v12.6

• Refined volume snapshots supersede drive contents tables
• Dynamic filters based on filename, deletion status, file type category, ...
• GREP syntax for physical and logical simultaneous search operations
• Searching logically in multiple evidence objects at the same time now easier
• File preview mode available when reviewing search hits
• Evidence file containers allow to pass on selected files forensically to other examiners

v12.55

• Ability to find deleted or otherwise lost files on Reiser4 volumes
• Ability to rebuild the internal tree on Reiser4 volumes if root was lost
• Volume snapshots can include a “thorough” search like drive contents tables
• 256-bit AES/Rijndael encryption, even for evidence files
• Password protection for case files
• Tagging files and adding them to the table of noteworthy files now separate
• New evidence object output subdirectory logic
• Ability to see search results while searching physically and logically
• Ability to select several files for printing with the viewer component
• Ability to open, preview, and export files with search hits while searching

v12.5

• File systems HFS+ and Reiser4 now natively supported (forensic licenses only)
• Exploring large directories regularly or recursively now much faster
• Improvements related to “Deleted Objects” directory
• Cluster allocation display improved for FAT
• Listing of NTFS ADS, INDX, and EFS streams improved
• New directory browser columns: 1st cluster and file ID
• Gallery view decoupled from directory browser
• Various other improvements to directory browser
• Better support for non-Western-European characters in filenames (since v12.35)
• Many other improvements (see newsletter archive for details)
• SR-2: Encryption error fixed
• SR-5: Slack space highlighting for FAT fixed

v12.35

• Fixed an error invoking external programs.
• Viewer component improvements.

v12.3

• Ability to include JPG and PNG files embedded in DOC and PDF documents in a contents table
• Ability to conveniently remove duplicate files based on hash values
• Some other minor improvements (see newsletter)
• SR-1: Support for Apple Mac styled hard disk partitioning, support for HFS+ date & time format, error reloading certain contents tables fixed
• SR-2: Compatibility issue with evidence files fixed, some fixes in CDFS, UDF, and ReiserFS support
• SR-3: Find Hex Values used directly after Simultaneous Search previously still found the alternate search terms - fixed. Unicode filename conversion improved.

v12.25

• Alternative disk access method #2 introduced, suitable for physically damaged disks
• Record presentation and handling improved
• Now 50 instead 32 virtual logical drives and physical disks supported
• Size of case log displayed
• NTFS MFT FILE record template
• File Recovery by Type can be applied to physical RAM
• Some other minor improvements and bug fixes

v12.2

• Ability to prepare contents tables for report purposes (forensic license only)
• Ability to conveniently copy contents tables within the case data window (forensic license only)
• Support for RAID 5 dynamic disks (in addition to simple, spanned, mirrored, striped, specialist+forensic license only)
• Support for hardware RAID 0 systems (internal destriping mechnism, specialist+forensic license only)
• Ability to map partitions in the Access button menu manually
• Files with known extension, but unknown signature specially flagged in Attr. column (forensic license only)
• Display of bad blocks file and name-only files in Ext2/Ext3
• New script commands: StrToInt and Release
• Error fixed that may have caused logical search operations to abort prematurely depending on settings
• Various other improvements and some bug fixes

v12.15

• Physical RAM viewable and editable
• Physical access to floppy disks faster under Windows 2000/XP
• Text decoding from PDF, WPD, CDR and VSD files when searching logically (requires viewer component)
• Opening files from search hit lists
• Highlighting thousands of search hits in the sectors view is no longer slow
• Option to include filesystem areas in logical searches (forensic license only)
• Unification of hash sets when importing
• Access to image files generally somewhat faster
• Option to abort the viewer component when loading takes too long
• Legend that explains icons, colors, and the Attr. column (forensic license only)
• Optional column "File Type Category" in directory browser
• Detection of ATA password protection under Windows 2000/XP
• Error fixed that may have caused incomplete evidence files to be created

v12.1

• Add-on viewer component
• Powerful internal hash database
• Support for Windows dynamic volumes (simple, spanned, striped)
• Evidence files created are now compatible with industry standard
• Quick compression option for evidence files
• Create Disk Image feature deals more gracefully with bad sectors
• Various improvements to the directory browser
• New script commands: StrCat, GetUserInput, GetUserInputI, Terminate
• Various other improvements and some bug fixes
• SR-6: Prevents creation of evidence files with a segment size of more than 2025 MB, which previously resulted in incomplete images under special circumstances

v12.05

• See newsletter archive.
• SR-6: some minor errors fixed

v12.0

• Directory tree
• File preview with signature check (forensic license only)
• Calendar/timeline view (forensic license only)
• Reiser file system support (forensic license only)
• Highlighting important files for future reference
• Many minor improvements
• SR-9: error fixed in SHA-1 and SHA-256 for data in excess of 512 MB

v11.9

• See newsletter archive.

v11.8

• Support for file systems Ext2, Ext3, and CDFS
• Compatibility with Linux and Wine improved
• Positions/annotations flexibility improved
• Simultaneous search: total maximum string length increased
• Disk cloning can now be accelerated by up to 30%
• Null device supported as cloning target
• Creation of hash sets now a separate command
• Entropy test during contents table creation
• Greedy RAM utilization for very large partitions no problem any more
• Alternative access method for hard disks and optical disks
• Ext2/Ext3 block logic for File Recovery by Type

v11.7

• Examination of ZIP, RAR, ARJ, GZ, TAR, and BZ2 archives supported
• Creation of split raw images and compressed evidence files
• Automatically generated report on Windows registry files
• Various minor improvements
• SR-14: NTFS slack space processing error in SR-6 through SR-13 fixed.

v11.65

• Support for NTFS-compressed files under Windows NT/2000/XP
• Integration of internal and external viewers improved
• Internal registry viewer added
• New template data types int24, uint24, zstring, and zstring16
• Conditional template interpretation with IfEqual and IfGreater
• New script commands CalcHashEx, IntToStr, and GetClusterAlloc
• Various other improvements
• SR-1: temporary error in File Recovery by Name fixed that caused certain files to be skipped on NTFS volumes

v11.5+11.6

• Major updates. Please see the newsletter issues #66+67 for details (newsletter archive).
• New forensic license introduced (X-Ways Forensics).
• 11.6 SR-2: Error in hash matching fixed
  11.6 SR-3: File recovery by type temporarily had no effect, this was fixed.
  11.6 SR-6: Error in Encase image support fixed, gallery problems under Windows 9x/Me fixed
  11.6 SR-12: Error in recovery by type in conjunction with byte-level search and file signature footers fixed
  11.6 SR-18: Unused FILE record initialization bug fixed

v11.26

• File recovery by name: naming conventions for multiple recovered copies improved
• File recovery by type: ability to search for signatures in allocated space only
• Left-shift bytes
• Pausing scripts even when no progress indicator window is displayed
• Aborting cloning while bad sectors are processed is now safe
• Several other minor improvements

v11.25

• Cluster list windows more informative
• Gather Free Space available for image files
• Variant of Go To Offset that allows movement in units of sectors
• Several minor improvements and bug fixes
• SR-1: New Position menu commands Go To FAT Entry and Go To FILE Record

v11.2

• “Create Drive Contents Table” can be output to the directory browser, and generally improved
• Clone Disk can now be used to conveniently copy spanned image files back to a hard disk
• Search in all open windows instead of all open files only
• Template data type uint_flex
• Script command IfGreater
• Several minor improvements

v11.15

• Slack space initialization bug fixed that occurred when using multiple passes
• Slack space initialization and extraction considerably accelerated on NTFS drives

v11.14

• File Recovery by Type: “Thorough” option extended
• File Recovery by Type: rare “cluster size in sector = 0” error fixed
• Better integration with X-Ways Trace

v11.1

• File Recovery by Type can now recover files of multiple types at a time
• File Recovery by Type: separate recovery subfolders depending on type
• File Recovery by Type: optional thorough search, not only at cluster boundaries
• File Recovery by Type now works with a customizable file type definition file
• File Recovery by Type: now 30 predefined file types
• Ability to interpret and examine spanned image files consisting of several segments
• Binary to Intel Hex and Motorola S conversion produces more compact results
• WinHex API function WHX_SetFeedbackLevel
• Better support for very large and highly fragmented MFTs on NTFS drives
• "Invalid input" errors: now more obvious what is wrong
• Display errors in message boxes on some systems with large screen fonts fixed
• SR-3: Capability to cope with circular FILE record references (NTFS)
• SR-4: Incomplete slack space processing error fixed on NTFS drive with outdated cluster scan

v11.0

• Menu command to open any directory in the sector display in the directory browser
• Disk cloning dialog window visually improved
• Option to avoid damaged disk areas during cloning added
• Option to write an ASCII pattern instead of unreadable source sectors
• File recovery by type improved for .dbx, .jpg, .avi, and .wav files
• File recovery by name: option to only recover files that are not marked as deleted
• Two new WinHex API functions: WHX_OpenEx and WHX_GetStatus
• Several minor improvements

v10.92

• Slack space initialization warnings do not require user interaction any more
• Several other minor improvements

v10.9

• Directory browser has become more powerful, now supporting data recovery
• “Lost & Found” folder on NTFS drives, containing all deleted files
• WinHex now allows up to 128 lines (instead of 64) and 256 bytes per line (128)
• Disks up to 2,000 GB supported (instead of 1,000 GB)
• New specialist tools command: Media details report
• New specialist tools command: Gather inter-partition space
• Restoring compressed backups now up to 5 times faster!
• Resizability of windows improved
• Display bug fixed
• “Parameter incorrect” error should no longer occur
• Enforcing parameter interpretation as text in scripts
• Several other improvements

v10.82

• Ability to display hard drive model and serial no. improved
• Error handling for physically damaged disks improved
• Error fixed that occurred when dealing with large FAT32 drives

v10.8

• Find Hex Values can now search for “non-matches”
• Ability to search for the same text in Unicode and ASCII simultaneously
• File Recovery by Name accelerated for NTFS
• The API can now be tried in the evaluation version
• Several minor improvements and bug fixes

v10.75

• Directory browser introduced
• Enhanced NTFS support for image files and physical hard disk partitions
• Simultaneous search now supports hex values
• Restoring several WinHex backup segments into one flat image file
• Synchronize & compare now supports up to four windows at a time
• Disk model no.s can now often be displayed under Windows 2000/XP
• Several minor improvements

v10.7

• Highlighting free drive space and slack space
• Turbo mode for script execution
• Automatically recovering file in currently displayed NTFS file record
• Masking non-printable characters when gathering slack space
• ReplaceAll script command now applicable to disks
• InitFreeSpace and InitiSlackSpace script commands
• Various minor improvements

v10.65

• Disk and files wiping options improved
• Ability to treat disk image files like disks
• Clone Disk dialog optimized
• Bates-numbering files for discovery or evidentiary use
• Script command Assign expanded

v10.6

• Gathering free space, wiping disks, and cloning disks is often much faster now
• Support for NTFS alternate data streams in drive contents tables
• Initializing unused $Mft records for security reasons
• DOS disk cloning tool included in specialist license
• External viewer program executable from within WinHex
• New API function WHX_SetLastError
• Various minor improvements

v10.55

• Several minor improvements and error corrections

v10.54

• “List Directory Clusters” expanded to “Directory Browser”
• Data analysis text file export
• New command Create Directory Contents Table (Specialist license only)
• Special API licenses introduced
• Various minor improvements

v10.52

• Added program-wide support for various checksums, CRC16, SHA-1, and SHA-256
• Various minor improvements regarding disk access, record display, scripts and templates

v10.5

• New data recovery feature (“file recovery by name”) for FAT and NTFS
• Disk contents table feature expanded for NTFS
• Record display settings now per window
• “Insert” script command
• “Trusted download” with more than one file at a time

v10.47

• Jump command and search wildcards supported in scripts
• Output file for extracted free drive space now splittable

v10.46

• Additions to scripting and API
• Error corrections

v10.45

• RAM editing optionally including free memory regions
• Enhanced error messages for template interpretation
• Minor corrections and improvements

v10.44

• Simultaneous search for multiple keywords (Specialist only)
• Pre-set file headers for file retrieval
• Bit-wise AND and OR operations
• Routine feature dropped
• Minor improvements

v10.4

• Opens partitions from physical disk's Access menu
• Limited RAM editor access to memory range possible
• New license type “Specialist” and dedicated tool menu
• Disk catalog of all existing and deleted files and directories
• Gather text from files, disks, and memory
• Allows a series of file masks in Open Folder
• Complete backup listings in Backup Manager
• Split File command improved
• Context menu in cluster list windows
• Many minor improvements

v10.3

• Insert mode
• New script commands
• Octal notation supported by the Data Interpreter
• Copy as Delphi/Pascal source code

v10.25

• Create New File dialog extended
• Addition navigation controls in Synchronize & Compare mode
• Various minor enhancements

v10.2

• New data recovery mechanism added
• New disk tools: Gather Free Space/Slack Space, Initialize Slack Space

v10.1

• WinHex API introduced
• Physical access to CD-ROM/DVD under Windows NT/2000/XP
• Searching on physically damaged media
• Template windows printable
• 6 new script commands

v10.0

• Major update of the year 2001! A bunch of new features have been implemented.

v9.92

• 65,535 file limit in cluster chain scanning overcome
• Several minor additions and fixes

v9.9

• Start Center
• Saving the window arrangement as a project
• Document cursor positions are remembered
• Alternative 3D button styles
• Template improvements
• Ready for Windows XP

v9.86

• More options for securely erasing files and free disk space
• Java date type introduced (incl. time zone option)
• Various minor enhancements

v9.82

• Shortcut button menu expanded for physical disks
• Some minor additions and fixes

v9.8

• Enhanced FAT12 support
• Shortcut button for quick access to partition tables, boot sectors, root directories, and much more
• Surplus sectors of physical disks and logical floppy drives accessible under Windows NT, too
• Big endian setting affects Unicode type
• Numerous other enhancements, see the newsletter archive

v9.75

• Facilitates viewing and editing fixed-size records

v9.74

• Search capability of routines added

v9.73

• MD5 available for backups
• Some minor errors fixed

v9.72

• Separate command for listing directory clusters
• Overriding the detected number of clusters of a logical drive
• Restoring a file directly from a backup
• Some other enhancements

v9.7

• Enhanced support for NTFS drives (cluster - file allocation)
• Portuguese translation
• Automated file recovery based on headers and footers
• Synchronized scrolling & visual comparing
• Numerous other enhancements

v9.64

• CHS translation for physical disks under Windows 9x improved and now customizable

v9.62

• Bit shifting (e.g. for bitstream editing)
• Splitting and unifying odd and even words (16-bit elements)

v9.6

• Major update of the year 2000! A bunch of new features have been implemented.

v9.54

• Error in backup compression fixed

v9.53

• Now accepts UNIX end-of-line coding in Motorola S and Intel Hex files
• Error fixed that could occur with templates on physical disks

v9.52

• Some errors were fixed, e.g. cluster chain inspection previously failed on some FAT16 drives
• NTFS boot sector template added
• Template definition language extended

v9.5

• Disk cloning functionality noticeably extended
• Finding all clusters allocated to a file or directory (FAT16/FAT32)
• 32-bit Intel Hex supported (instead of only 20-bit)
• Exporting Position Manager list as HTML
• Switching between positions using hotkeys
• Configuration optionally stored in Windows registry (details here)

v9.45

• Spanish user interface, program help, and manual

v9.41

• Several minor enhancements

v9.4

• Copying hex values as C/C++-formatted source code
• Copying reverse hex values for following 32-bit pointers

v9.38

• Search and replace strings extended from 30 to 50 characters at max.
• Search condition: offset mod x = y
• “Copy Into New File” no longer needs the clipboard as a buffer

v9.31

• Physical CHS sector numbering now starts with 1 instead of 0
• Intel-Hex and Motorola-S conversion enhanced

v9.3

• Editing data structures using templates
• ASCII hex values can be imported from the clipboard as binary data

v9.26

• Limited support for EBCDIC
• Main window resizable in the conventional way

v9.25

• Enhanced support for FAT16 and FAT32 drives:
  WinHex displays to which file/directory a cluster/sector is allocated or whether it is unused.

v9.2

• Compressed file backups and drive images (optional, same compression ratio as ZIP)
• Splitting drive images (e.g. into 650 MB volumes for archiving on CD-R)
• Bad-sector-tolerant drive cloning
• Search algorithm's speed increased by another 7.5%
• Lengthy operations may be paused and resumed by pressing the PAUSE key
• Offset display relative to records of a user-defined length
• Minor improvements

v9.12

• Optionally hex display only
• Support for very high screen resolutions improved
• Minor improvements

v9.11

• Disk editor and RAM editor now fully compatible with Windows 2000
• Internal sector caching

v9.05

• Disk Editor grants access beyond the 8 GB barrier on physical disks even under Windows 95 and 98.

v9.04

• Big-endian data supported by the Data Interpreter
• Menu icons
• Oddities with wheel mouse support fixed
• Minor improvements

v9.0

• Toolbar
• Enhanced look for true color mode
• French user interface
• Search from the cursor position forward and backward
• Variable number of hex values per line (better utilization of high screen resolutions)
• Variable hex value groups
• Optionally text display only
• Simple XOR encryption/decryption
• Pages are fully utilized when printing
• Command to invoke external text editor for current file