|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||
|
|||||||||||||||||||
| #72: WinHex & X-Ways Forensics 11.9 released November 28, 2004 |
This mailing is to announce a major update, v11.9. Download URLs: WinHex: http://www.x-ways.net/winhex.zip (all languages) WinHex: http://www.x-ways.net/winhex-e.zip (English only) X-Ways Forensics: registered users please log in at http://www.x-ways.net/winhex/upgrade.html to receive the URL WinHex 11.9 is a free update for all users who purchased WinHex 11.0 or newer (e.g. online after Aug 12, 2003). If you do not qualify any more, or if you are interested in a different license type, please find out more about online upgrading at http://www.x-ways.net/winhex/upgrade.html. Purchasing the current version (or upgrading) entitles you to receive updates released in the following 12 months or more at no cost. ------------------------------------------------------------- TRAINING Computer forensics training in Seattle: January 25-28, 2005 For more information please see http://www.x-ways.net/training.html and http://www.x-ways.net/signup_ext.html. ------------------------------------------------------------- WHAT'S NEW? * WinHex now allows logical search operations in files and directories that are selected in the directory browser, even if a partition is available e.g. as an image file only and not mounted as a logical drive letter in Windows. The Simultaneous Search command for this can be found in the directory browser's context menu (specialist or forensic license only). Advantages and disadvantages: + The search scope can be limited to certain files and directories, also certain files that are part of a contents table. + Searching in files (usually = in the cluster chains allocated to files) is a "logical" kind of search. Will find search term occurrences even if the search term happens to be physically split in a fragmented file (occurs at the end and the beginning of two disjoint clusters) and even if the file is compressed at the NTFS file system level or if it is part of an archive such as ZIP, RAR, GZ etc. (not if encrypted). (forensic license only). + Files in which the searm term occurs can be automatically opened. - Unlike a search operation on a partition = search in a partition's sectors (= a "physical" kind of search), does not include unallocated space, slack space, or special system areas such as file allocation tables or logical surplus sectors. * There is no duplication of search hits in the Position Manager any more. E.g. if you first search physically and then logically on a partition and have WinHex archive search hits both times, only additional hits will be added the second time. * Annotations manually added to evidence objects are now maintained and reported separately from search hits. Important search hits can be moved to the list of annotations with the Position Manager's context menu. Search hits are now collectively recorded with the date and time when the search operation began (useful for sorting by two criteria). * The UDF file system is now supported in addition to FAT, NTFS, Ext2/Ext3, and CDFS/ISO9660 (specialist and forensic licenses only). * WinHex can now estimate the original size of MS Office documents when recovering such files "by type" and can now also distinguish between MS Excel, MS Word, and MS PowerPoint files and name them accordingly. (since v11.8 SR-3) * WinHex now understands both ways of numbering raw image file segments, .000-based and .001-based. Newly created image file segments will now start with .001 instead of .000. (since v11.8 SR-3) * WinHex now tries to identify obvious deleted partitions automatically and can scan for further formerly existing partitions in unpartitioned disk space when you invoke Tools | Disk Tools | Scan For Lost Partitions. * Contents tables are now loaded back into the directory browser at twice the speed. Unloading large contents tables has become similarly faster. * The directory browser can now sort in reverse order and still reveals the previous sort criterion with a lighter arrow. For example, if you first click the filename column and then the filenameextension column, files with the same extension will be internally still sorted by name. Also the directory browser can optionally now be displayed with a grid (see General Options). * The directory browser has new icons for deleted files and directories. Deleted objects that WinHex knows are no longer accessible (either because their first cluster has been reallocated or because they have a size of 0 bytes) have icons crossed out in red. * There is now a tooltip that indicates the path of a file if you place the mouse cursor over its icon in a contents table. * There is now a small extra button (a floppy disk icon) that allows to save changes to a contents table, after having deleted irrelevant files or directories from it. * It is now possible to create drive contents tables for all evidence objects in a case without further user interaction in one step. * A new option allows to create a case wide global contents table, by unifying contents tables from various evidence objects. The menu command for this can be found in the Case Data | Edit menu. Such a unified contents table is the most powerful way to review all files from all directories, from all partitions, from all media and image files associated with a case. (forensic license only) * There is now an option under Edit | Convert that allows to stretch 7-bit ASCII, which can be found e.g. on mobile phone SIM cards, to readable 8-bit ASCII. * There are now script and API commands that allow to interpret raw images, Encase images, and evidence files like physical disks or partitions, as known from the Specialist menu command. * It is now possible to select a track of a multi-session CD for display in the directory browser. * It is now possible to include data analysis charts in the case report (via the context menu). * Depending on which encryption algorithm was used, it is now possible to decrypt many encrypted ZIP and RAR archives if you know the original password, when exploring them in the directory browser. (forensic license only) * Filename mask string for contents table creation extended from 32 to 256 characters at max. "*.*" now means "files with a dot in their name". Generally two asterisks per file mask permitted now, at the beginning and end of the mask. * Previously, there was a small chance that WinHex was unable to determine the location of a file or directory on an NTFS volume, and a warning was displayed in that case. The probability of such a case has been considerably further reduced. * Many other minor improvements. ------------------------------------------------------------- X-Ways Replica 2.3 is now available for owners of a forensic license. * ATA password-protected drives can be unlocked with user or master password until system reboot if password is known. * Ext2, Ext3, Reiser, Linux Swap, JFS, XFS, MFS/HFS, and HPFS partitions are now recognized as such. * Available drive letters are listed when entering source or destination image filename with path. * Entering image filenames can be aborted any time by pressing the ESC key. * New menu font color light gray instead of blue. * X-Ways Forensics or Evidor license file needs to be present. Since v2.2: * Host-protected areas (HPAs) can now be disabled (unlocked) either permanently or until the next reboot only, so that it is accessible for cloning/imaging. * Up to 32 partitions are now displayed in the list and available for selection (instead of 15 at max. before). * Image segment numbering now starts with .001 (or non-numeric extension) instead of .000. The second segment ends with .002. * Copying selected sectors: Number of lines no longer limited to 500. ------------------------------------------------------------- FAQ: HOW TO INSTALL THE UPDATE CORRECTLY? Install the new version to the folder with your existing WinHex installation, using the setup program. There is no need for prior uninstalling. The existing installation must not be running when installing, of course. The setup program will warn you if your license no longer supports the new version as a free update, or if you need new license codes, before overwriting the existing installation. FAQ: WHAT VERSION DID I ORIGINALLY PURCHASE? The Help | About box tells you what version your license was issued for. |
| #71: WinHex & X-Ways Forensics 11.8 released October 25, 2004 |
This mailing is to announce a major update,
v11.8. Download URLs: WinHex: http://www.x-ways.net/winhex.zip (all languages) WinHex: http://www.x-ways.net/winhex-e.zip (English only) X-Ways Forensics: registered users please log in at http://www.x-ways.net/winhex/upgrade.html to receive the URL WinHex 11.8 is a free update for all users who purchased WinHex 10.92 or newer (e.g. online after July 13, 2003). If you do not qualify any more, or if you are interested in a different license type, please find out more about online upgrading at http://www.x-ways.net/winhex/upgrade.html. Purchasing the current version (or upgrading) entitles you to receive updates released in the following 12 months or more at no cost. ------------------------------------------------------------- TRAINING Computer forensics training in Seattle: January 25-28, 2005 For more information please see http://www.x-ways.net/training.html and http://www.x-ways.net/signup_ext.html. ------------------------------------------------------------- WHAT'S NEW? * In addition to FAT and NTFS, WinHex now fully supports the file systems Ext2, Ext3, and CDFS/ISO 9660/Joliet. (specialist and forensic license only) * Compatibility with Linux and Wine has been improved. WinHex can now easily open devices such as hard disks and main memory when run under Wine. * Positions/bookmarks/annotations may now have a description of up to 8192 characters (instead of just 255). Also they can now have an arbitrary length (instead of always just 1 byte). Plus you can select a unique color for each bookmark! Bookmark colors are mixed with block colors if a bookmark and the block overlap. * The limit of the simultaneous search's overall search term length has been extended from 255 to 30,000 characters. All the search terms will be included in the case log. Also, you can now easily load and save search term lists! * The Tools | Disk Tools | Clone Disk feature now works up to 30% faster if you enable simultaneous I/O and the destination is not the same physical medium as the source. * There is now a dedicated command for creating hash sets in the directory browser's context menu (forensic license only). It is no longer necessary to create a contents table as a by-product of a hash set. * When creating a drive contents table, WinHex can now perform an entropy test on unknown files to check whether they might be encrypted. (forensic license only) * When manually deleting irrelevant items from a contents table that is associated with an evidence object, WinHex can now save your changes to the contents table file. Plus it is now possible to review the original settings used to create a contents table that is associated with an evidence object, with the Properties command. * Greedy RAM utilization for very large partitions is no longer a problem. * There is now an alternative access method for optical discs and physical hard disks under Windows NT/2000/XP (see General Options), which may allow to access hard disks formatted in an unconventional way or other media that cannot be accessed otherwise, plus some sectors at the end of CD-ROMs/DVDs that may otherwise be missed. * There is a new option in the Edit | Conversion list that allows to decompress raw data from any number of 16-cluster units compressed by NTFS. * There is an option "Ext2/Ext3 block logic" in File Recovery by Type that causes this recovery method to deviate from the standard assumption of no fragmentation in that it will follow the typical Ext block pattern. * File Recovery by Type can now be applied to all open windows (e.g. 10 partitions) at the same time. * File Recovery by Type can now create and fill a new subfolder with recovered files if the maximum number of files per folder you specify is exceeded. This is useful because e.g. Windows Explorer can become very slow when dealing with huge folders. * When creating a contents table, filename/file type mismatches are now detected for non-existent (deleted or orphaned) files, too. Please note that false alerts might be displayed if a deleted file's clusters have been re-allocated to another file of a different type in the meantime. * It is now possible to specify a "null device" as the destination for the Clone Disk functionality. This is useful if you are interested in the report about bad sectors, but do not wish to actually copy all the sectors somewhere. (since v11.7 SR-5) * It is now possible to create a raw image out of an evidence file or vice-versa, and/or split or compress a previously unsplit/uncompressed image, by applying the Create Disk Image to an image file again. (since v11.7 SR-5) * Support for BZ2 archives and for superfloppy format improved. (since v11.7 SR-2) * Status bar added to registry viewer. (since v11.7 SR-1) * Slack space processing error fixed that was temporarily present in v11.7 (SR-7 through SR-13). * Many other minor improvements. |
| #70: WinHex & X-Ways Forensics 11.7 SR-14 (Bug Fix) October 16, 2004 |
This mailing is to specially announce a
service release,
v11.7 SR-14, which fixes an error that was present in WinHex
and X-Ways Forensics 11.7 SR-6 through SR-13: Slack space on NTFS partitions was not properly addressed by the commands "Gather Slack Space" and "Initialize Slack Space", meaning that data other than slack space was extracted or wiped. WinHex 11.7 SR-14 download URLs: http://www.x-ways.net/winhex.zip (all languages) http://www.x-ways.net/winhex-e.zip (English only) X-Ways Forensics 11.7 SR-14: registered users please log in at http://www.x-ways.net/winhex/upgrade.html to receive the URL. WinHex 11.7 SR-14 is still a free update for all users who purchased WinHex 10.82 or newer (e.g. online after May 21, 2003). Thank you for your attention. |
| #69: WinHex 11.7 released September 1, 2004 |
This mailing is to announce a noteworthy update, WinHex
11.7. ------------------------------------------------------------- WHAT'S NEW? * File | Make Disk Backup can now create raw images, split them into segments of a user-defined size and calculate a hash while creating the image. (any kind of license) * The same command can now also create compressed evidence files that include hashes and can later be interpreted like the original disks. (forensic license only) * Restoring compressed WinHex backups (.whx) is now between 10 and 20% faster. * The contents of ZIP and RAR archives can be examined right within the directory browser like the contents of a directory by applying the "Explore" command to such an archive. The gallery view works on files inside such archives, and any such file can be extracted, viewed or opened individually (except if encrypted). Also files inside archives can optionally be included and examined in a drive contents table like normal uncompressed files. (forensic license only) * After loading Windows registry files into the registry viewer, you may now use the automated report feature to examine interesting sections of the registry and list them in a report. (forensic license only) * GIF, JPEG, PNG, and ART files that have been added to a case can now be seen in the HTML case report directly (if displayed with MS Internet Explorer). * It is now possible to rename drive contents tables associated with an evidence objects and to import drive contents tables. (since v11.65 SR-2) * The last access date of a file within a logical drive or image is now recorded and included in the report before the file is added to a case. (since v11.65 SR-2) * The last modification date and time of Windows NT/2000/XP registry keys are now displayed in the registry viewer. (since v11.65 SR-7). * An error was fixed that prevented searching Win9x registry files with the registry viewer. * Several other minor improvements. * X-Ways Replica 2.12: Some errors fixed and minor improvements. Please see http://www.x-ways.net/replica.html for details. ------------------------------------------------------------- TRAINING About our computer forensics training program: We offer a course that explains all internals of the file systems FAT and NTFS, plus a course that systematically teaches the forensic edition of WinHex, X-Ways Forensics. For more information please see http://www.x-ways.net/training.html ! New classes have been scheduled for October. ------------------------------------------------------------- MD5 Collisions, Proven Just 2 Weeks Ago WinHex and X-Ways Forensics leave it up to you whether to use MD5, SHA-1, or SHA-256. Please read up on real MD5 collisions here: http://www.x-ways.net/md5collisions.html . |
| #68: WinHex 11.65 released August 4, 2004 |
This mailing is to announce a major update, WinHex 11.65. ------------------------------------------------------------- WHAT'S NEW? * WinHex can now access, open, recover, and examine files that are compressed at the NTFS file system level. They are decompressed transparently to the user "on the fly" when needed. * The possibilities to view files have been considerably improved. Multiple files can now be selected in the directory browser for viewing. For display in the integrated viewer, a file does not even need to be extracted internally from a hard disk partition or image file first. If the integrated viewer cannot open the file, it will invoke an external viewer. Up to 3 different external programs can now be defined and invoked directly. The internal viewer is available with a forensic license only and also accessible via the Tools menu and the case tree's context menu for evidence objects that are files. * In addition to various common picture file formats, the internal viewer can now display Windows 95/98/Me/2000/XP registry files in a tree-like structure as known from the Windows Registry Editor. * There is now always an Open command in the directory browser that allows you to open a file within a partition or image individually and directly in WinHex, without extracting it to the local hard disk first. Even NTFS alternate data streams and non-directory INDX records listed in a drive contents table can be opened that way. * Calculating hash values when creating a drive contents table and recovering files is now considerably faster for huge files on NTFS. * Templates now support null-terminated ASCII and Unicode strings as well as 24-bit integer data types. * Templates now allow for conditional data interpretation using IfEqual and IfGreater statements. * The new script command CalcHashEx not only calculates a hash, but also displays it on the screen. * The new script command IntToStr converts the specified integer or integer variable into a string that contains the decimal ASCII text representation of that integer value. * The new script command GetClusterAlloc retrieves a textual description of the current position, e.g. which file is stored in the currently displayed cluster of a logical drive, and saves that description in the specified variable. * Scripts now support up to 32 variables instead of 16. * Skin color detection was improved (number of false positives reduced). * Grouping existing and deleted files and directories in the directory browser is now optional. * You can now indicate your preferred gallery thumbnail size. * Optional background thumbnail loading. * Up to 16 (instead of 6 previously) virtual logical drives can be can opened at the same time (partitions from physical disks or image files). * Up to 8 (instead of 4 previously) virtual physical disks can be can opened at the same time (image files). * Graphic-related errors caused by the gallery view and by skin color detection under Windows 9x have been fixed. (since 11.6 SR-6) * An error in File Recovery by Type in conjunction with byte-level search and file signature footers was fixed. (since v11.6 SR-12) * An error was fixed that prevented certain Encase images to be read correctly. (since 11.6 SR-6) * When pressing Esc or closing the small progress indicator window, you now have to confirm that you wish to abort the current operation. * It is now possible to manually add log entries to a case. Date and time are recorded automatically. * Several other minor improvements. * The X-Ways Replica web page was updated with USB drivers that enable to you clone/image USB drives with X-Ways Replica or pick USB drives as the target. ------------------------------------------------------------- TRAINING About our computer forensics training program: We offer a course that explains all internals of the file systems FAT and NTFS, plus a course that systematically teaches the forensic edition of WinHex, X-Ways Forensics. For more information please see http://www.x-ways.net/training.html ! New classes have been scheduled for October. |
| #67: WinHex 11.6 released June 21, 2004 |
This mailing is to announce a major update, WinHex 11.6. ------------------------------------------------------------- WHAT'S NEW? * Switching between view mode, default edit mode, and in-place edit mode now has immediate affect on all open edit windows and is generally more straight-forward to use. (since 11.5 SR-4) * To enforce forensic procedures, WinHex's sister product X-Ways Forensics can only open those files for editing (e.g. conversion, decoding, decryption) that have been copied into the current case's folder. All other files, or disks in general, cannot be modified intentionally or accidentally whatsoever. So for example it is impossible to repair file system data structures with X-Ways Forensics. You need to use WinHex for that. The strict write protection is the only difference between X-Ways Forensics and WinHex operated with a forensic license. * File Recovery by Type is now easier to use. The recovery can be limited to a certain range of sectors simply by selecting a block prior to using it. (since 11.5 SR-4) * Files found by File Recovery by Type can now be just listed in the directory browser for inspection, without actually recovering them yet. * A drive contents table of non-existing files can now even include deleted files in unallocated clusters that are no longer referenced by any file system data structures if they can be recognized by their file header signature. * The hash values calculated by Create Drive Contents Table can now be matched against a hash database. It is up to you whether files that occur in the hash database will be included in the output or excluded. This allows you to conveniently check if certain known files are present on a hard disk (e.g. known malware) or to exclude known good files from your examination (e.g. standard Windows installation files). WinHex recognizes the hash database formats NSRL RDS 2.x, ILook, and HashKeeper. You can use the Create Drive Contents Table command also to create your own hash sets, in the NSRL RDS 2.x format. Available with a forensic license only. * You can now associate up to 10 drive contents tables with an evidence object. * The Create *Directory* Contents Table command is now ubiquitously available in the directory browser's context menu. * Raw mode for reading Audio CDs and for access to the full 2352-byte sectors on data CDs (CD-ROM and Video CDs), including error correction codes. * View command for all files in the directory browser (in conjunction with the external viewer defined in General Options, since 11.5 SR-4). * In gallery view, the selected picture is now highlighted. The gallery view's scroll behavior is now more convenient. * NTFS alternate data streams are now listed individually in a drive contents table, one per line (since 11.5 SR-7). Non-directory index streams are listed, too. * WinHex can now encode and decode Base64 and UUCode data. * The Italian user interface of WinHex has been newly translated. Translation by Fabrizio Degni. * The new script command CalcHash calculates a hash such as CRC32, MD5, SHA-1, and stores it in a variable. There is another new script command InitMFTRecords that clears unused MFT FILE records just like the disk tools menu command. * An error was fixed that under certain circumstances caused script commands to be applied to an edit window other than the intended one. * Several minor improvements. WinHex 11.6 is still a free update for all users who purchased WinHex 10.7 or newer (e.g. online after Jan 31, 2003). If you do not qualify any more, or if you are interested in a different license type, please find out more about online upgrading at http://www.x-ways.net/winhex/upgrade.html . Purchasing the current version (or upgrading) entitles you to receive updates released in the following 12 months or more at no cost. ------------------------------------------------------------- TRAINING About our computer forensics training program: We offer a course that explains all internals of the file systems FAT and NTFS, plus a course that teaches the forensic edition of WinHex and X-Ways Forensics. Please see http://www.x-ways.net/training.html for more information and the schedule. |
| #66: WinHex 11.5 released May 17, 2004 |
This mailing is to announce 1. a major update, WinHex 11.5, 2. the new computer forensics edition of WinHex, ...and our computer forensics training program. We offer a course that explains all internals of the file systems FAT and NTFS, plus a course that teaches the forensic edition of WinHex ("X-Ways Forensics"). Both courses are offered in Cologne, Germany, in English as well as German. Please see http://www.x-ways.net/training.html for more information and the schedule. ------------------------------------------------------------- 1. WHAT'S NEW? * Two new data types are supported by the data interpreter: signed and unsigned 24-bit integers. * Digit grouping can be enabled optionally for decimal numbers in the data interpreter. This setting also affects templates. * File Recovery by Type now recovers JPEG, GIF, PNG, BMP, TIFF, AVI, WAV, ZIP, and RTF files with their actual size (if below the user-supplied maximum size) and can often detect corruption in recovered JPEG and GIF data that arises e.g. in case of file fragmentation. * There is a new WinHex API function, WHX_WasFoundEx, which returns the number of search term occurrences replaced by WHX_Replace. * WinHex can now evaluate mathematical expressions in script parameters and templates. Formulae must be enclosed in brackets to be recognized and may use variables. Supported operations are addition (+), subtraction (-), multiplication (*), integer division (/), modular division (%), bitwise AND (&), bitwise OR (|), and bitwise XOR (^). * Annotation positions are now optionally highlighted in the editor window, and when the mouse cursor is moved over them, the descriptions are displayed in small yellow tooltips. You may optionally use line breaks in the text. * You may now exclude files in File Recovery by Name and in Create Drive Contents Table using filename patterns that begin with a colon (:). For example, you may include all files except NTFS system files by providing the following patterns: *.*;:$* * Create Drive Contents Table can now calculate hashes of the files in a partition or in an image file. Deleted files are no longer ignored, but hashed as if they were recovered by WinHex. * For NTFS drives that have been formatted, recovery of files and folders using the Access button menu has been considerably improved and works more successfully when recovering files from the former volume. Remember, when you have found the FILE record of a folder (e.g. by searching for the folder name in Unicode), you can explore it in the directory browser or recover it with all its subfolders and files using the appropriate commands in the context-sensitive Access button menu. * The directory browser is now more flexible. It supports multiple selection in conjunction with the Open and the Recover/Copy command. * Recovering large files by name (also via the directory browser or the access button menu) from FAT-formatted drives is now considerably faster. * There is a new command in the directory browser's context menu "Sort by directory entry location" (FAT) or "Sort by MFT ID" (NTFS), respectively. * That cluster lists are displayed when double-clicking a file or directory in the directory browser is now optional. View | Show | Cluster Lists. * If a sector with an MFT file record is on the screen, the details panel will now show the name and path of the file described by that record. * You may now select images files directly as such in the file types drop-down list of the File | Open dialog, without the necessity to apply "Interpret File as Disk" afterwards. * Gathering or initializing slack space has been significantly accelerated for FAT-formatted drives. Besides, it is now possible to gather slack space from FAT-formatted drives accessed as a partition or an image file. * WinHex still selects MS Excel by default for viewing and editing tab-delimited text files. However, you may now select your favorite program if MS Excel cannot be found on your computer. * Several minor improvements. The electronic manual has been updated as well. -- 2. NEW FORENSIC LICENSE: * Case management. You may create a case, enter details such case designation, description, and comments, examiner name and organization. You may associate any media, disk image, or recovered file with a case, add comments, annotations, a hash value, drive contents tables, extracted+slack space, verify the hash, etc. * When working inside a case, all your actions are optionally logged. That includes exact dates and times and screenshots of dialog windows, so you will later know precisely what options you used. * An extensive, hyper-linked HTML report can be automatically generated, including all annotations and the log. The report can easily be imported and further processed e.g. in MS Word. * WinHex now supports Encase image files. The MD5 is imported automatically when adding an Encase image to a case. * Create Drive Contents Table now offer an optional category view, where files are sorted by categories such as images, office documents, Internet, etc. File type categories can be fully customized. * There is a gallery view feature that works in conjunction with the directory browser. Picture files that are displayed in the directory browser are represented as thumbnails in the gallery view. Double-clicking a thumbnail displays the image in full size. * Drive Contents Tables are automatically saved in the current case and can be retrieved at any time by double-clicking the "Contents Table" item. * WinHex is now able to detect host-protected areas (HPA, a.k.a. ATA protected areas) on hard disks. * Filename extension/file type mismatch detection is now an extra feature of Create Drive Contents Table. For example, if an incriminating MS Word document is concealed with the innocuous extension ".dll", it will raise your particular attention when you check the "Mismatch" column in the table. You may fully customize the file signature database. * The new X-Ways Replica 2.0 version is available for owners of a WinHex forensic license and has the following new features: - Restoring an image file back to a disk - Calculating and logging hashes of the source data - Invoking the cloning process from the command line by means of parameters, for completely unattended operation - Option to clone only selected sectors, forwards or backwards - Audible notification (beep) of bad sectors during cloning - Additional information (like manufacturer model number) about hard disks - Detection and temporary removal of host-protected areas (HPA) -- WinHex 11.5 is a free update for all users who purchased WinHex 10.7 or newer (e.g. online after Jan 31, 2003). If you do not qualify any more, or if you are interested in a different license type, please find out more about online upgrading at http://www.x-ways.net/winhex/upgrade.html . Purchasing the current version (or upgrading) entitles you to receive updates released in the following 12 months or more at no cost. The upgrade to the new forensic license is free for everyone who owns both a WinHex 10.7+ specialist and an Evidor license. Otherwise please see http://www.x-ways.net/winhex/upgrade.html . ------------------------------------------------------------- FAQ: HOW DO I INSTALL THE UPDATE CORRECTLY? Install the new version to the folder with your existing WinHex installation, using the setup program. There is no need for prior uninstalling. The existing installation must not be running when installing, of course. The setup program will warn you if your license no longer supports the new version as a free update, before overwriting the existing installation. FAQ: WHAT VERSION DID I ORIGINALLY PURCHASE? The Help | About box tells you what version your license was issued for. |
| #65: WinHex 11.26 released March 2, 2004 |
This mailing is to announce a minor update, WinHex 11.26. Download
URLs: ------------------------------------------------------------- WHAT'S NEW? X-Ways Software Technology AG has opened a new office in Cologne. * File Recovery by Name: Naming convention for multiple recovered copies of the same filename improved. * File Recovery by Type: Ability to search for file header signatures in allocated space only (since v11.25 SR-3). * The Modify Data command now allows to left-shift data by entire bytes. This is useful if you wish to strip some bytes from a very huge file in in-place mode, which would otherwise require the creation of a huge temporary file. * The execution of a script can now be paused by pressing the Pause key even if no progress window is displayed (in Turbo Off mode). * Aborting the disk cloning process was unclean when done while a bad sector on the source disk processed. Fixed since v11.25 SR-8. * Option to exclude subdirectories when recovering with the directory browser on NTFS drives was previously without effect. * Some minor improvements. WinHex 11.26 is a free update for all users who purchased WinHex 10.55 or newer (e.g. online after Oct 10, 2002). If you do not qualify any more, or if you are interested in a different license type, please find out more about online upgrading at http://www.x-ways.net/winhex/upgrade.html . Purchasing the current version (or upgrading) entitles you to receive updates released in the following 15 months or more at no cost.------------------------------------------------------------- MAKING PARTITION BACKUPS WITH WINHEX http://www.x-ways.net/winhex/kb/resources/backup_e1.htmlby Daniel Gröger ------------------------------------------------------------- X-WAYS SUPPORT FORUM Unused accounts in the X-Ways support forum will be deleted shortly. Your account might
be considered unused |
| #64: WinHex 11.25 released Jan 17, 2004 |
This mailing is to announce a noteworthy update, WinHex
11.25. Download URLs: http://www.winhex.com/winhex.zip (all languages) http://www.winhex.com/winhex-e.zip (English only) ------------------------------------------------------------- What's new? * There is a new command in the Position menu that conveniently allows to jump to a certain entry in the file allocation table on a FAT drive and to a certain FILE record in the master file table on an NTFS drive. * Cluster lists are now more informative. They indicate fragmented cluster chains by inserting separator lines and display the total number of clusters and fragments at the bottom of the list. * It is now possible to gather free space from image files interpreted as a drive. * When recovering files and subdirectories from an NTFS drive via the directory browser, and WinHex encounters a subdirectory with an invalid name (garbled characters), it will now no longer skip the remaining items in the current directory. * There is now a variant of the Go To Offset dialog window where the unit size is the sector size. Alt++ will allow to jump x sectors down, Alt+- will allow to jump x sectors up. As known from Go To Offset, F11 will repeat the last movement, and Ctrl+F11 will do the inverse movement. * You may now delete items in the list of recently opened files and disks, e.g. for security reasons. * An error was fixed that occurred when interpreting several image file segments as a disk with an invidivual size of 2 GB or more. * An error in the WinHex API previously caused files to be opened in an undesired edit mode in certain situations. * The Portuguese translation has been updated. * Several minor improvements and bug fixes. * X-Ways Replica 1.3 is available (free for owners of a WinHex specialist license). Image files are now created with the read-only attribute set, and there is now more in-progress information about bad sectors encountered on the source disk and the current image file segment. WinHex 11.25 is a free update for all users who purchased WinHex 10.54 or newer (e.g. online after Sep 6, 2002). If you do not qualify any more, or if you are interested in a different license type, please find out more about online upgrading at http://www.x-ways.net/winhex/upgrade.html . Purchasing the current version (or upgrading) entitles you to receive updates released in the following 15 months or more at no cost. ------------------------------------------------------------- JOB OPENINGS If you are interested in a varied job in software development or computer forensics, you would like to work in Cologne (Germany), join X-Ways and contribute to the future of WinHex and other software products, please see our job offers at http://www.x-ways.net/corporate/jobs.html . Thank you. |