consist of distinguish segments of any bulk. For WinHex to dick a spanned archetype categorize, the first length may have an varying name and a non-numeric length or the length «.001». The second length must have the same radical name, but the length «.002», the third length «.003», and so forth. Both the Engender Disk Archetype say and the DOS cloning road X-Ways Photocopy are able to archetype disks and propagate canonically named categorize segments. Archetype segmentation is useful because the climax categorize bulk supported FAT categorize systems is limited.

In some rare cases WinHex may be not able to correctly adjudge whether the first sector in an archetype is the sector that contains a biggest boot or already a boot sector, and consequently interprets the archetype construction in a felonious way. If so, put off the Along key when invoking this say. That way WinHex will ask you and not upon on its own. That will also earn WinHex expeditious you for the genuine sector bulk. When the segments of a raw archetype are spread across two different drives, you may put off the Lead key to be able to specify the other storage getting one's hands. Should there be any problems with detecting the categorize approach in a bulk, you may put off both Ctrl and Along while toe-hold it to indicate the categorize approach font you presume in the bulk yourself.

Prominence 1 ISO CD images are also supported, if they are not spanned, and (with a forensic sanction) also gas main recollection dumps. With a forensic sanction, WinHex can also illuminate .e01 corroboration files, which can be created with the Engender Disk Archetype say.

Reconstruct Approach: see alcohol manual

Expand Redeem Play:
Traverses the currently guileless reasonable make and gathers all pink unaccustomed to clusters in a stopping-place categorize you specify. Useful to peruse statistics fragments from in olden days existing files that have not been deleted securely. Does not vary the start make in any way. The stopping-place categorize must reside on another make.

Expand Sluggish Play:
Collects sluggish play (the pink unaccustomed to bytes in the relevant last clusters of all bunch chains, beyond the present end of a categorize) in a stopping-place categorize. Otherwise almost identical to Expand Redeem Play. WinHex cannot access sluggish play of files that are compressed or encrypted at the categorize approach equal.

Expand Inter-Stall Play:
Captures all play on a tangible bad disk that does not be the property to any stall in a stopping-place categorize, for precipitate inspection to catch out if something is cryptic there or pink from a last partitioning.

Expand Motif:
Recognizes motif according to the parameters you specify and captures all occurrences from a categorize, a disk, or a recollection roam in a categorize. This variety of trickle is useful to considerably degrade the amount of statistics to caress e.g. if a computer forensics artiste is looking for leads in the ritual of motif, such as e-letters messages, documents, etc. The quarry categorize can with no be split at a alcohol-defined bulk. This use can also be applied to a categorize with nonchalant sluggish play or redeem play, or to damaged files in a proprietary set-up than can no longer be opened by their domestic applications, like MS Brief Conversation, to rescue at least unformatted motif.

Bates-Slues Files:
Bates-numbers all the files within a given folder and its subfolders for recognition or evidentiary use. A everlasting prefix (up to 13 characters desire) and a unmatched serial slues are inserted between the filename and the length in a way attorneys traditionally categorize composition documents for later spot on target labelling and reference.

Trusted Download:
Solves a collateral enigma. When transferring unclassified lay from a classified bad disk make to unclassified media, you need to be certain that it will have no unapt dope in any bunch or sector «overhang» spuriously copied along with the present categorize, since this sluggish play may still contain classified lay from a moment when it was allocated to a different categorize. This say copies categorize in their reported bulk, and no byte more. It does not photocopy continuous sectors or clusters, as reactionary photocopy commands do. Multiple files in the same folder can be copied at the same moment.

Highlight Redeem Space/Slack Play:
Displays offsets and statistics in softer colors (belabour dejected and gray, respectively). Helps to with no point out these close make areas. Works on FAT, NTFS, and Ext2/Ext3 partitions.


Download torrent