| Author | Message | ||
     Anonymous |
here are some improvement i suggest for Winhex * Disassembler View like in hiew * Support for the Windows PE-Fileformat (used for exe and dlls) * improved Comparefunction like in HexWorkshop 2.54 * better MDI-Support to show more than one window | ||
| Anonymous |
I actually downloaded Version 9.9 and noticed that there is already an improve compare function and MDI-Support implemented. | ||
| Stefan Fleischmann (Admin) |
A template for editing PE .exe file would be nice, I agree. Thanks for that suggestion. A disassembler view is currently not planned. | ||
| Stan Stoler |
I know that Outlook and Outlook Express do not store messages in ASCII format, so is there any way to use Winhex to read the content of those messages? That would be an invaluable feature for evidence recovery. | ||
| Stefan Fleischmann (Admin) |
I know that Outlook Express does store the message text in ASCII format, though it may be incoherent and of course is interleaved with binary data (unprintable characters). You can use WinHex to view these .dbx files, WinHex can gather text from them, and Evidor can gather text from them as well. I guess it is the same with Outlook .pst files. | ||
| Dave Ennis |
Hello Stefan, It's great to have control of my HD's again. Suggestion: Double-click navigation down the path rather than repeatedly using the drop-down Access/goto would be very nice. May seem lazy, but it would really enhance the flow and feel of your product. Suggestion: One-page view of directory contents would be wonderful, displaying for each file or subdirectory the parameters currently accessible only one item at a time in templates. | ||
| Stefan Fleischmann (Admin) |
Thanks for your worthwhile suggestions. 1) For now, to go to a deeply nested subdirectory immediately, use Tools | Disk Tools | List Directory Clusters and click the first cluster number. | ||
| Anonymous |
I am currently evaluating this program and I have several applications that use 5 byte form to store numbers. Since I am unable to interpret this to inject my own values easily, it would be nice to have something like a checkbox added to the hex converter that allows me to convert from Decimal to hex 5 byte form and back. It would also be handy to show output values in the hex converter in the various forms available to view your conversion as the Data Interpreter should. Selecting "real" in the data interpreter shows nothing since it does not act on a block of data, only a single byte. | ||
| Stefan Fleischmann (Admin) |
1) Thanks for your suggestion. Unfortunately I don't think I can add support for 5-byte integers any time soon, sorry. 2) The data interpreter always interprets the byte(s) at the current cursor position, not the block. In the case of "real" the next 6 bytes. Maybe I do not understand your comment. | ||
| DZork |
Hi, I'm currently evaluating the WinHex 10.7 SR7 version and, no doubts, it's a very powerfull application. But, someting is missing for a per-user configuration. It's not appropriated to have only one config file, located within the 'WinHex' install path. On a restricted environment, all the installed paths are only accessible with 'Administrator' account priviledges, and thus ordinary or restricted users accounts will never be able to set/save their preferences/settings. Even if all users accounts would have enought privileges to write their setting into the 'WinHex.cfg' file, this would make setting conflict within each others settings. By the way, why aren't you looking for the 'TEMP' or 'TMP' environment variable to get a default value. Here is a good exemple, of a work around I had to make to get your application work in my 'Win2000' RESTRICTED development environment. For now, only ONE account can used the 'WinHex' application, since the users accounts doesn't share TEMP dir. They have their own access path to a TEMP directory location. I hope this will be addressed in a futur version, if not already did. | ||
| Stefan Fleischmann (Admin) |
If your installation is used by more than one user and these users should not/cannot share the same configuration, I recommend you have WinHex write its configuration to the local registry. This is described here. | ||
| Anonymous |
I am currently evaluating version 10.7 for displaying structures, very nice also conversion tools is great (win hex, ebcdic..). I need to display mixed structures within a file and need to move freely on the hex window to reposition cursor while the template window is open so it gets refreshed, right now you need to close template window and reposition cursor and open it again. Also it would be nice to have the template window standalone with some menu inside it to select template. Is there an option to enable this or perhaps for a future version? | ||
| Stefan Fleischmann (Admin) |
Thanks for your suggestion, I will add this to the wish list. | ||
| Anonymous |
I have been using Winhex for several years and think it's an excellent program. One shortcut I would like is the ability to move/jump the cursor position based on the value (byte/word/dword selectable on an options page or menu) under the cursor at it's current location. ALT-J would be nice. I work with many files that are not block structured but use variable record lengths, with the length stored at the start of the record. It is not easy to quickly position the cursor to the start of the next record. | ||
| Stefan Fleischmann (Admin) |
Thanks, I see that this would be useful. Added to the wish list. | ||
| Steven Allport |
An addition to the move/jump cursor position suggestion would be to also allow a fixed jump size for if you're working with files that have fixed size records but don't have a stored record length value. I use the record presentation view so that I can see the record separation in the hex view and also use the templates where possible but it would be nice to move easily between the records in the hex view. Thanks. | ||
| Stefan Fleischmann (Admin) |
For fixed-size jumps use Position | Go To Offset. It's possible to move from the current position, backward or forward, optionally in units of the current record length. Press F11 to repeat the last movement. | ||
| Steven Allport |
Thanks, I hadn't found the F11 shortcut (I know, RTFM). Is there a shortcut for the reverse. I know there's the 'back' facility but that's only good if I've previously positioned to that point. I couldn't find a shortcut for 'back'. Many thanks for your support. | ||
| Stefan Fleischmann (Admin) |
That will be Alt+F11 or so, in the next release.  | ||
| Stefan Fleischmann (Admin) |
Ctrl+F11 in WinHex 10.8 SR-7. | ||
| shanerpoad |
Bravo Stefan!! An excellent product and it keeps getting better. But, somebody always wants more features. Well I have a request for a new feature. My work involves extensive use of various text interchange file formats. It would be nice if Winhex could display (view mode only) a text file as a text file like note pad but with a line count where the offset column is and a column number row across the top. And I love the EBCDIC option. IBM mainframes..got to love em. Thanks again for a great product, Shane. | ||
| Stefan Fleischmann (Admin) |
Thanks for your posting. There have been suggestions before to make WinHex a text editor, where line break characters actually cause a line break in the display, but I'm afraid this is not a priority for us, sorry. Anyway, will post here again if that changes. | ||
| Alan Hutchison (Alan_Hutchison) |
First Stefan, I'm a rare user of WinHex but I have to say that it's a TOP Product. Intuitive UI and packed with tools. My problem: I use ATA PCMCIA cards for data collection and have noticed that the various O/S format the cards differently. Obviously, different sized cards are treated differently, but outside of that. My feeling is that from the late Win-2k service packs & XP, I have problems. In operation the files appear to be written without errors, with WinHex I see them on the card but the FAT doesn't seem to be written in the correct place for them to be seen by any Windows O/S. This doesn't happen if the cards are fomatted with 6.22, 95,NT,or Win-2K (with no service packs). Using WinHex, I can see FAT1 at 1000 offset down the disc, FAT two at 2000. But at offset 200 there is what looks like another FAT - an old FAT left by an old O/S perhaps, with nothing in it. I'm still grappling with the disc format/structure info. Can anyone point me to info relating to this? When did FORMAT change? The reasons etc. Thanks in advance, A. | ||
| Stefan Fleischmann (Admin) |
For more information on the FAT file system, please refer to the files in the knowledge base. | ||
| Tim Walker (Timdw) |
I've been attempting recovery of an accidentally quick formated HFS+ Mac disk. WinHex was very useful for investigating the disk structure in conjunction with the specification document at http://developer.apple.com/technotes/tn/tn1150.html Unfortunately this confirmed that there was nothing left of the catalog btree which contains all information about directories, files and their initial extents. I then turned to the file recovery by type tool and had a certain amount of success. In the end though, I've had to use another product to perform this task in an efficient manner. The problem was that the drive had about 8.5Gb in use with a mixture of very large and small image files. This made trying to set the maximum file size to retrieve tricky as space on the recovery destination would run out due to the large number of "maxed out" files recovered. A solution that occurs to me is this: change the file type definitions to include the capability to conditionally run a script. This would be used to determine the length to recover for file types where there is no trailing signature. If the specification is known for a particular file type then a script would be sufficient to do this, perhaps rejecting the file if inconsistencies are found too. I suppose the script could be used pass back a file name prefix as well while it's at it. I understand that WinHex has some internal logic for dealing with JPEG file lengths, perhaps this could be brought out into a script as an example for other people to use. Just a thought. Cheers, Tim | ||
| Stefan Fleischmann (Admin) |
Would be useful, yes, thanks for the idea. | ||
| Anonymous |
wish list: 1. If you're at a file's MFT entry(NTFS), there should be a way to jump to the beginning of the file by way of the access button without traversing through the directory browser. (like you can with FAT) 2. While viewing a disk(NTFS), there should be a way to 'block' a file from the browser or access. (like you can with FAT) 3. the ability to search (or multi search) only data sectors, or only free sectors. 4. ability to select multiple blocks. | ||
| Stefan Fleischmann (Admin) |
Thanks, no need to post the same message twice. No posting goes unnoticed. | ||
| Russell Brown |
You may be able to help me with a problem.... Under certain conditions the Windows XP Pro System drive I/O rate goes very high. DiskMon reports specific sector addresses. I need to relate those addresses with Files. How do I go about it? Can WinHex help? | ||
| Jens Kirschner (Admin3) |
Pretty simple actually. Run WinHex, open the drive you are interested in and allow the cluster scan that should start automatically to complete. After that you can go to the sector in question and the details panel should tell you what file is in that sector. Simply click the "sector" field at the bottom of the window to enter the sector number you wish to go to. Be sure to open the correct drive depending on your problem! If the given sector addresses are based on the current partition, open the partition. If they are absolute sectors starting from the beginning of the physical disk, open that. Opening disks and partitions can both be achieved by pressing "F9". | ||
| Jens Kirschner (Admin3) |
I have to correct myself a little: There will only be a cluster scan if you open a partition. So, if the sector address you are looking for is absolute, you would need to find out, at what sector the partition starts on the disk, subtract that and then still open the partition itself to be able to tell, which file is stored at the position in question. | ||
| Douglas Fuller Username: datarecdude Registered: N/A |
I would like to make a suggestion for improving this product. I am shocked that it has not been already suggested or added. Once you have done the "Reconstruct Raid". On the information bar where it tells you the sector you are looking at as well as cluster, block and so on. It would be great if after it tell you sector ? of ?, that it give you the disk number and sector on that disk. For example see below: ...............................disk# / sector# Sector 0 of 100000........"( 0 / 0 )" Sector 128 of 100000.... "( 1 / 0 )" Sector 256 of 100000.... "( 2 / 0 )" Sector 384 of 100000.... "( 0 / 128 )" Sector 512 of 100000.... "( 1 / 128 )" Sector 640 of 100000.... "( 3 / 128 )" Sector 768 of 100000.... "( 0 / 256 )" So you only need to add the part and functionality I in closed in quotes. I am using a program I wrote that allows you to specify any parity scheme that exists and shows you the sector on raid as well as which disk and absolute sector on that disk. I know this would be a great asset to your customers. I thank you in advance for adding this function. DataRecDude AKA Snap-Tech Douglas | ||
| Stefan Fleischmann Username: admin Registered: 1-2001 |
Sorry to hear that you are shocked. Please try to calm down and please note that contrary to your belief this feature was suggested before. I maintain a To Do list with the more realistic ideas and suggestions that we have/receive, and it already contains more than 800 items. | ||
| Stefan Fleischmann Username: admin Registered: 1-2001 |
Will be implemented in v15.2 Beta. | ||
| Thomas Ansorge Username: thomasansorge Registered: N/A |
Hello, I am running WinHex 15.3 SR-1 on Win XP for private use. I used an account with admistrator rights to install it and I use another account with restricted rights to acutally use the software (examining files, mainly). First, the installation software installed the software only for the administrator account. Creating a desktop link to WinHex.exe from the restricted account was not difficult, but I expected the installation software to do this for me... Then, the restricted user has no write access to the program directory C:\Programme\WinHex\. Therefore he cannot create his config file, for example. Can you please add features that are common in a multi user environment like user-dependend paths to config files and other such files? Thank you. Thomas | ||
| Stefan Fleischmann Username: admin Registered: 1-2001 |
No, the software is not meant to create any files in user-specific directories without asking. If it did, that would be unacceptable. WinHex is designed in such a way that it does not have to be installed and can be run from any directory on a hard disk or any kind of external USB device. If used for non-forensic purposes by a user who cannot create files in a directory from where he or she executes WinHex, you can have WinHex store its configuration in that user's registry instead. That way the usage of the winhex*.cfg files is avoided altogether. To that end, simply create an empty file named winhex.rgt in the directory from which WinHex is executed. (more information) | ||
| Thomas Ansorge Username: thomasansorge Registered: N/A |
Thank you, that works :-) Thomas |