WinHex 11.5 Log Out | Topics | Search
Moderators | Edit Profile

X-Ways User Forum » Public Announcements » WinHex 11.5 « Previous Next »

Author Message
Stefan Fleischmann (Admin)
Posted on Wednesday, Apr 28, 2004 - 20:49:   

A beta version of WinHex 11.5 is now available here.

What's new?

* Two new data types are supported by the data interpreter: signed and unsigned 24-bit integers.

* Digit grouping can be enabled optionally for decimal numbers in the data interpreter. This setting also affects templates.

* File Recovery by Type now recovers JPEG, GIF, PNG, BMP, and TIFF files with their actual size (not the user-supplied maximum size) and can often detect corruption in recovered JPEG and GIF data that arises e.g. in case of file fragmentation.

* There is a new WinHex API function, WHX_WasFoundEx, which returns the number of search term occurrences replaced by WHX_

* WinHex can now evaluate mathematical expressions in script parameters and templates. Formulae must be enclosed in brackets to be recognized and may use variables. Supported operations are addition (+), subtraction (-), multiplication (*), integer division (/), modular division (%), bitwise AND (&), bitwise OR (|), and bitwise XOR (^).

* Annotation positions are now optionally highlighted in the editor window, and when the mouse cursor is moved over them, the descriptions are displayed in small yellow tooltips. You may optionally use line breaks in the text.

* You may now exclude files in File Recovery by Name and in Create Drive Contents Table using filename patterns that begin with a colon ( : ). For example, you may include all files except NTFS system files by providing the following patterns: *.*;:$*

* Create Drive Contents Table can now calculate hashes of the files in a partition or in an image file. Deleted files are no longer ignored, but hashed as if they were recovered by WinHex.

* For NTFS drives that have been formatted, recovery of files and folders using the Access button menu has been considerably improved and works more successfully when recovering files from the former volume. Remember, when you have found the FILE record of a folder (e.g. by searching for the folder name in Unicode), you can explore it in the directory browser or recover
it with all its subfolders and files using the appropriate commands in the context-sensitive Access button menu.

* The directory browser is now more flexible. It supports multiple selection in conjunction with the Open and the Recover/Copy command.

* There is a new command in the directory browser's context menu "Sort by directory entry location" (FAT) or "Sort by MFT ID" (NTFS), respectively.

* That cluster lists are displayed when double-clicking a file or directory in the directory browser is now optional. View | Show | Cluster Lists.

* If a sector with an MFT file record is on the screen, the details panel will now show the name and path of the file described by that record.

* You may now select images files directly as such in the file types drop-down list of the File | Open dialog, without the necessity to apply "Interpret File as Disk" afterwards.

* Gathering or initializing slack space has been significantly accelerated for FAT-formatted drives. Besides, it is now possible to gather slack space from FAT-formatted drives accessed as a partition or an image file.

* WinHex still selects MS Excel by default for viewing and editing tab-delimited text files. However, you may now select your favorite program if MS Excel cannot be found on your computer.

* Some minor improvements.


There will be a new license type called a forensic license, superior to a specialist license:

* Case management. You may create a case, enter details such case designation, description, and comments, examiner name and organization. You may associate any media, disk image, or recovered file with a case, add comments, annotations, a hash value, drive contents tables, extracted+slack space, verify the hash, etc.

* When working inside a case, all your actions are optionally logged. That includes exact dates and times and screenshots of dialog windows, so you will later know precisely what options you used.

* An extensive, hyper-linked HTML report can be automatically generated, including all annotations and the log. The report can easily be imported and further processed e.g. in MS Word.

* WinHex now supports Encase image files. The MD5 is imported automatically when adding an Encase image to a case.

* Create Drive Contents Table now offer an optional category view, where files are sorted by categories such as images, office documents, Internet, etc. File type categories can be fully customized.

* There is a gallery view feature that works in conjunction with the directory browser. Picture files that are displayed in the directory browser are represented as thumbnails in the gallery view. Double-clicking a thumbnail displays the image in full size.

* Drive Contents Tables are automatically saved in the current case and can be retrieved at any time by double-clicking the "Contents Table" item.

* WinHex is now able to detect host-protected areas (HPA, a.k.a. ATA protected areas) on many hard disk models.

* Filename extension/file type mismatch detection is now an extra feature of Create Drive Contents Table. For example, if an incriminating MS Word document is concealed with the innocuous extension ".dll", it will raise your particular
attention when you check the "Mismatch" column in the table. You may fully customize the file signature database.


WinHex 11.5 will be a free update for all users who purchased WinHex 10.7 or newer (e.g. online after Jan 31, 2003).

The upgrade to the new forensic license will be free for everyone who owns both a WinHex 10.7+ specialist and an Evidor license.
Stefan Fleischmann (Admin)
Posted on Friday, Apr 30, 2004 - 17:28:   

WinHex 11.5 Beta C:

* Recovering large files by name (also via the directory browser or the access button menu) from FAT-formatted drives is now considerably faster.

To do:

* Speed up skin color detection
Stefan Fleischmann (Admin)
Posted on Monday, May 3, 2004 - 18:35:   

WinHex 11.5 Beta D:

* Sped up skin color detection

* Small bug fixes
Stefan Fleischmann (Admin)
Posted on Tuesday, May 4, 2004 - 16:39:   

WinHex 11.5 Beta F:

* Recovering entire subdirectory structures from the directory browser previously failed with an error message. This was fixed.
Carl Garon
Posted on Tuesday, May 4, 2004 - 18:17:   

when digit grouping in active and 64 bit is also active in data interpreter, there is somme alphabetic characters after the 64 bits readings... and winhex (11.5 beta-F) freeze if I try to scroll in the file... both on Windows 2000 and Windows 98.
Stefan Fleischmann (Admin)
Posted on Tuesday, May 4, 2004 - 18:41:   

I could not reproduce the freeze, however, the inability of the digit grouping feature to deal with large 64-bit integer numbers should be fixed now with WinHex 11.5 Beta G. Thanks for your error report.
Carl Garon
Posted on Tuesday, May 4, 2004 - 19:04:   

I've just dowload again the beta version and I have teh beta E version, not the beta G version...
Carl Garon
Posted on Wednesday, May 5, 2004 - 1:05:   


I tried the beta G version and there is no more problem with the data interpreter 64 bit readind with digit grouping active (and no more freezing). But there is a bug with the viewing of the details panel in a screen resolution of 800x600. The contextuel menu is not available for the details panel and when I do |view|refresh view|, the datails panel disapears. Every things is ok in a screen resolution of 1024x768.

Both with win98 and win2000
Jimmy Weg (Jw)
Posted on Wednesday, May 5, 2004 - 2:07:   

I hope the posts on the Beta go in this thread. In Beta G, I mounted an image set (20G, FAT32) as a logical drive and tried to create a drive contents table. First an error box appeared with JPEG in the title bar and "unknown expression encounterred 0" in the message. I clicked OK and the dialog box opened. I tried to create a table of existing objects to the browser, with an MD5 hash. It stopped at some point with an Error 11 message indicating an error occurred while allocating 3.9G. I don't know whether all the files were listed, but no hashes were reported.

On another note, I associated my image files (.000) with WinHex. When I try to open them from Explorer, a DOS box opens at the directory level of where the image files exist. I'll have to look into that further, as maybe that's not associated with the beta. Thanks!
Stefan Fleischmann (Admin)
Posted on Wednesday, May 5, 2004 - 23:15:   

Thank you for your error reports.

WinHex 11.5 Beta H:

* 800x600 screen resolution error fixed.

* Erroneous complaint about offset 0 in JPEG file type definition fixed.

* FAT volume hashing error fixed.

* Made more obvious in dialog box and program help that hash values are included in the file output only, not in the directory browser.
Carl Garon
Posted on Wednesday, May 12, 2004 - 1:33:   


I have this script:

assign valeurhex 0x000000
{write valeurhex
inc valeurhex

and the first line of the result:
000000 010000 020000 030000 040000 050000 060000
As you can see I realy have 24 bit integer increment by one.
Now, I have this script:

assign valeurhex 0x000000
{assign valeurhex (valeurhex+1)
write valeurhex

and the first line of the result:
01 02 03 04 05 06 07 08 09 0A 0B

As you can see I don't have 24 bit integer increment by one.
When we have to only inc by one, this is not very important, but if I want to apply this:

assign valeurhex 0x000000
{assign valeurhex (valeurhex+1000)
write valeurhex

in a .bmp file and see the result in an image editor, it is not possible because the 24 bits type is no long there. And a script with 1000 "inc" operation is not a good alternative.
Since script now allow mathematical operation it would be nice to have the posibility to assign a parameter (8,16,24,32,64bits)for the integer that we want to do mathematical operation on it.

thanks and continue your good job!
Stefan Fleischmann (Admin)
Posted on Monday, May 17, 2004 - 0:16:   

We will provide a solution for this particular problem with a service release soon.

The WinHex 11.5 Beta version referenced above will become unavailable.
Sara Lopez (Sexysara)
Posted on Thursday, Jul 1, 2004 - 21:52:   

I've got missing 'hi.dll' error...
It also says that I must download full package,
but it did't work and I can't find hi.dll in other X-Ways packages.
Help me pls. :)
Stefan Fleischmann (Admin)
Posted on Friday, Jul 2, 2004 - 0:31:   

If you wish to use the full version, please consider ordering it.
Forum operated by X-Ways Software Technology AG.