WinHex: Additional Features of Specialist
Refine Volume Snapshot
1) Particularly thorough file system search
• FAT12/FAT16/FAT32: This option searches for orphaned subdirectories
(subdirectories that are no longer referenced by any other directory).
• NTFS: This option searches for FILE records in sectors that do not belong
to the current MFT. Such FILE records can be found e.g. after a partition
has been recreated, reformatted, moved, resized, or defragmented. With a
forensic license, in a second and third step, this option also searches INDX
buffers and $LogFile for noteworthy index record remnants, which either
reveal previous names or paths of renamed/moved files/directories that were
known to the volume snapshot before or deleted files that the volume
snapshot was not aware of before (without file contents, though).
• UDF: While the first and the last session of multi-session UDF CDs/DVDs
will be listed automatically, additional sessions in the middle can be found
only with this option.
• CDFS: Usually all sessions on a multi-session CD/DVDs are detected
automatically. In cases where they are not (e.g. when CDFS co-exists with
UDF or if the gaps between the sessions are unusually large), this will
detect sessions beyond the first one.
Taking a thorough volume snapshot is possibly a lengthy operation, depending
on the size of the volume, and for that reason this is not the standard
procedure when opening volumes.
2) The "File header signature search" option helps to include files in the
volume snapshot that can still be found in free or used drive space based on
their file header signature and are no longer referenced by file system data
structures. You are asked to select certain file types for detection,
specify a default file size, an optional filename prefix etc. Please see
"File Recovery by Type" and the file type definitions for details. Files
found with this method will be included in the volume snapshot only if there
is no other file in the volume snapshot with the same start sector number
yet, to avoid duplicates. Files found with this method are listed with a
generic filename and size as detected by the "File Recovery by Type"
mechanism. If applied to a physical, partitioned evidence object, only
unpartitioned space and partition gaps will be searched for signatures, and
always at sector boundaries, because the partitions are treated as separate,
additional evidence objects.
3) Hash values can be computed for files in the volume snapshot. In addition
to this, a forensic license allows to match the hash values against
individually selected (or simply all) hash sets in the internal hash
database. The filter can then later be used to hide known irrelevant files.
Files recognized as irrelevant with the help of the hash database are also
excluded from further processing as part of volume snapshot refinement if
the corresponding option is enabled, which among other benefits saves time.
Technical Details Report: Shows information about the currently
active disk or file and lets you copy it e.g. into a report you are writing.
Most extensive on physical hard disks, where details for each partition and
even unallocated gaps between existing partitions are pointed out. WinHex also reports the password protection status of
Forensic license only: WinHex is able to detect hidden host-protected areas
(HPAs, a.k.a. ATA-protected areas) and device configuration overlays (DCO
areas) on ATA hard disks. A message box with a
warning will be displayed in case the disk size has been artificially
reduced. At any rate, the real total number of sectors according to ATA, if
it can be determined, is listed in the details report. Some important SMART
status information is also displayed, for hard disks connected via [S]ATA
that support SMART. Useful to check for one's own hard disk as well as that
of suspects. For example, you can learn how often and how long the hard disk
was used and whether it has had any bad sectors (in the sense that
unreliable sectors were replaced internally with spare sectors). If a hard
disk is returned to a suspect and he or she consequently complains about bad
sectors and accuses you of having damaged the disk, a details report created
when the hard disk was initially captured can now show whether it was
already in a bad shape at that time. Also, seeing that spare sectors are in
use means knowing that there is additional data to gain from the hard disk
(with the appropriate technical means).
Interpret Image File As Disk: Treats a currently open and active disk
image file as either a logical drive or physical disk. This is useful if you
wish to closely examine the file system structure of a disk image, extract
files, etc. without copying it back to a disk. If interpreted as a physical
disk, WinHex can access and open the partitions contained in the image
individually as known from "real" physical hard disks.
WinHex is even able to interpret spanned raw image files, that is, image
files that consist of separate segments of any size. For WinHex to detect a
spanned image file, the first segment may have an arbitrary name and a
non-numeric extension or the extension ".001". The second segment must have
the same base name, but the extension ".002", the third segment ".003", and
so forth. Both the Create Disk Image command and the DOS cloning tool X-Ways
Replica are able to image disks and produce canonically named file segments.
Image segmentation is useful because the maximum file size supported FAT
file systems is limited.
In some rare cases WinHex may be unable to correctly determine whether the
first sector in an image is the sector that contains a master boot record or
already a boot sector, and consequently interprets the image structure in a
wrong way. If so, hold the Shift key when invoking this command. That way
WinHex will ask you and not decide on its own. That will also make WinHex
prompt you for the original sector size. When the segments of a raw image
are spread across two different drives, you may hold the Control key to be
able to specify the other storage location. Should there be any problems
with detecting the file system in a volume, you may hold both Ctrl and Shift
while opening it to indicate the file system type you suppose in the volume
Mode 1 ISO CD images are also supported, if they are not spanned, and (with
a forensic license) also main memory dumps. With a forensic license, WinHex
can also interpret .e01 evidence files, which can be created with the Create
Disk Image command.
Reconstruct RAID System: see user manual
Gather Free Space: Traverses the currently open logical drive and
gathers all unused clusters in a destination file you specify. Useful to
examine data fragments from previously existing files that have not been
deleted securely. Does not alter the source drive in any way. The
destination file must reside on another drive.
Gather Slack Space: Collects slack space (the unused bytes in the
respective last clusters of all cluster chains, beyond the actual end of a
file) in a destination file. Otherwise similar to Gather Free Space. WinHex
cannot access slack space of files that are compressed or encrypted at the
file system level.
Gather Inter-Partition Space: Captures all space on a physical hard
disk that does not belong to any partition in a destination file, for quick
inspection to find out if something is hidden there or left from a prior
Gather Text: Recognizes text according to the parameters you specify
and captures all occurrences from a file, a disk, or a memory range in a
file. This kind of filter is useful to considerably reduce the amount of
data to handle e.g. if a computer forensics specialist is looking for leads
in the form of text, such as e-mail messages, documents, etc. The target
file can easily be split at a user-defined size. This function can also be
applied to a file with collected slack space or free space, or to damaged
files in a proprietary format than can no longer be opened by their native
applications, like MS Word, to recover at least unformatted text.
Bates-Number Files: Bates-numbers all the files within a given folder
and its subfolders for discovery or evidentiary use. A constant prefix (up
to 13 characters long) and a unique serial number are inserted between the
filename and the extension in a way attorneys traditionally label paper
documents for later accurate identification and reference.
Trusted Download: Solves a security problem. When transferring
unclassified material from a classified hard disk drive to unclassified
media, you need to be certain that it will have no extraneous information in
any cluster or sector "overhang" spuriously copied along with the actual
file, since this slack space may still contain classified material from a
time when it was allocated to a different file. This command copies file in
their current size, and no byte more. It does not copy entire sectors or
clusters, as conventional copy commands do. Multiple files in the same
folder can be copied at the same time.
Highlight Free Space/Slack Space: Displays offsets and data in softer
colors (light blue and gray, respectively). Helps to easily identify these
special drive areas. Works on FAT, NTFS, and Ext2/Ext3 partitions.