» X-Ways WinHex

Можно ли WinHEX'ом открыть сам жесткий диск ( ну вроде hexedit /dev/hda)

Не очень понял, что значит

Цитата:

открыть сам жесткий диск

Просто открыть диск можно: Tools -> Open Disk...
Далее выбор: логический или физический диск.

WinHex 12.05
http://www.x-ways.de/winhex.zip

У всех глюк с русскими названиями файлов?
Побороть можно?

Или это от системы зависит?

шапка поднята для оформления.

WinHex 12.05 SR-3
http://www.x-ways.de/winhex.zip

Русская версия WinHex 12.05 SR-6
_http://samlab.ru/soft/winhex_12.05_registered_russian.cab

WinHex 12.05 SR-6
http://www.x-ways.de/winhex.zip
http://www.winhex.com/winhex.zip
http://www.muenster.de/~sf/winhex.zip

WinHex 12.05 SR-14
_http://www.x-ways.de/winhex.zip
_http://www.winhex.com/winhex.zip
_http://www.muenster.de/~sf/winhex.zip

WinHex 12.1

Цитата:

Latest Changes:
- Add-on viewer component available
- Powerful internal hash database (forensic license only)
- Support for Windows dynamic volumes (simple, spanned, striped)
- Evidence files created are now compatible with industry standard
- Quick compression option for evidence files
- Create Disk Image feature deals more gracefully with bad sectors
- Various improvements to the directory browser
- New script commands: StrCat, GetUserInput, GetUserInputI, Terminate
- Various other improvements and some bug fixes

http://www.x-ways.net/winhex.zip

WinHex 12.1 SR-X
_http://www.x-ways.de/winhex.zip
_http://www.x-ways.net/winhex.zip
_http://www.winhex.com/winhex.zip

WinHex 12.15

Цитата:

What's New in This Release:
· The RAM viewer/RAM editor so far was able to load the virtual memory of active processes. In addition to that, it is now possible to view/edit _physical_ RAM (under Windows 2000 and XP).
· Physical access to floppy disks under Windows 2000/XP is now 20% faster than before. Physical access to DVDs under Windows 2000/XP can now read protected sectors.
· Logical search operations can now optionally extract and decode the text contained in Adobe PDF documents, Corel WordPerfect (WPD), Corel Draw (CDR), and Microsoft Visio (VSD) files and search the plaintext automatically. Potential search hits in such files would otherwise be missed because these file types typically store text in an encoded, encrypted or
· otherwise garbled way. This feature requires the separate viewer component to be active for the decoding and text extraction part. ( http://www.x-ways.net/forensics/viewer.html ) Listings of search hits now usually allow you to open the corresponding file that contains the hit and (in the case of logically found search hit) automatically jump to the seach hit position. This is particularly useful for compressed files or files with search hits in decoded raw text only, where no physical disk offsets corresponds to the search hits and could be shown. Both physical and relative (=logical) offsets are now displayed for logical search hits, if available, in separate columns.
· If many thousand search hits or bookmarks were listed and highlighting was enabled, the display previously became rather slow. This problem was solved now.
· Logical searches in directories now include the directory data itself, i.e. directory entries in FAT and INDX records in NTFS will be searched as well.
· Filesystem areas such as the file allocation table, Ext2/Ext3 inodes or the internal Reiser tree can now be logically searched in a convenient way via a new fictitious item named "Filesystem areas" in the directory browser, similar to "Free Space".
· When importing folders with hash set files, it is now possible to import these files into a single hash set in the internal database, that is unify them under one name.
· Importing folders with many hash set files into the internal hash database is now considerably faster. The same holds true for deleting hash sets from a very large internal database.
· Access to data in raw image files (since v12.1 SR-4) and evidence files has generally become somewhat faster. When loading very large files with the separate viewer takes too much time, you can now abort the process in a convenient way.
· Right-clicking a file in the directory browser (to bring up the context menu) no longer triggers the preview to refresh and possibly delay the context menu.
· There is now a legend that explains icons, colors, and attributes listed in the directory browser. (forensic licenses only, since v12.1 SR-2)
· There is now an optional column "File Type Category" in the directory browser. (forensic licenses only, since v12.1 SR-3)
· ATA password protection can now be detected on hard disks under Windows 2000 and XP by creating a Media Details Report (since v12.1 SR-4). If detected, the protection level is reported and whether or not the master password has been changed from factory default.
· Previous versions of X-Ways Forensics and WinHex allowed the user to enter a segment size for evidence files of up to 2047 MB. Under special circumstances a set of evidence files apparently could have become corrupt if this limit was fully or nearly utilized. This error can be easily detected because it results in the immediate error message "Incomplete image" when opening the image. Such corrupted images have to be reacquired. The new limit is 2025 MB and such corruption would now be detected when writing already.
· In previous versions, initializing slack space on NTFS volumes potentially corrupted EFS-encrypted files. This was fixed.
· Many other minor improvements.

http://www.winhex.com/winhex.zip

WinHex 12.15 SR-4
_http://www.x-ways.de/winhex.zip
_http://www.x-ways.net/winhex.zip
_http://www.winhex.com/winhex.zip

WinHex 12.15 SR-5
http://www.winhex.com/winhex.zip

Nick 2003
Хоть бы проверял что пишешь и не верил всем новостным сайтам или хотя бы здравый смысл имей после 4 сразу 14??? Реально вот что:

WinHex 12.15 SR-5
_http://www.x-ways.de/winhex.zip
_http://www.x-ways.net/winhex.zip
_http://www.winhex.com/winhex.zip

WinHex 12.15 SR-10
_http://www.x-ways.de/winhex.zip
_http://www.x-ways.net/winhex.zip
_http://www.winhex.com/winhex.zip

WinHex 12.2
[more=Changes]
Цитата:

Changes:
· It is now possible to add files to newly created report contents tables that can be included in the report under unique names. This enables you to manage a large number of notable files in a more systematic way than in just a single generic table for noteworthy files. For example, you could gather relevant Internet Explorer favorite files in one table and revealing pictures in another. Use an evidence object's context menu to create a blank report contents table. (forensic license only)
· It is now possible to conveniently copy contents tables with the case data window's context menu. By working on copies you ensure that you don't lose original file listings when you remove irrelevant files in order to narrow down the list to possibly relevant files.
· In addition to simple, spanned, and striped volumes, WinHex now supports logical RAID 5 volumes on Windows 2000 dynamic disks. (specialist and forensic licenses only)
· WinHex can now internally destripe RAID 0 systems (physical hard disks or images) with up to 5 components and supports different RAID header sizes per component. This renders the use of a script that unstripes and exports RAID systems to a new image obsolete, and it saves time
· and drive space. First open the components, then try the Specialist | Assemble RAID System menu command. (specialist and forensic licenses only) The RAID configuration and the partitions defined in the RAID system can be saved as evidence objects, which allows to access them instantly in later sessions. (forensic licenses only)
· When you find the start sector of a volume (e.g. lost partition) on a physical disk, WinHex can now make such a partition easily accessible via the Access button menu when you use the new menu command Tools | Disk Tools | Interpret As Partition Start.
· Previously, files with a known extension, but an unknown (not matching) file signature, were flagged in the contents table file only, with the word "unknown" in the Mismatch column, visible e.g. when opening in MS Excel. Such files are now flagged in the directory browser as well when a
· contents table with mismatch detection is loaded, with "(sign. unknown)" in the sortable Attr. column. (since v12.15 SR-6)
· .jpg, .gif, .png, etc. files that cannot be displayed as pictures because they are corrupt or have an incorrect extension now appear with an ASCII representation in the preview area instead of with the notice "This picture cannot be displayed.".
· In addition to _exploring_ directories with the directory browser, it is now possible to _open_ their data structures in a separate data window, i.e. directory entries in FAT and INDX records in NTFS. (see directory browser context menu, since v12.15 SR-4)
· A special file ".badblocks" is now displayed in the root directory of Ext2/Ext3 file systems. This file contains the bad blocks that the file system is aware of.
· On Ext2/Ext3, WinHex can now optionally list deleted files of which nothing is known but the name (no data, size, or dates).
· The evidence object's folder being the default output target for recovered files is now optional. (see case properties, since v12.15 SR-6)
· There is a new case option that allows to automatically add all partitions to a case as well when a physical disk is added.
· A new script command - StrToInt - converts ASCII integer numbers in ASCII into integer numbers encoded in binary. The new Release command decommits the memory associated with a variable and destroy the variable.
· Depending on the chosen parameters, the search functions in v12.15 SR-2 through SR-9 aborted prematurely. This was fixed.
· Cloning disks with bad sectors with both simultaneous I/O and log file creation activated caused WinHex to crash. This was fixed.
· Various other minor improvements and bug fixes.

[/more]
http://www.winhex.com/winhex.zip

WinHex 12.2 SR-10
_http://www.x-ways.de/winhex.zip
_http://www.x-ways.net/winhex.zip
_http://www.winhex.com/winhex.zip

WinHex 12.25 SR-3
_http://www.x-ways.de/winhex.zip
_http://www.x-ways.net/winhex.zip
_http://www.winhex.com/winhex.zip

WinHex 12.3
_http://www.x-ways.de/winhex.zip
_http://www.x-ways.net/winhex.zip
_http://www.winhex.com/winhex.zip

как можно сравнить два файла в hex, чтобы было видно параллельно соответствующие ячейки?

XARMAN KAZE
В WinHex такой функциональности не встречал.
Из сторонних программ, например, Total Commander это умеет делать - есть там режим сравнения файлов в HEX-режиме. Отображаются в две колонки, различия подсвечиваются.

указанная в шапке версия на поверку оказалась старенькой 12.05
к тому же без указаний по регистрации
Обманывать не хорошо

WinHex 12.3 SR-1
_http://www.x-ways.de/winhex.zip
_http://www.x-ways.net/winhex.zip
_http://www.winhex.com/winhex.zip
_http://www.muenster.de/~sf/winhex.zip

Ну что за люди!
Пока не поскандалишь - ничего не получишь!
(homosoveticus - называются)

WinHex 12.3 SR-2
http://www.winhex.com/winhex.zip

WinHex 12.3 SR-3
http://www.winhex.com/winhex.zip

WinHex 12.5 SR-3
_http://www.x-ways.de/winhex.zip
_http://www.x-ways.net/winhex.zip
_http://www.winhex.com/winhex.zip
_http://www.muenster.de/Esf/winhex.zip
_http://www.muenster.de/~sf/winhex.zip

WinHex 12.5 SR-3
http://www.winhex.com/winhex.zip

2 Nick 2003

Что это вы батенька повторяетесь?