v12.6 |
- Refined volume snapshots supersede drive
contents tables
- Dynamic filters based on filename, deletion
status, file type category, ...
- GREP syntax for physical and logical
simultaneous search operations
- Searching logically in multiple evidence
objects at the same time now easier
- File preview mode available when reviewing
search hits
- Evidence file containers allow to pass on
selected files forensically to other examiners
|
v12.55 |
- Ability to find deleted or otherwise lost files on Reiser4 volumes
- Ability to rebuild the internal tree on Reiser4
volumes if root was lost
- Volume snapshots can include a “thorough”
search like drive contents tables
- 256-bit AES/Rijndael encryption, even for
evidence files
- Password protection for case files
- Tagging files and adding them to the table of
noteworthy files now separate
- New evidence object output subdirectory logic
- Ability to see search results while searching
physically and logically
- Ability to select several files for printing
with the viewer component
- Ability to open, preview, and export files with
search hits while searching
|
v12.5 |
- File systems HFS+ and Reiser4 now natively
supported (forensic licenses only)
- Exploring large directories regularly or
recursively now much faster
- Improvements related to “Deleted Objects”
directory
- Cluster allocation display improved for FAT
- Listing of NTFS ADS, INDX, and EFS streams
improved
- New directory browser columns: 1st cluster and
file ID
- Gallery view decoupled from directory browser
- Various other improvements to directory browser
- Better support for non-Western-European
characters in filenames (since v12.35)
- Many other improvements (see
newsletter archive for details)
- SR-2: Encryption error fixed
- SR-5: Slack space highlighting for FAT fixed
|
v12.35 |
- Fixed an error invoking external programs.
- Viewer component improvements.
|
v12.3 |
- Ability to include JPG and PNG files embedded
in DOC and PDF documents in a contents table
- Ability to conveniently remove duplicate
files based on hash values
- Some other minor improvements (see
newsletter)
- SR-1: Support for Apple Mac styled hard disk
partitioning, support for HFS+ date & time format, error
reloading certain contents tables fixed
- SR-2: Compatibility issue with evidence files
fixed, some fixes in CDFS, UDF, and ReiserFS support
- SR-3: Find Hex Values used directly after
Simultaneous Search previously still found the alternate search
terms - fixed. Unicode filename conversion improved.
|
v12.25 |
- Alternative disk access method #2 introduced,
suitable for physically damaged disks
- Record presentation and handling improved
- Now 50 instead 32 virtual logical drives and
physical disks supported
- Size of case log displayed
- NTFS MFT FILE record template
- File Recovery by Type can be applied to
physical RAM
- Some other minor improvements and bug fixes
|
v12.2 |
- Ability to prepare contents tables for report
purposes (forensic license only)
- Ability to conveniently copy contents tables
within the case data window (forensic license only)
- Support for RAID 5 dynamic disks (in addition
to simple, spanned, mirrored, striped, specialist+forensic
license only)
- Support for hardware RAID 0 systems (internal
destriping mechnism, specialist+forensic license only)
- Ability to map partitions in the Access
button menu manually
- Files with known extension, but unknown
signature specially flagged in Attr. column (forensic license
only)
- Display of bad blocks file and name-only
files in Ext2/Ext3
- New script commands: StrToInt and Release
- Error fixed that may have caused logical
search operations to abort prematurely depending on settings
- Various other improvements and some bug fixes
|
v12.15 |
- Physical RAM viewable and editable
- Physical access to floppy disks faster under
Windows 2000/XP
- Text decoding from PDF, WPD, CDR and VSD
files when searching logically (requires
viewer component)
- Opening files from search hit lists
- Highlighting thousands of search hits in the
sectors view is no longer slow
- Option to include filesystem areas in logical
searches (forensic license only)
- Unification of hash sets when importing
- Access to image files generally somewhat
faster
- Option to abort the viewer component when
loading takes too long
- Legend that explains icons, colors, and the
Attr. column (forensic license only)
- Optional column "File Type Category" in
directory browser
- Detection of ATA password protection under
Windows 2000/XP
- Error fixed that may have caused incomplete
evidence files to be created
|
v12.1 |
- Add-on
viewer component
- Powerful internal hash database
- Support for Windows dynamic volumes (simple,
spanned, striped)
- Evidence files created are now compatible with
industry standard
- Quick compression option for evidence files
- Create Disk Image feature deals more gracefully
with bad sectors
- Various improvements to the directory browser
- New script commands: StrCat, GetUserInput,
GetUserInputI, Terminate
- Various other improvements and some bug fixes
- SR-6: Prevents creation of evidence files with
a segment size of more than 2025 MB, which previously resulted in
incomplete images under special circumstances
|
v12.05 |
|
v12.0 |
- Directory tree
- File preview with signature check (forensic
license only)
- Calendar/timeline view (forensic license only)
- Reiser file system support (forensic license
only)
- Highlighting important files for future
reference
- Many minor improvements
- SR-9: error fixed in SHA-1 and SHA-256 for data
in excess of 512 MB
|
v11.9 |
|
v11.8 |
- Support for file systems Ext2, Ext3, and CDFS
- Compatibility with Linux and Wine improved
- Positions/annotations flexibility improved
- Simultaneous search: total maximum string length
increased
- Disk cloning can now be accelerated by up to 30%
- Null device supported as cloning target
- Creation of hash sets now a separate command
- Entropy test during contents table creation
- Greedy RAM utilization for very large partitions no
problem any more
- Alternative access method for hard disks and
optical disks
- Ext2/Ext3 block logic for File Recovery by Type
|
v11.7 |
- Examination of ZIP, RAR, ARJ, GZ, TAR, and BZ2 archives supported
- Creation of split raw images and compressed evidence files
- Automatically generated report on Windows registry files
- Various minor improvements
- SR-14: NTFS slack space processing error in SR-6
through SR-13 fixed.
|
v11.65 |
- Support for NTFS-compressed files under Windows NT/2000/XP
- Integration of internal and external viewers improved
- Internal registry viewer added
- New template data types int24, uint24, zstring, and zstring16
- Conditional template interpretation with IfEqual and IfGreater
- New script commands CalcHashEx, IntToStr, and GetClusterAlloc
- Various other improvements
- SR-1: temporary error in File Recovery by Name fixed that caused certain
files to be skipped on NTFS volumes
|
v11.5+11.6 |
- Major updates. Please see the newsletter issues #66+67 for details (newsletter archive).
- New forensic license introduced (X-Ways
Forensics).
- 11.6 SR-2: Error in hash matching fixed
11.6 SR-3: File recovery by type temporarily had no effect, this was fixed.
11.6 SR-6: Error in Encase image support fixed, gallery problems under Windows 9x/Me fixed
11.6 SR-12: Error in recovery by type in conjunction with byte-level search and file
signature footers fixed
11.6 SR-18: Unused FILE record initialization bug fixed
|
v11.26 |
- File recovery by name: naming conventions for multiple recovered copies
improved
- File recovery by type: ability to search for signatures in allocated
space only
- Left-shift bytes
- Pausing scripts even when no progress indicator window is displayed
- Aborting cloning while bad sectors are processed is now safe
- Several other minor improvements
|
v11.25 |
- Cluster list windows more informative
- Gather Free Space available for image files
- Variant of Go To Offset that allows movement in units of sectors
- Several minor improvements and bug fixes
- SR-1: New Position menu commands Go To FAT Entry and Go To FILE Record
|
v11.2 |
- Create Drive Contents Table can be output to the directory
browser, and generally improved
- Clone Disk can now be used to conveniently copy spanned image files back
to a hard disk
- Search in all open windows instead of all open files
only
- Template data type uint_flex
- Script command IfGreater
- Several minor improvements
|
v11.15 |
- Slack space initialization bug fixed that occurred when using multiple
passes
- Slack space initialization and extraction considerably accelerated on
NTFS drives
|
v11.14 |
- File Recovery by Type: Thorough option extended
- File Recovery by Type: rare cluster size in sector = 0 error
fixed
- Better integration with X-Ways Trace
|
v11.1 |
- File Recovery by Type can now recover files of multiple types at a time
- File Recovery by Type: separate recovery subfolders depending on type
- File Recovery by Type: optional thorough search, not only at cluster
boundaries
- File Recovery by Type now works with a customizable file type definition
file
- File Recovery by Type: now 30 predefined file types
- Ability to interpret and examine spanned image files consisting
of several segments
- Binary to Intel Hex and Motorola S conversion produces more compact
results
- WinHex API function WHX_SetFeedbackLevel
- Better support for very large and highly fragmented MFTs on NTFS drives
- "Invalid input" errors: now more obvious what is wrong
- Display errors in message boxes on some systems with large screen fonts
fixed
- SR-3: Capability to cope with circular FILE record references (NTFS)
- SR-4: Incomplete slack space processing error fixed on NTFS drive with
outdated cluster scan
|
v11.0 |
- Menu command to open any directory in the sector display in the directory
browser
- Disk cloning dialog window visually improved
- Option to avoid damaged disk areas during cloning added
- Option to write an ASCII pattern instead of unreadable source sectors
- File recovery by type improved for .dbx, .jpg, .avi, and .wav files
- File recovery by name: option to only recover files that are not
marked as deleted
- Two new WinHex API functions:
WHX_OpenEx and WHX_GetStatus
- Several minor improvements
|
v10.92 |
- Slack space initialization warnings do not require user interaction any
more
- Several other minor improvements
|
v10.9 |
- Directory browser has become more powerful, now supporting data recovery
- Lost & Found folder on NTFS drives, containing all
deleted files
- WinHex now allows up to 128 lines (instead of 64) and 256 bytes per line
(128)
- Disks up to 2,000 GB supported (instead of 1,000 GB)
- New specialist tools command: Media details report
- New specialist tools command: Gather inter-partition space
- Restoring compressed backups now up to 5 times faster!
- Resizability of windows improved
- Display bug fixed
- Parameter incorrect error should no longer occur
- Enforcing parameter interpretation as text in scripts
- Several other improvements
|
v10.82 |
- Ability to display hard drive model and serial no. improved
- Error handling for physically damaged disks improved
- Error fixed that occurred when dealing with large FAT32 drives
|
v10.8 |
- Find Hex Values can now search for non-matches
- Ability to search for the same text in Unicode and ASCII simultaneously
- File Recovery by Name accelerated for NTFS
- The API can now be tried in the evaluation version
- Several minor improvements and bug fixes
|
v10.75 |
- Directory browser introduced
- Enhanced NTFS support for image files and physical hard disk partitions
- Simultaneous search now supports hex values
- Restoring several WinHex backup segments into one flat image file
- Synchronize & compare now supports up to four windows at a time
- Disk model no.s can now often be displayed under Windows 2000/XP
- Several minor improvements
|
v10.7 |
- Highlighting free drive space and slack space
- Turbo mode for script execution
- Automatically recovering file in currently displayed NTFS file record
- Masking non-printable characters when gathering slack space
- ReplaceAll script command now applicable to disks
- InitFreeSpace and InitiSlackSpace script commands
- Various minor improvements
|
v10.65 |
- Disk and files wiping options improved
- Ability to treat disk image files like disks
- Clone Disk dialog optimized
- Bates-numbering files for discovery or evidentiary use
- Script command Assign expanded
|
v10.6 |
- Gathering free space, wiping disks, and cloning disks is often much
faster now
- Support for NTFS alternate data streams in drive contents tables
- Initializing unused $Mft records for security reasons
- DOS disk cloning tool included in
specialist license
- External viewer program executable from within WinHex
- New API function WHX_SetLastError
- Various minor improvements
|
v10.55 |
- Several minor improvements and error corrections
|
v10.54 |
- List Directory Clusters expanded to Directory
Browser
- Data analysis text file export
- New command Create Directory Contents Table (Specialist license only)
- Special API licenses introduced
- Various minor improvements
|
v10.52 |
- Added program-wide support for various checksums, CRC16, SHA-1, and
SHA-256
- Various minor improvements regarding disk access, record display, scripts
and templates
|
v10.5 |
- New data recovery feature (file recovery by name) for FAT and
NTFS
- Disk contents table feature expanded for NTFS
- Record display settings now per window
- Insert script command
- Trusted download with more than one file at a time
|
v10.47 |
- Jump command and search wildcards supported in scripts
- Output file for extracted free drive space now splittable
|
v10.46 |
- Additions to scripting and API
- Error corrections
|
v10.45 |
- RAM editing optionally including free memory regions
- Enhanced error messages for template interpretation
- Minor corrections and improvements
|
v10.44 |
- Simultaneous search for multiple keywords (Specialist only)
- Pre-set file headers for file retrieval
- Bit-wise AND and OR operations
- Routine feature dropped
- Minor improvements
|
v10.4 |
- Opens partitions from physical disk's Access menu
- Limited RAM editor access to memory range possible
- New license type Specialist and dedicated tool menu
- Disk catalog of all existing and deleted files and directories
- Gather text from files, disks, and memory
- Allows a series of file masks in Open Folder
- Complete backup listings in Backup Manager
- Split File command improved
- Context menu in cluster list windows
- Many minor improvements
|
v10.3 |
- Insert mode
- New script commands
- Octal notation supported by the Data Interpreter
- Copy as Delphi/Pascal source code
|
v10.25 |
- Create New File dialog extended
- Addition navigation controls in Synchronize & Compare mode
- Various minor enhancements
|
v10.2 |
|
v10.1 |
- WinHex API
introduced
- Physical access to CD-ROM/DVD under Windows NT/2000/XP
- Searching on physically damaged media
- Template windows printable
- 6 new script commands
|
v10.0 |
|
v9.92 |
- 65,535 file limit in cluster chain scanning overcome
- Several minor additions and fixes
|
v9.9 |
- Start Center
- Saving the window arrangement as a project
- Document cursor positions are remembered
- Alternative 3D button styles
- Template improvements
- Ready for Windows XP
|
v9.86 |
- More options for securely erasing files and free disk space
- Java date type introduced (incl. time zone option)
- Various minor enhancements
|
v9.82 |
- Shortcut button menu expanded for physical disks
- Some minor additions and fixes
|
v9.8 |
- Enhanced FAT12 support
- Shortcut button for quick access to partition tables, boot sectors, root
directories, and much more
- Surplus sectors of physical disks and logical floppy drives accessible
under Windows NT, too
- Big endian setting affects Unicode type
- Numerous other enhancements, see the newsletter
archive
|
v9.75 |
- Facilitates viewing and editing fixed-size records
|
v9.74 |
- Search capability of routines added
|
v9.73 |
- MD5 available for backups
- Some minor errors fixed
|
v9.72 |
- Separate command for listing directory clusters
- Overriding the detected number of clusters of a logical drive
- Restoring a file directly from a backup
- Some other enhancements
|
v9.7 |
- Enhanced support for NTFS drives (cluster - file allocation)
- Portuguese translation
- Automated file recovery based on headers and footers
- Synchronized scrolling & visual comparing
- Numerous other enhancements
|
v9.64 |
- CHS translation for physical disks under Windows 9x improved and now
customizable
|
v9.62 |
- Bit shifting (e.g. for bitstream editing)
- Splitting and unifying odd and even words (16-bit elements)
|
v9.6 |
|
v9.54 |
- Error in backup compression fixed
|
v9.53 |
- Now accepts UNIX end-of-line coding in Motorola S and Intel Hex files
- Error fixed that could occur with templates on physical disks
|
v9.52 |
- Some errors were fixed, e.g. cluster chain inspection previously failed
on some FAT16 drives
- NTFS boot sector template added
- Template definition language extended
|
v9.5 |
- Disk cloning functionality noticeably extended
- Finding all clusters allocated to a file or directory (FAT16/FAT32)
- 32-bit Intel Hex supported (instead of only 20-bit)
- Exporting Position Manager list as HTML
- Switching between positions using hotkeys
- Configuration optionally stored in Windows registry (details here)
|
v9.45 |
- Spanish user interface, program help, and manual
|
v9.41 |
- Several minor enhancements
|
v9.4 |
- Copying hex values as C/C++-formatted source code
- Copying reverse hex values for following 32-bit pointers
|
v9.38 |
- Search and replace strings extended from 30 to 50 characters at max.
- Search condition: offset mod x = y
- Copy Into New File no longer needs the clipboard as a buffer
|
v9.31 |
- Physical CHS sector numbering now starts with 1 instead of 0
- Intel-Hex and Motorola-S conversion enhanced
|
v9.3 |
- Editing data structures using templates
- ASCII hex values can be imported from the clipboard as binary data
|
v9.26 |
- Limited support for EBCDIC
- Main window resizable in the conventional way
|
v9.25 |
- Enhanced support for FAT16 and FAT32 drives:
WinHex displays to which file/directory a cluster/sector is allocated or whether it is
unused.
|
v9.2 |
- Compressed file backups and drive images (optional, same compression
ratio as ZIP)
- Splitting drive images (e.g. into 650 MB volumes for archiving on CD-R)
- Bad-sector-tolerant drive cloning
- Search algorithm's speed increased by another 7.5%
- Lengthy operations may be paused and resumed by pressing the PAUSE key
- Offset display relative to records of a user-defined length
- Minor improvements
|
v9.12 |
- Optionally hex display only
- Support for very high screen resolutions improved
- Minor improvements
|
v9.11 |
- Disk editor and RAM editor now fully compatible with Windows 2000
- Internal sector caching
|
v9.05 |
- Disk Editor grants access beyond the 8 GB barrier on physical disks even
under Windows 95 and 98.
|
v9.04 |
- Big-endian data supported by the Data Interpreter
- Menu icons
- Oddities with wheel mouse support fixed
- Minor improvements
|
v9.0 |
- Toolbar
- Enhanced look for true color mode
- French user interface
- Search from the cursor position forward and backward
- Variable number of hex values per line (better utilization of high screen
resolutions)
- Variable hex value groups
- Optionally text display only
- Simple XOR encryption/decryption
- Pages are fully utilized when printing
- Command to invoke external text editor for current file
|