WinHex for Windows

Product summary

WinHex is a versatile hexadecimal editor designed for both routine and emergency use. It is especially useful for computer forensics, data recovery, low-level data manipulation, and IT security tasks. With it you can inspect and modify file contents at the byte level, recover deleted or corrupted data, and work directly with physical media and disk images.

Supported media and storage access

• Physical and removable media: CD/DVD, ZIP disks, hard drives, floppy disks, SmartMedia cards, and camera memory cards
• Direct disk editing capability for partitions and raw device access
• Access to both physical RAM and other processes’ virtual memory via the RAM editor

Filesystems and RAID handling

• Full compatibility with NTFS, FAT variants, Ext2/Ext3, ReiserFS, UDF and CDFS
• Built-in interpretation of RAID layouts and Windows dynamic disks for reconstructed views of data

Data formats, conversion, and interpretation

• Convert between binary, Intel Hex, Motorola S-record, hexadecimal ASCII and plain text formats
• Support for multiple character encodings, such as ANSI, IBM ASCII, EBCDIC and Unicode
• A data interpreter that understands two dozen common data types for easy value reading

Editing templates and structural repair

• Use templates to edit structured data — for example, to reconstruct partition tables or repair boot sectors
• Tools for splitting and concatenating files, and for rearranging or merging odd/even bytes or words

Search, analysis and comparison

• Simultaneous physical and logical searching with GREP-style syntax for complex queries
• Flexible search-and-replace options and multi-object logical searches across multiple evidence files at once
• File comparison and advanced analysis features with a preview mode for search results

Forensic workflows and evidence handling

• Create and manage drive images and backups, with optional compression and the ability to split archives into 650 MB chunks
• Evidence file containers for securely packaging selected files and passing them to other examiners for further analysis
• Refined volume snapshots that replace older drive-contents tables for more reliable evidence views

Automation, integration and development

• Scripting support and a programming interface (API) for automating repetitive tasks and integrating WinHex into toolchains

Security, integrity and cleanup

• Cryptographic and integrity utilities including 128-bit encryption, CRC32, MD5, SHA-1 and checksum functions
• Secure file wiping and whole-drive cleansing routines to protect sensitive information
• A built-in random-number generator for tasks that require entropy

Miscellaneous utilities

• Import from the clipboard in multiple formats, including ASCII hex values
• Instant window switching, printing support, and miscellaneous convenience tools that speed up forensic and recovery work