WinHex 12.9
[more=Changes]
Цитата:
[more=Changes]
Цитата:
Changes:[/more]
- The directory browser is now directly based on volume snapshots
- There is now a fictitious file "Idle space" in each newly created volume snapshot
- Additional fictitious files for Ext2/Ext3, ReiserFS, NTFS, FAT, and HFS+ in newly created volume snapshots
- The contents of archives that are explored in the directory browser manually (e.g. double-clicked) are now incorporated into the volume snapshot right away, as known from Refine Volume Snapshot
- New optional directory browser columns reveal the owner and the hard link count of files and directories on NTFS/Ext2/Ext3/ReiserFS/Reiser4/HFS+/UFS volumes
- Support for advanced UDF features such as resident files and directories, variably positioned file set descriptors, and sparing tables on sparable partitions
- Improvements in UFS support
- A dynamic file size filter and a filter for some special values in the Attribute column have been introduced
- Logging user activity separately for each evidence object becomes optional and is even disabled by default in a fresh installation
- "File Type Categories.txt" now supports full filenames in addition to filename extensions
- The "File Type Signature.txt" database was updated
- The text column now supports 16-bit Unicode characters (little-endian UTF-16), e.g. Chinese, Cyrillic
- There is now a bigger internal buffer for archives (.zip, .rar, ...), which can speed up access to compressed files
- The skin tone detection feature now serves a second purpose: It now also reveals pictures that are black & white or grayscale pictures
- Since TIFF files may contain multiple pages, they are now displayed by the separate viewer component instead of by the internal picture viewer, even if the viewer component is not generally activated for pictures
- As an alternative and easier to discover way for new users to bring up a recursive view of a directory, there is now an additional button next to "Sync"
- File | Create Disk Image is now potentially faster, depending on the system and various outer circumstances
- A faster implementation of the hash algorithms MD5, SHA-1 and SHA-256 is now available to owners of professional licenses or higher
- Compression/decompression algorithm for evidence files updated from zlib 1.2.1 to 1.2.3
- Optionally, files on the logical drive letters A: through Z: can now be opened with the help of the operating system instead of with the built-in logic at the sector level
- The folder for temporary files used by the separate viewer component is now controlled by WinHex/X-Ways Forensics, i.e. set to the one the user specifies in General Options
- In report tables created by v12.9, duplications can no longer occur, i.e. the same file is never (e.g. accidentally) added twice to the same report table
- Support for unified contents/report tables and for the category view of tables was dropped
- The disk selection dialog window already reveals on which physical disks the volumes mounted as drive letters C: through Z: reside
- The Sync mechanism was reworked internally
- The gallery is better synchronized with the directory browser
- Special treatment for $BadClus:$Bad in NTFS, so that this particular system data stream can be efficiently viewed and searched
- When cloning over a partition that is mounted as a drive letter or when restoring an image over it, X-Ways Forensics now tries to disable Windows' internal buffers, so that the new contents of the target partition are visible everywhere in the system imme
- Ability to undo/reset the signature check for all items in a volume snapshot, by removing the "Already done" checkmark
- The ability to delete the case log was removed in X-Ways Forensics (but not from WinHex)
- Calendar mode: Color markers were swapped in v12.85
- Error fixed that prevented files in "Path unknown" from being copied to evidence file containers in v12.85
- Error fixed that caused physical RAM beyond 256 MB to be read from wrong memory addresses
- Several other minor improvements and fixes