X-Ways Forensics & WinHex Manual

1 X-Ways Software Technology AG X-Ways Forensics / WinHex integrated Computer Forensics Environment. Data Recovery & IT Security Tool. Hexadecimal Editor for Files, Disks & RAM. Manual Copyright 1995-2021 Stefan Fleischmann, X-Ways Software Technology AG. All rights reserved. Contents 1 About WinHex and X-Ways License More differences between WinHex & X-Ways Getting Started with X-Ways 2 Technical Using a Hex Integer Data Floating-Point Data Date ANSI ASCII/IBM Checksums, Hashes, Attribute Technical 3 User Start Directory General Virtual Columns and More about the Timestamp Columns.

2 31 Mode Status Data Position Useful Command Line User-Defined Keyboard 4 Menu Directory Browser Context Case Data Window Context Data Window Context File Edit Search Navigation View Tools File Specialist Options Window Help Windows Context II 5 Forensic Interpret Image File As Case Management ..79 Multi-User Coordination For Large Evidence Case Log (Activity Log)..88 Case Report Viewer Registry Simultaneous Logical Search Hit Search Term Hit Count in Search Term Event Mount As Drive File Type Hash Time Zone Evidence File Related Items.

3 124 Generator External Analysis 6 Volume Snapshots and their Refinement at the Volume/Sector Run Particularly thorough file system data structure File Header Signature Block-wise Hashing and Refinement at the File Hash Value Computation and File Type Extraction of Internal Archive E-mail Uncovering Embedded Capture Still Images from Pictures Analysis and Detection of More Information about Volume Snapshot Refinement ..150 7 Some Basic Edit X-Tensions Disk Memory III Template 8 Data File Recovery with the Directory File Recovery by Type/File Header Signature File Type Manual Data 9 General Directory Volume Snapshot Viewer Programs & Gallery Undo Security Search Replace 10 Modify Sector Wiping and Disk Images and Dummy Image Hints on Disk Cloning, Imaging.

4 Image Skeleton Backup Recover/Copy Duplicate File Surrogate Reconstructing RAID Systems ..218 Appendix A: Template 1 2 Body: Variable 3 Body: Advanced 4 Body: Flexible Integer Appendix B: Script Appendix C: Master Boot IV 1 Preface About WinHex and X-Ways Forensics Copyright 1995-2021 Stefan Fleischmann, X-Ways Software Technology AG. All rights reserved. X-Ways Software Technology AG Web: 32 Order at: B nde User forum: Germany E-mail address: Registered in Bad Oeynhausen (HRB 7475).

5 CEO: Stefan Fleischmann. Board of directors (chairwoman): Dr. M. Horstmeyer. X-Ways Software Technology AG is a stock corporation incorporated under the laws of the Federal Republic of Germany. WinHex was first released in 1995. This Manual was compiled from the online help of WinHex / X-Ways Forensics and was last updated in M rz 2021. The software can be run on Windows 7, Windows 8 2012, Windows 10/Server 2016; 32-bit and 64-bit; Standard, PE and FE, to different extens. It can potentially also still be run on Windows XP, Windows 2003 Server, Windows Vista/Server 2008.

6 Some functionality is also available when run under Linux+Wine. However, some copy protection methods (among them dongles) unfortunately do not work under Linux+Wine at all. User interface translation: Chinese by Sprite Guo. Japanese by Takao Horiuchi and Ichiro Sugiyama (not generally available). French by J r me Broutin, revised by Bernard Lepr tre. Spanish by Jos Mar a Tagarro Mart . Italian by Andrea Ghirardini. Brazilian Portuguese by Heyder Lino Ferreira. Polish by ProCertiv Sp.

7 Z (LLC). We would like to thank the state law enforcement agency of Rhineland-Palatinate for extraordinarily numerous and essential suggestions on the development of X-Ways Forensics and X-Ways Investigator. Thanks to Dr. A. Kuiper for his method to process videos with MPlayer. Professional users around the world (this list is from ~18 years ago) and German federal law enforcement agencies, ministries such as the Australian Department of Defence, national institutes ( the Oak Ridge National Laboratory in Tennessee), the Technical University of Vienna, the Technical University of Munich (Institute of Computer Science), the German Aerospace Center, the German federal bureau of aviation accident investigation, Microsoft Corp.

8 , Hewlett Packard, Toshiba Europe, Siemens AG, Siemens Business Services, Siemens VDO AG, Infineon Technologies Flash GmbH & Co. KG, Ontrack Data International Inc., Deloitte & Touche, KPMG Forensic, Ernst & Young, Ericsson, National Semiconductor, lockheed Martin, BAE Systems, TDK Corporation, Seoul Mobile Telecom, Visa International, Analytik Jena AG, and many other 1 companies and scientific institutes. Legalities Copyright 1995-2021 Stefan Fleischmann, X-Ways Software Technology AG.

9 No part of this publication may be reproduced, or stored in a database or retrieval system without the prior permission of the author. Any brand names and trademarks mentioned in the program or in this Manual are properties of their respective holders and are generally protected by laws. FuzZyDoc is a trademark of X-Ways Software Technology AG. This publication is designed to provide accurate and authoritative information in regard to the subject matter covered. However, the author neither offers any warranties or representations nor does he accept any liability with respect to the program or the Manual .

10 License Agreement Acknowledgements The MD5 message digest is copyright by RSA Data Security Inc. X-Ways Forensics contains software by Igor Pavlov, , and an Adler32 implementation by Arnaud Bouchez. Outside In Technology Copyright 1991, 2019, Oracle Corp. and/or its affiliates. All rights reserved. NEXT3 is a registered trademark of CTERA Networks. FuzZyDoc is a trademark of X-Ways Software Technology AG. X-Ways Forensics uses ResIL, a fork of DevIL. ResIL is governed by the LGPL ( ), version The source code can be downloaded from X-Ways Forensics contains an unofficial build of libPFF.