X-Ways Software Technology heeft WinHex voorzien van een update naar versie 14.5. WinHex is niet alleen een universele hexeditor, maar is ook in staat om low-level dataprocessing toe te passen via een makkelijke interface. Het programma beschikt onder andere over een ram-editor, een Data Interpreter en een Disk-editor, en kan bijvoorbeeld worden gebruikt om verwijderde informatie terug te halen en om bestanden te inspecteren. WinHex werkt op alle Windows-versies vanaf 98 met uitzondering van NT, maar het complete arsenaal aan mogelijkheden kan alleen volledig worden benut op Windows 2000, XP en 2003 Server. Het changelog van deze release laat de volgende veranderingen en verbeteringen zien:
What's new?[break]
- It is now possible to assemble RAID systems that consist of up to 16 instead of 10 component disks.
- One additional RAID 5 pattern is now supported: Forward Dynamic Parity, a.k.a. Right Synchronous, one of the four algorithms used in software RAIDs under Linux. The other three Linux algorithms are supported by X-Ways Forensics already.
- Ability to specify a non-standard parity start component disk. E.g. Intel SRCU42L RAID controllers use a disk other than No. 1 for their forward parity pattern.
- Reading from multi-session CDs and DVDs has become considerably faster because WinHex and X-Ways Forensics now skip blank sectors. The difference will be noticeable e.g. when imaging, hashing, and searching such media.
- More information on optical media in the technical details report.
- The process of listing the clusters allocated to huge files can now be greatly accelerated by omitting the clusters in the middle of a series of contiguous clusters from the list. Each omission is indicated by a special line in square brackets, where the number of omitted clusters is specified. That the number of the last cluster in a fragment is listed makes it easy to navigate to the end of each fragment. This new option can be found in the context menu of a cluster list and takes effect on the next cluster list that is brought up.
- In the case report, report table cells can now optionally have borders and padding. The font size used in report tables and in the log is now user-definable, which is useful to save space/paper if you render the font size smaller (e.g. 10 points instead of the default of 12). More changes are planned for the case report, recommendations welcome.
- An evidence file container can now optionally store the name of its creator. The internal designation of a container can now contain up to 63 characters instead of 31. A container now internally records its creation date and time as well as its last modification date and time.
- Better tailored metadata for inclusion in comments. Metadata for Windows Write files (.wri).
- If physical "superfloppy" media (unpartitioned, consisting of just a single volume) are imaged as .e01 evidence files, these files will now be marked as evidence files of logical volumes instead of physical disks. This avoids the unnecessary inclusion of an additional physical evidence object when adding such an evidence file to a case.
- Fixed an error that could prevent complete index optimization if that process had been aborted before.
- Metadata in .mdi files (MS Office document imaging) can now be seen in Details mode.
- Even more metadata from MS Word documents in Details mode.
- Fixed instability issue with long paths.
- It's now possible to remove physical evidence objects from the case that have child objects (partitions) without having to remove the child object first.
- A "Save As" command was introduced for cases, which allows to save the case with a new internal case filename and/or in a different directory. When using this command, the entire case subdirectory will be copied, too. Available also for a case that was opened as read-only if that happened voluntarily and not because of password protection.
- When working with a case opened in read-only mode, the user is now reminded of that whenever the auto-save interval elapses and when an evidence object whose volume snapshot has changed is about to be closed. Useful when working in read-only mode inadvertently, e.g. after having decided to open a case that was not properly closed in read-only mode, without actually understanding the consequences.
- When including report tables in the report, comments on files are no longer truncated.
- The lower word length limit in indexing has been decreased from 3 to 2 to allow for 2-character searches in Chinese if required by the user in certain cases (e.g. for names).
- Some minor improvements.
:fill(white):strip_exif()/i/2000568959.jpeg?f=thumbmedium)
:strip_exif()/u/30814/newgot.gif?f=community){kind=small}