X-Ways Forensics & WinHex Manual

1 X-Ways Software Technology AG X-Ways Forensics / WinHex Integrated Computer Forensics Environment. Data Recovery & IT Security Tool. Hexadecimal Editor for Files, Disks & RAM. Manual Copyright 1995-2018 Stefan Fleischmann, X-Ways Software Technology AG. All rights reserved. Contents 1 About WinHex and X-Ways License More differences between WinHex & X-Ways Getting Started with X-Ways 2 Technical Using a Hex Integer Data Floating-Point Data Date ANSI ASCII/IBM Checksums, Hashes, Attribute Technical 3 User Start Directory General Virtual Columns and More about the Timestamp Columns.

2 34 Mode Status Data Position Useful Command Line User-Defined Keyboard 4 Menu Directory Browser Context Case Data Window Context Data Window Context File Edit Search Navigation View Tools File Specialist Options Window Help II Windows Context 5 forensic Interpret Image File As Case Management ..79 Multi-User Coordination For Large Evidence Case Case Report Viewer Registry Simultaneous Logical Search Hit Search Term Hit Count in Search Term Event Mount As Drive File Type Hash Time Zone Evidence File Related Items.

3 121 Generator External Analysis 6 Volume Snapshots and their Refinement at the Volume/Sector Run Particularly thorough file system data structure File Header Signature Block-wise Hashing and Refinement at the File Hash Value Computation and File Type Extraction of Internal Archive E-mail Uncovering Embedded Capture Still Images from Pictures Analysis and Detection of More Information about Volume Snapshot Refinement ..145 7 Some Basic Edit X-Tensions III Disk Memory Template 8 Data File Recovery with the Directory File Recovery by Type/File Header Signature File Type Manual Data 9 General Volume Snapshot Viewer Programs & Gallery Undo Security Search Replace 10 Modify Sector Wiping and Disk Images and Dummy Image Hints on Disk Cloning, Imaging.

4 Image Skeleton Backup Recover/Copy Duplicate File Surrogate Reconstructing RAID Systems ..206 Appendix A: Template 1 2 Body: Variable 3 Body: Advanced 4 Body: Flexible Integer Appendix B: Script Appendix C: Master Boot IV 1 Preface About WinHex and X-Ways Forensics Copyright 1995-2018 Stefan Fleischmann, X-Ways Software Technology AG. All rights reserved. X-Ways Software Technology AG Web: Carl-Diem-Str. 32 Order at: B nde User forum: Germany Fax: +49 3212-123 2029 E-mail address: Registered in Bad Oeynhausen (HRB 7475).

5 CEO: Stefan Fleischmann. Board of directors (chairwoman): Dr. M. Horstmeyer. X-Ways Software Technology AG is a stock corporation incorporated under the laws of the Federal Republic of Germany. WinHex was first released in 1995. This Manual was compiled from the online help of WinHex / X-Ways Forensics SR-2, released in September 2018. Supported platforms: Windows XP, Windows 2003 Server, Windows Vista/Server 2008, Windows 7, Windows 8 2012, Windows 10/ Server 2016.

6 32-bit and 64-bit. Standard, PE and FE. Some functionality is also available when run under Linux+Wine. However, some copy protection methods (among them dongles) unfortunately do not work under Linux+Wine at all. User interface translation: Chinese by Sprite Guo. Japanese by Takao Horiuchi and Ichiro Sugiyama (not generally available). French by J r me Broutin, revised by Bernard Lepr tre. Spanish by Jos Mar a Tagarro Mart . Italian by Andrea Ghirardini. Brazilian Portuguese by Heyder Lino Ferreira.

7 Polish by ProCertiv Sp. z (LLC). We would like to thank the state law enforcement agency of Rhineland-Palatinate for extraordinarily numerous and essential suggestions on the development of X-Ways Forensics and X-Ways Investigator. Thanks to Dr. A. Kuiper for his method to process videos with MPlayer. Professional users around the world (this list is from ~14 years ago) and German federal law enforcement agencies, ministries such as the Australian Department of Defence, national institutes ( the Oak Ridge National Laboratory in Tennessee), the Technical University of Vienna, the Technical University of Munich (Institute of Computer Science), the German Aerospace Center, the German federal bureau of aviation accident investigation, Microsoft Corp.

8 , Hewlett Packard, Toshiba Europe, Siemens AG, Siemens Business Services, Siemens VDO AG, Infineon Technologies Flash GmbH & Co. KG, Ontrack Data International Inc., Deloitte & Touche, KPMG forensic , Ernst & Young, Ericsson, National Semiconductor, Lockheed Martin, BAE Systems, TDK Corporation, Seoul Mobile Telecom, Visa International, DePfa Deutsche Pfandbriefbank AG, 1 Analytik Jena AG, and many other companies and scientific institutes. Legalities Copyright 1995-2018 Stefan Fleischmann, X-Ways Software Technology AG.

9 No part of this publication may be reproduced, or stored in a database or retrieval system without the prior permission of the author. Any brand names and trademarks mentioned in the program or in this Manual are properties of their respective holders and are generally protected by laws. FuzZyDoc is a trademark of X-Ways Software Technology AG. This publication is designed to provide accurate and authoritative information in regard to the subject matter covered.

10 However, the author neither offers any warranties or representations nor does he accept any liability with respect to the program or the Manual . License Agreement Acknowledgements The MD5 message digest is copyright by RSA Data Security Inc. The zlib compression library is copyright by Jean-loup Gailly and Mark Adler. Homepage: X-Ways Forensics contains software by Igor Pavlov, , and an Adler32 implementation by Arnaud Bouchez. Outside In Technology Copyright 1991, 2014, Oracle Corp.