Download WinHex 14.7

X-Ways Software Technology released version 14.7 of WinHex yesterday. WinHex is not only a universal hex editor, but is also capable of low-level data processing through a simple interface. The program includes a ram editor, a data interpreter and a disk editor, and can be used, for example, to retrieve deleted information and to inspect files. WinHex works on all Windows versions from 98 with the exception of NT, but the full arsenal of features can only be fully exploited on Windows 2000, or higher. The changelog of this release shows the following changes and improvements:

What’s new?

• The virtual “Path unknown” directory on NTFS volumes is now often much better organized. It identifies files and subdirectories whose original parent directories are unknown but known to be the same. Such files and subdirectories are now collected in the same generically named virtual directory, which makes it easier to get an idea what that directory might have been and more quickly identify relevant and irrelevant files. Applications to newly taken volume snapshots only.
• The thorough file system data structure search on NTFS volumes now often turns up even more traces of previously existing files than before, including even more earlier names and earlier paths of renamed/moved files. (forensic license only)
• Support for dynamic volumes defined on GUID partitioned (GPT) disks. Such dynamic volumes can be used under Windows Vista and the 64-bit versions of Windows XP and Windows 2003 Server.
• Now automatically finds all partitions on hard disks that have both valid GPT and MBR partition definitions.
• Ability to conveniently find the e-mail message that contains the selected attachment, via the directory browser context menu, not for AOL PFC. (forensic license only)
• Extracted metadata were previously added to the Comments column. Now there are a separate column and a separate filter for metadata, and the Comments columns is now reserved for the examiner’s own comments.
• Metadata extraction from RTF, MP4, 3GP, M4V, M4A, RIFF files (.wav, .avi, …) and IE cookies. (forensic license only)
• Intelligent file size detection for MP4, 3GP, M4V, M4A, MOV, DBX during file header signature search.
• File Header Signatures.txt further expanded.
• PDF documents with old, invisible versions of the same document are now associated automatically with a special report table once viewed in Details mode or once internal metdata has been extracted from them. (forensic license only) Once aware that old versions exist, well-versed users can make them visible if needed.
• Extracts the internal creation timestamp from Internet Explorer cookies, Norton Ghost .gho and PGP pubring.pkr keyring files. (forensic license only)
• Ability to preview/view INFO2 files as well as most SPL printer spool files. Ability to automatically extract EMF files from multi-page SPL printer spool files (see Refine Volume Snapshot). (forensic license only)
• Ability to control NTFS compression for raw image files in File | Create Disk Image: none, sparse, or normal.
• Correct conversion from/to the Windows code pages between 50220 and 50230.
• When viewing a file externally that was already copied to the directory for temporary files before for viewing and still exists there, it is not copied again any more.
• New investigator.ini option: Prevent taking new volume snapshots.
• Fixed an exception error that could with very long image file paths and names.
• Same fix level as v14.6 SR-2.
• Several minor improvements.

[break]