WinHex is niet alleen een universele hex-editor, maar is ook in staat om low-level dataprocessing toe te passen via een makkelijke interface. Het programma beschikt onder andere over een RAM-editor, een Data Interpreter en een Disk-editor, en kan dus worden gebruikt om verwijderde informatie terug te halen en om bestanden te inspecteren. Versie 12.65 is sinds kort beschikbaar met de volgende veranderingen:
What's new in version 12.65:
- We now offer forensic licenses optionally without update maintenance (at reduced cost) or including 2 years instead of 1 year default update maintenance (surcharge).
- Ability to add a comment to an item in the directory browser. After entering comments, you can conveniently set the filter such that only commented items are shown or only items with specific comments, i.e. certain keywords. For items in a report table, comments are also included in the report if the table is output in the flat format. (forensic licenses only)
- Ability to export selected hash sets from the internal hash database, to share them with other users without exchanging the entire hash database.
- Ability to hide a directory recursively, so that all its files and subdirectories are automatically hidden as well. If you are only allowed to examine the contents of certain directories, you could initially hide all files in all other directories such that they will be automatically excluded from the directory browser, the gallery view, logical searches, copying actions, additions to an evidence file container, etc.
- New visual concept for "tagging" items. Ability to select all listed tagged items. (forensic license only)
- Ability to tag directories recursively, i.e. including their files and subdirectories. Ability to hide all untagged items on a volume. (Remember that you can make use of the dynamic filter to conveniently tag oder hide certain files.)
- The directory browser context menu was restructured.
- Ability to limit the operations in Refine Volume Snapshot to all tagged files or to all files that are not hidden.
- It is now possible to add selected files from within archives to evidence file containers. Prerequisite: The volume snapshot has been refined and includes the contents of archives.
- New script commands: GetClusterAllocEx, GetClusterSize
- Several other minor improvements. For example, during the creation of hash sets, the name of the currently hashed file is displayed in the caption of the small progress indicator window, and the core file in the internal hash database is locked while in use to prevent the user from inadvertently moving or replacing the hash database's directory while X-Ways Forensics is running.