POS File Format

Format of Position Data Files in “WinHex”

File format v2.1. Supported by WinHex 12.05 and later. POS files are used to store selected file or disk offsets along with a textual description. Look here for file format v2.0, which can still be read by WinHex.

Offset (0X) Type Description
0 char[16] File signature. ASCII characters “WinHex Pos v2.1” + 0X00
10 32-bit integer Flags. Currently all zero. Flag 0X01: All descriptions in Unicode instead of ASCII characters.
14 32-bit integer Specifies the number of position chunks stored in the POS file.
18 PositionChunk[] Position chunks of variable size, each containing one position offset and description.

The following section is optional and for internal purposes only. It may occur repeatedly. Extension of WinHex 9.3 and later.

n/a 16-bit integer Designates the length of the following string in ASCII characters.
n/a char[] Contains a string. Not null-terminated.

Position chunk format:

Type Element Description
16-bit integer Size Size of this chunk in bytes.
16-bit field Flags 0x0001 = Position is a search hit.
0x0002 = volatile/temporary (NTFS MFT auto-coloring)
0x0004 = volatile/temporary (new search hit highlighting)
0x0080 = Position is selected.
0x0100 = Extended chunk needed/available/saved.
0x0200 = Relative offset in extended chunk corresponds to raw text extract of the file (viewer component needed).
0x0400 = Descr is the path and name of a deleted file.
0x0800 = Descr is the path and name of a file whose slack contains the search hit.
0x1000 = Logical search hit that is located in a file that is part an archive.
64-bit integer Offset Specifies the start offset of the position itself, i. e. the offset within a file or a disk. In case of disk partitions with a file system: absolute offset.
64-bit integer Size Specifies the length of the position in bytes.
FILETIME Time Specifies the time this position was entered. 64-bit Win32 FILETIME format.
byte[3] RGB Color highlighting for this position. (0,0,0) designates the default color.
byte Padding Reserved.
16-bit integer DescrLen Designates the length of Descr in ASCII characters. In the current implementation of WinHex, 8192 at max. May be zero if no description is provided.
char[DescrLen] Descr Contains the position description in ASCII. Usually the name and path of the file where the search hit is located in. Null-terminated.
64-bit integer Relative Offset Optional. In extended chunks only. In case of disk partitions with a file system: relative offset in a file.
64-bit integer FileID Optional. In extended chunks only. In case of disk partitions with a file system: file identifier
16-bit integer PathLen Optional. In extended chunks only. Designates the length of the filename path in ASCII characters.
char[DescrLen] Path Optional. In extended chunks only. Contains a filename including the position description path n ASCII. Null-terminated.