WinHex

The WinHex is a program developed by Stefan Fleischmann hex ​​editor and file viewer. It has been edited by X -Ways Software Technology AG.

It allows its user to read files in its hexadecimal notation. It also offers a number of computer forensic functions. Among others, these are: hard disk viewer for viewing and analyzing raw data on the hard disk (for example, master boot record, file allocation table (FAT) file space ), RAM viewer for analyzing currently running processes and memory dumps, recovering deleted files and byte-wise processing.

WinHex is with different user levels, from normal user to forensics specialists, issued. The price depends on the selected user level. WinHex is only available for Microsoft Windows. It runs on Windows 2000 version, to version 11 on Windows 9x.

Functions

WinHex contains functions for hex editing, and analysis of data carriers. Through the use of so-called " templates " ( templates), the program is able to identify performance-critical areas on a disk (eg in the boot sector ). It also features a detailed display of folders and directories that are hidden from the file system.

WinHex is also "see" deleted files to be able to. This is possible since most operating systems do not delete the data normally, but the user no longer merely display and release to overwrite. As long as a deleted file has been overwritten, it can therefore be recovered. Also parts of files can be recovered.