WinHex v20.8 Specialist FC Portable

[Farid]

WinHex v20.8 Specialist | 5.21 MB |

WinHex portable is in its core a universal hexadecimal editor, particularly helpful in the realm of computer forensics, data recovery, low-level data processing, and IT security. An advanced tool for everyday and emergency use: inspect and edit all kinds of files, recover deleted files or lost data from hard drives with corrupt file systems or from digital camera cards.

Features:

* Disk editor for hard disks, floppy disks, CD-ROM & DVD, ZIP, Smart Media, Compact Flash, .
* Native support for FAT, NTFS, Ext2/3, ReiserFS, Reiser4, UFS, CDFS, UDF
* Built-in interpretation of RAID systems and dynamic disks
* Various data recovery techniques
* RAM editor, providing access to physical RAM and other processes' virtual memory
* Data interpreter, knowing 20 data types
* Editing data structures using templates (e.g. to repair partition table/boot sector)
* Concatenating and splitting files, unifying and dividing odd and even bytes/words
* Analyzing and comparing files
* Particularly flexible search and replace functions
* Disk cloning (under DOS with X-Ways Replica)
* Drive images & backups (optionally compressed or split into 650 MB archives)
* Programming interface (API) and scripting
* 256-bit AES encryption, checksums, CRC32, hashes (MD5, SHA-1, .)
* Erase (wipe) confidential files securely, hard drive cleansing to protect your privacy
* Import all clipboard formats, incl. ASCII hex values
* Convert between binary, hex ASCII, Intel Hex, and Motorola S
* Character sets: ANSI ASCII, IBM ASCII, EBCDIC, (Unicode)
* Instant window switching. Printing. Random-number generator.
* Supports files >4 GB. Very fast. Easy to use.

Additional Features of Specialist Licenses

Refine Volume Snapshot
1) Particularly thorough file system search
• FAT12/FAT16/FAT32: This option searches for orphaned subdirectories (subdirectories that are no longer referenced by any other directory).
• NTFS: This option searches for FILE records in sectors that do not belong to the current MFT. Such FILE records can be found e.g. after a partition has been recreated, reformatted, moved, resized, or defragmented. With a forensic license, in a second and third step, this option also searches INDX buffers and $LogFile for noteworthy index record remnants, which either reveal previous names or paths of renamed/moved files/directories that were known to the volume snapshot before or deleted files that the volume snapshot was not aware of before (without file contents, though).
• UDF: While the first and the last session of multi-session UDF CDs/DVDs will be listed automatically, additional sessions in the middle can be found only with this option.
• CDFS: Usually all sessions on a multi-session CD/DVDs are detected automatically. In cases where they are not (e.g. when CDFS co-exists with UDF or if the gaps between the sessions are unusually large), this will detect sessions beyond the first one.
Taking a thorough volume snapshot is possibly a lengthy operation, depending on the size of the volume, and for that reason this is not the standard procedure when opening volumes.

2) The "File header signature search" option helps to include files in the volume snapshot that can still be found in free or used drive space based on their file header signature and are no longer referenced by file system data structures. You are asked to select certain file types for detection, specify a default file size, an optional filename prefix etc. Please see "File Recovery by Type" and the file type definitions for details. Files found with this method will be included in the volume snapshot only if there is no other file in the volume snapshot with the same start sector number yet, to avoid duplicates. Files found with this method are listed with a generic filename and size as detected by the "File Recovery by Type" mechanism. If applied to a physical, partitioned evidence object, only unpartitioned space and partition gaps will be searched for signatures, and always at sector boundaries, because the partitions are treated as separate, additional evidence objects.

3) Hash values can be computed for files in the volume snapshot. In addition to this, a forensic license allows to match the hash values against individually selected (or simply all) hash sets in the internal hash database. The filter can then later be used to hide known irrelevant files. Files recognized as irrelevant with the help of the hash database are also excluded from further processing as part of volume snapshot refinement if the corresponding option is enabled, which among other benefits saves time.

------------------------------------*****------------------------------------

WinHex v20.8 Specialist FC Portable (5.21 MB)
NitroFlare Link(s)

[To see links please register or login]

RapidGator Link(s)

[To see links please register or login]