WinHex 11.8 Log Out | Topics | Search
Moderators | Edit Profile

X-Ways Forum » Public Announcements » WinHex 11.8 « Previous Next »

Author Message
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann (Admin)
Posted on Wednesday, Oct 13, 2004 - 19:29:   

A beta version of WinHex 11.8 is now available here.

What's new?

* In addition to FAT and NTFS, WinHex now fully supports the file systems Ext2, Ext3, and CDFS/ISO 9660/Joliet. (specialist and forensic license only)

* Compatibility with Linux and Wine has been improved. WinHex can now easily open devices such as hard disks and main memory when run under Linux with Wine.

* Positions/bookmarks/annotations may now have a description of up to 8192 characters (instead of just 255). Also they can now have an arbitrary length (instead of always just 1 byte). Plus you can select a unique color for each bookmark! Bookmark colors are mixed with block colors if a bookmark and the currently defined block overlap.

* The limit of the simultaneous search's overall search term length has been extended from 255 to 30,000 characters. All the search terms will always be included in the case log, regardless of how many are visible on the screen. Also, you can now easily load and save search term lists!

* The Tools | Clone Disk feature now works up to 30% faster if you enable the simultaneous I/O option and if the destination is not the same physical medium as the source. The option might have a negative impact otherwise. Please report your observations and experience with this option in particular. The speed benefit may also depend on whether or not source and destination are connected via the same IDE channel.

* There is now a dedicated command for creating hash sets in the directory browser's context menu (forensic license only). It is no longer necessary (also: not possible) to create a contents table as a by-product of a hash set (or vice-versa).

* When creating a drive contents table, WinHex can now perform an entropy test on unknown files to check whether they might be encrypted. (forensic license only)

* When manually deleting irrelevant items from a contents table that is associated with an evidence object, WinHex can now save your deletions to the contents table file. Plus it is now possible to review the original settings used to create a contents table that is associated with an evidence object, with the Properties command.

* Greedy RAM utilization for v e r y large partitions is no longer a problem. Downside: Cluster chain scans may take somewhat longer now.

* There is now an alternative access method for optical discs and physical hard disks under Windows NT/2000/XP (see General Options), which may allow to access hard disks formatted in an unconventional way or other media that cannot be accessed otherwise, plus some sectors at the end of CD-ROMs/DVDs that may otherwise be missed.

* There is an option "Ext2/Ext3 block logic" in File Recovery by Type that causes this recovery method to deviate from the standard assumption of no fragmentation in that it will follow the typical Ext block pattern.

* There is a new option in the Edit | Conversion list that allows to decompress raw data from any number of 16-cluster units compressed by NTFS (not just one such unit at a time as tentatively in previous v11.7 service releases).

* Various minor improvements.

The program help has been updated with most, but not all of these changes.

If you have a forensic license, please add the files that are missing in the beta download (hi.dll, zip.dll, rar.dll, File Type Categories.txt, and Reg Report Keys.txt) from the current version X-Ways Forensics 11.7. WinHex 11.8 will be a free update for all users who purchased WinHex 10.92 or later.

Please report errors here or by e-mail. Thank you.
Top of pagePrevious messageNext messageBottom of page Link to this message

Jimmy Weg (Jw)
Posted on Thursday, Oct 14, 2004 - 0:30:   

On the install, I get messages that files other than those listed (hi.dll, zip.dll, rar.dll, File Type Categories.txt, and Reg Report Keys.txt) are missing. The files are Reiser Superblock.txt, Ext Directory Entry.txt, Ext Superblock.txt, Ext Inode.txt, Ext Group Descriptor.txt. I click ignore on each and all seems well. Thanks.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann (Admin)
Posted on Thursday, Oct 14, 2004 - 0:34:   

Oops, fixed, thanks, sorry.
Top of pagePrevious messageNext messageBottom of page Link to this message

David (Dh)
Posted on Saturday, Oct 16, 2004 - 12:19:   

11.8 beta a, on windows 98se

File recovery by type recieves invalid input.
Same problem we had before with 11.7
Thank you
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann (Admin)
Posted on Saturday, Oct 16, 2004 - 18:11:   

Yes, thanks, will be fixed with WinHex 11.8 Beta B.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann (Admin)
Posted on Saturday, Oct 16, 2004 - 19:02:   

WinHex 11.8 Beta B:

* When creating a contents table, filename/file type mismatches are now detected for non-existent (deleted or orphaned) files, too. Please note that the link between the current data in unallocated clusters and deleted files and their filenames is weak, so false alerts might be displayed if a deleted file's clusters have been re-allocated to another file of a different type in the meantime.

* File Recovery by Type can now be applied to all open windows (e.g. 10 partitions or image files) at the same time.

* File Recovery by Type can now create and fill a new subfolder with recovered files if the maximum number of files per folder you specify is exceeded. This is useful because e.g. Windows Explorer can become very slow when dealing with huge folders.
Top of pagePrevious messageNext messageBottom of page Link to this message

ross@winpro.net
Posted on Sunday, Oct 17, 2004 - 1:27:   

> useful because e.g. Windows Explorer can become very slow when dealing with huge folders.

Will that be a maximum of 10, or was that just an example?

recovery by type has an option to just send the results to the Direcotry Browser; is it possible to save those results as contents table?

> useful because e.g. Windows Explorer can become very slow when dealing with huge folders.

Thank you very much!!!!!!!!! Yeah!!!!
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann (Admin)
Posted on Sunday, Oct 17, 2004 - 1:47:   

> Will that be a maximum of 10, or was that just an example?

Just an example. The option is to apply File Recovery by Type to all open windows. WinHex supports up to 1,000 edit windows under Windows NT/2000/XP (500 under Windows 9x/Me). However, currently WinHex can only interpret up to 8 image files as physical disks at a time, and open only 16 partitions individually at a time.

> is it possible to save those results as contents table?

No, that's not possible.
Top of pagePrevious messageNext messageBottom of page Link to this message

Russell Coombe (Mackavi)
Posted on Monday, Oct 18, 2004 - 14:35:   

Am getting a NO DISK error every time I start WH. Error reads There is no disk in drive. Please insert disk into drive \Device\Harddisk5\DR21.

Clicking cancel causes a further three errors for simular drives until a get the error for Drive H - which is my floppydisk drive. I've deleted config file but still get the errors and have just DL ver C and still get the error.

I've XWF installed in same folder and that runs without probs.

Cheers

Russell
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann (Admin)
Posted on Monday, Oct 18, 2004 - 18:01:   

Fixed now with WinHex 11.8 Beta E. Thanks!
Top of pagePrevious messageNext messageBottom of page Link to this message

Anonymous
Posted on Tuesday, Oct 19, 2004 - 11:29:   

testing: winxp & 11.80beta c


bug:
Try to do "directory contents table" to scan one directory(ntfs):
- Using the menu method always gives zero objects found.
- Using the "right click on the dir in the browser" works ok, but gives extra files from another directory whose path contains the same name as my test directory. Example, scanning c:\abc will give all files in c:\abc, but will also give the files under c:\xyz\qqq\abc\www\*.*.


bug:
trying to open a small "alternate data stream" file (as found by "directory contents") does not display all the alternate data (if contained totally in a mft record). I didn't test a big file yet.


bug:
Doing a secure wipe on a small file that is totally in the MFT record (2 sectors) doesn't get completely wiped. (only the first sector gets wiped, try it on your file_id.diz). Doing a "initalize MFT records" after that will complete the wipe.


wish list:
on a FAT drive, I can right click on a file in the directory browser, go to the directory entry, then using "access" to goto the file (already blocked). I should be able to do those things for a ntfs drive.
(can only goto file entry). I know I can get to the file by double clicking it, but it would be nice if the file entry, directory entry, and file data were linked like on the FAT system.


wish list:
UDF file system support(dvd format) like you did for CDFS.


wish list:
put back "list alocated clusters" for "drive/directory contents table".
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann (Admin)
Posted on Tuesday, Oct 19, 2004 - 18:56:   

Thank you for your error reports.

> zero objects found

Menu item removed meanwhile.

> extra files from another directory
> small alternate data stream
> secure wipe on a small file

Fixed with WinHex 11.8 Beta I.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann (Admin)
Posted on Saturday, Oct 23, 2004 - 2:11:   

WinHex 11.8 and X-Ways Forensics 11.8 have been released.
Top of pagePrevious messageNext messageBottom of page Link to this message

Russell Coombe (Mackavi)
Posted on Saturday, Oct 23, 2004 - 12:28:   

Cheers Stefan,

Upgrade is great. Ext2/Ext3 is really usefully - it even recovered files from my virtual pc linux drive file.

One issue - I can't DL ver 11.8 of WH - I'm still getting 11.7 from link.

Also, is it possible to sort file recovered by type by those that are corrupted or even better, to excluded corrupted files from being listed in the first place? The reason for this is that when scanning my rootdrive for JPGs, I get some 100,000 hits with over half of them being blank (corrupted - I assume it just finds the header) and its a real nuicance try to stroll though pages of blank thumbs.

Cheers

Russell
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann (Admin)
Posted on Saturday, Oct 23, 2004 - 13:02:   

All download servers have WinHex 11.8 since approx. 13 hours ago. v11.7 may still be in some kind of cache between your computer and the web server if you downloaded it recently. Please try again.

Files recovered "by type" which WinHex detects are corrupt are named with a prefix "c" in addition to the filename pattern you provide, so you can easily sort by name and select and delete the known corrupt ones.
Top of pagePrevious messageNext messageBottom of page Link to this message

Russell Coombe (Mackavi)
Posted on Saturday, Oct 23, 2004 - 17:10:   

Sorry no luck, will wait until tomorrow and try again.

As for corrupt files, I must be doing something different - I don't get files beginning with c. They're all listed file#######.jpg in the name column, then the extention coloumn is all .jpg and byte size is also listed but nothing else.

Cheers

Russell
Top of pagePrevious messageNext messageBottom of page Link to this message

Anonymous
Posted on Monday, Oct 25, 2004 - 11:24:   

bug in 11.80 (eval)

Create new 1 MB file.
Fill file with random data.
Do an EBCDIC -> ASCII conversion.
Scroll up & down the file.
You will notice that every other 64K block does not get converted.
(I changed ebcdic.dat to suit my needs)
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann (Admin)
Posted on Monday, Oct 25, 2004 - 11:42:   

Thanks. Fixed with WinHex 11.8 SR-2.
Top of pagePrevious messageNext messageBottom of page Link to this message

Jimmy Weg (Jw)
Posted on Tuesday, Nov 9, 2004 - 0:09:   

Just downloaded SR-8 (English), but the install indicates that it's SR-7. Thanks.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann (Admin)
Posted on Tuesday, Nov 9, 2004 - 0:14:   

If so, the previous SR is still in some kind of cache/buffer/proxy between our web server and your download software. I checked the download, and it is SR-8 as it should be. Please try the other download URL or wait until tomorrow or so.
Forum operated by X-Ways Software Technology AG.