WinHex is een van de vele te verkrijgen HEX-editors. Met dit programma is het onder andere mogelijk om te kijken in het geheugen wat door andere programma's wordt gebruikt. Versie 10.6 Beta is de nieuwste versie en kent de volgende veranderingen:
Gather Free Space is now much faster on NTFS drives. A command for listing free clusters can now be found in the Access button menu. Alternate data streams on NTFS drives, which contain hidden data, are now listed in a Drive Contents Table. Under Windows XP, WinHex will now detect surplus sectors on physical disks automatically. On NTFS drives, Initialize Free Space now also wipes currently unused $Mft file records for security reasons, as they may still contain names and fragments from files previously stored in them. An external viewer program (like Quick View Plus etc.) can now be invoked from within WinHex, to view the currently edited file or selected block. The external text editor can be used for editing the block now, if one is selected. Filling disk sectors (e.g. for proper sanitizing/clearing) is now much faster. An easy-to-use DOS disk cloning tool is now included in the specialist license. X-Ways Replica is a simple, separate tool that creates clones of entire disks and disk partitions. It allows you to perform your forensic examination on an exact bit-by-bit copy of the original drive. X-Ways Replica runs solely in plain DOS mode, e.g. on an MS-DOS floppy boot disk. Many Windows environments tend to access a newly attached drive without asking, thereby e.g. altering the last access dates of some files on the original drive. This can be avoided using X-Ways Replica. http://www.winhex.com/replica.html A new API function WHX_SetLastError has been added. Some minor improvements.