Software Update: WinHex 11.6 SR-2

WinHex is a universal hex editor that allows you to apply low-level data processing through an easy interface. Version 11.6 SR-2 has recently been made available by the developers with the following release notes†

what’s new?

• Switching between view mode, default edit mode, and in-place edit mode now has immediate affect on all open edit windows and is generally more straight-forward to use. (since 11.5 SR-4)
• To enforce forensic procedures, WinHex’s sister product X-Ways Forensics can only open those files for editing (eg conversion, decoding, decryption) that have been copied into the current case’s folder. All other files, or disks in general, cannot be modified intentionally or accidentally whatsoever. So for example it is impossible to repair file system data structures with X-Ways Forensics. You need to use WinHex for that. The strict write protection is the only difference between X-Ways Forensics and WinHex operated with a forensic license.
• File Recovery by Type is now easier to use. The recovery can be limited to a certain range of sectors simply by selecting a block prior to using it. (since 11.5 SR-4)
• Files found by File Recovery by Type can now be just listed in the directory browser for inspection, without actually recovering them yet.
• A drive contents table of non-existing files can now even include deleted files in unallocated clusters that are no longer referenced by any file system data structures if they can be recognized by their file header signature.
• The hash values ​​calculated by Create Drive Contents Table can now be matched against a hash database. It is up to you whether files that occur in the hash database will be included in the output or excluded. This allows you to conveniently check if certain known files are present on a hard disk (eg known malware) or to exclude known good files from your examination (eg standard Windows installation files). WinHex recognizes the hash database formats NSRL RDS 2.x, ILook, and HashKeeper. You can use the Create Drive Contents Table command also to create your own hash sets, in the NSRL RDS 2.x format. Available with a forensic license only.
• You can now associate up to 10 drive contents tables with an evidence object.
• The Create * Directory * Contents Table command is now ubiquitously available in the directory browser’s context menu.
• Raw mode for reading Audio CDs and for access to the full 2352-byte sectors on data CDs (CD-ROM and Video CDs), including error correction codes.
• View command for all files in the directory browser (in conjunction with the external viewer defined in General Options, since 11.5 SR-4).
• In gallery view, the selected picture is now highlighted. The gallery view’s scrolling behavior is now more convenient.
• NTFS alternate data streams are now listed individually in a drive contents table, one per line (since 11.5 SR-7). Non-directory index streams are listed, too.
• WinHex can now encode and decode Base64 and UUCode data.
• The Italian user interface of WinHex has been newly translated. Translation by Fabrizio Degni.
• The new script command CalcHash calculates a hash such as CRC32, MD5, SHA-1, and stores it in a variable. There is another new script command InitMFTRecords that clears unused MFT FILE records just like the disk tools menu command.
• An error was fixed that under certain circumstances caused script commands to be applied to an edit window other than the intended one.
• Several minor improvements.
• 11.6 SR-2: Error in hash matching fixed