|How are the
various user interface elements called?
Labelled here (German).
The resizable rectangular area that appears when you open a file or disk is
called a data window hereafter. Data windows are managed by the MDI
interface that is common to many standard Windows programs.
Can you explain the menu structure?
1. Menu commands that help to manage the
current case can be found in Case Data window's File menu and in the context
menu that opens when you right-click the name of the case in the Case Data
2. Menu commands related to an evidence
object can be found in the context menu that opens when you right-click the
name of the evidence object in the Case Data window.
3. Menu commands that affect an entire
search hit list or bookmark list or contents table can be found in their
respective context menus in the Case Data window.
4. Menu commands that affect individual
items displayed in the directory browser or in a search hit or bookmark list
can be found in the context menu that opens when you right-click such items.
You won't find such commands in the main menu.
5. Menu commands that either affect the
binary data in a data window or the data window as such (and these are a
lot), or that affect files or disks that are still to be specified (e.g. for
opening, cloning, concatenating, ...), can be found in the main menu.
6. Menu commands specifically needed for
computer forensics or IT security purposes can be found in the Tools and Specialist
sections of the main menu. The commands in the Specialist section are only available with
a specialist or forensic license.
|How can I read
or print the WinHex manual?
PDF files, please use Adobe Acrobat Reader or GSView.
|What is the maximum
file size WinHex can handle?
itself theoretically supports file sizes up to several thousand GB (no typo). Practically,
file sizes are limited by the file system:
Please note that removing/deleting or pasting/inserting
bytes within such a large file may require the creation of a huge temporary file of almost
the same size.
|What is the maximum
disk size WinHex can handle with its disk editor?
about 1000 GB (WinHex 10.82 and before) or 2000 GB (WinHex 10.9 and later).
|How can I recover
all the files in a folder with the directory browser at the same time?
the folder instead of each file individually and select Recover/Copy. Please note that the
".." folder represents the parent folder, not the folder itself. To
recover the folder, go to the parent folder and right-click the folder there.
occurs at address 0012F... when I try to use the RAM editor. Why?
users who encountered this problem solved it like this:
For nVidia users, in the Control Panel should be
'NVIDIA nView Desktop Manager'. Open it and uncheck the 'Enable nView Desktop Manager' and
hit Apply and OK. Now, open the WinHEX and if you need, you can reverse the step above and
check the 'Enable nView Desktop Manager'. Now you should have RAMedit and nView Desktop
Manager active at the same time if you desire so. It seems that for RAMedit to work you
need to disable the 'Enable nView Desktop Manager' when you open the winHEX.
My solution is: Remove all nVidia enhancements
from windows(desktop explorer, etc). Now RAM editor works fine.
It was the Nvidia drivers, in particualar, I was getting other error messages from
other programs pointing to nview.dll (ver 126.96.36.19942). I uninstalled the drivers
and upon rebooting installed fresh drivers and now it works fine.
I have the NVIDIA GeForce4 MX 420 card and the driver is version 188.8.131.5242. When
my problem arouse with WinHex, it was also effecting a program called RamDisk XP by
SuperSpeed Software. I also could not uninstall certain software using the uninstaller in
the Control Panel. I then was receiving error messages pointing to nwiz.exe, and Nvidia
file. I then uninstalled the Nvidia drivers and assorted files. Upon rebooting, Windows
found new hardware and reinstalled the most current versions which were downloaded from
Microsoft Update. I am not sure if the update benefited me or the reinstall of the Nvidia
drivers, which could have become
corrupted. But upon reinstalling Nvidia drivers, WinHex, RamDisk and the Windows XP
uninstaller all worked perfectly from that point on.
|How can I unpack
the winhex.zip file?
use WinZip from http://www.winzip.com,
WinRAR from http://www.rarsoft.com
or an equivalent program to extract the files in the winhex.zip archive.
in edit windows moves strangely when moving the cursor. How to fix this?
versions of WinHex in rare cases did not initialize with the correct font size. Select the
font again in the General Options dialog.
strangely, e.g. does not start up correctly, displays no window, etc... what can
try to start Windows again. If this does not help, please try deleting (or renaming) your
winhex.cfg file before starting WinHex for full initialization. If this does not help
either, you may also want to try installing again, or downloading and installing again.
windows are empty! No hex or text data and no offsets are displayed. What can I
problem can occur under Windows NT or Windows 2000 if a previous instance of WinHex
terminated abnormally or after upgrading from a version prior to WinHex 9.6 to WinHex 9.6
or later. Please restart your computer or select a different font in the General Options
|How can I
safely remove confidential data from my hard drive?
use the command Delete irreversibly in the File Manager menu to shred certain
files. To wipe an entire hard drive (with the result of everything being
deleted), fill all sectors of the hard drive with zero bytes, optionally more than once.
edit any hard drive's sectors using WinHex?
cannot access remote hard drives (in a network) with the disk editor. And under
Windows NT/2000, administrator privileges are needed to access local hard drives.
|The buttons in
the MS Office shortcut bar open the Office programs in WinHex.
How can I repair this?
an inconsistency in the behavior of the MS Office shortcut bar that occurs in some cases
in conjunction with WinHex appearing in the shell's context menu. Note that you can still
run the MS software by right-clicking a button in the shortcut bar and selecting
Open in the popup menu. This menu item should still be printed in bold, so it
is not obvious why it is not the default command for this button any more.
To get rid of this problem, please disable Add WinHex to the context menu in
the General Options dialog in WinHex. If this does not help, please run regedit.exe (the
Windows Registry Editor) and remove the following entry manually:
"Edit with WinHex" under HKEY_CLASSES_ROOT\*\shell\