Download WinHex 12.8 SR-5

X-Ways Software Technology has just released the fifth update for version 12.8 of WinHex. WinHex is not only a universal hex editor, but it is also capable of low-level data processing through an easy-to-use interface. The program includes a RAM editor, a Data Interpreter and a Disk editor, among other things, so it can be used to retrieve deleted information and, for example, to inspect files. The changelog for this release shows the following changes:

What’s new?

• Support for Unicode character set in filenames and directory names in most parts of the user interface, notably in the directory browser and the directory tree, implemented so far for NTFS, Ext2/Ext3, ReiserFS/Reiser4 and HFS+. That means Chinese, Russian, Japanese, etc. characters should now be displayed correctly.
• Newly created evidence file containers can now optionally incorporate filenames in Unicode instead of ASCII. For compatibility with older versions of X-Ways Forensics, stick with ASCII.
• New concept: When verifying file types based on signatures, no fictitious items with the presumed correct extensions are listed any more. Instead, the detected type can be seen in the new optional Type column. By default, the Type column shows the same text as the Extension column. The Category column is now based on the Type column, no longer on the Extension column. When a mismatch between filename and type is detected, either when refining the volume snapshot, when previewing files, or when viewing files in the Gallery, both the Type and the Category column turn blue.
• There is also a new filter that conveniently lets you address files of multiple types, in addition to the Category filter. Such filter settings can even be loaded and saved. Works with a slightly adjusted type of File Type Categories.txt file. (forensic licenses only)
• Another new optional column indicates the status of the file type column. Initially “not verified”. After checking for filename/file type mismatches: If a file is very small the status is “don’t care”. If neither the extension nor the signature is known to the file type signature database, the status is “not in list”. If the signature matches the extension according to the database, the status is “confirmed”. If the extension is referenced in the database, yet the signature is unknown, the status is “not confirmed”. If the signature matches a certain file type in the database and the extension matches a different file type or none at all, the status is “newly identified”. A filter can be used on this column, too. (forensic licenses only)
• Since for a file with a name/type mismatch there will be no duplicate with the (presumed) right extension any more, a new option was introduced that allows to automatically append the extension shown in the Type column when copying such a file.
• Ability to display timestamps with tenths of seconds in the directory browser. Useful for the file systems NTFS and FAT that provide for this precision in all or some timestamps.
• Support for drive contents table creation finally discontinued.
• The volume snapshot data format has changed. Previously created volume snapshots can be converted automatically for use with v12.85 and later, except for ReiserFS/Reiser4 volumes. Should you encounter problems importing old volume snapshots, you can either recreate the volume snapshot from scratch (thereby losing comments, tags, discovered orphaned files, etc.) or continue using v12.8 for that case/image.
• The way how sorting by the Attribute column works was adjusted. (Help file not yet updated.)
• You may now specify maximum dimensions for the inclusion of pictures in the case report (see Report Table Options in the Case Properties, but also applies to pictures associated with the case as an evidence object). Useful if the report is to be printed and large pictures would be visible partially only on the printout.
• Several other minor improvements.

[break]