X-Ways
·.·. Computerforensik-Software aus Deutschland .·.·
   
 


WinHex & X-Ways Forensics Newsletter-Archiv 2001 (deutsch)

(Sie können den Newsletter hier abonnieren.)

#38: WinHex 10.1 veröffentlicht

7. Dezember 2001

Dieses Rundschreiben soll ein beachtenswertes Update ankündigen, WinHex 10.1.

Was ist neu?

* Sie sind nun Abonnent des *deutschspachigen* Newsletters. You have been moved to the *German* announcement list. If you prefer the English one, please unsubscribe (see below) and re-subscribe at http://www.winhex.com/winhex/index-m.html .

* WinHex erlaubt professionellen Benutzern nun, die brandneue WinHex API (Anwendungsprogrammierschnittstelle) in ihren eigenen C/C++-, Delphi- und Visual-Basic-Programmen zu
verwenden. Diese stellt insbes. ein bequemes und einfaches Interface zum wahlfreien Zugriff auf Dateien und Datenträgersektoren zur Verfügung. Mehr dazu finden Sie unter http://www.winhex.com/winhex/api/ .

* 6 neue Scriptbefehle wurden hinzugefügt. Details unter http://www.winhex.com/cgi-bin/discus/show.cgi?1/151.html .

* WinHex erlaubt nun den *physischen* Zugriff auf CD-ROM und DVD unter Windows NT/2000/XP. Generell ist physischer Zugriff z. B. vorteilhaft, wenn der Bootsektor beschädigt wurde oder das Betriebssystem das Dateisystem nicht kennt.

* Schablonenfenster können nun ausgedruckt werden. Der Befehl zum Drucken wurde in das Systemmenü integriert.

* WinHex kann nun optional Lesefehler bei der Suche ignorieren. Nützlich beim Arbeiten auf physisch beschädigten Datenträgern.

* WinHex erkennt es jetzt, wenn geöffnete Dateien außerhalb des Programm verändert wurden und bietet an, diese neu zu laden.

* Kleine Verbesserungen und Fehlerbehebungen, die bereits in den WinHex 10.0 Service-Releases enthalten waren.

Das Upgrade auf WinHex 10.1 ist kostenlos für alle Benutzer, die WinHex 9.53 oder neuer (z. B. online ab dem 1. August 2000) erworben haben. Wenn Ihre Lizenz Sie dazu nicht mehr qualifiziert, finden Sie Details zum Online-Upgrade unter folgende Adresse: http://www.winhex.com/winhex/upgrade-d.html . Beachten Sie, daß es auch möglich ist, eine private in eine professionelle Lizenz umzuwandeln.

Der Erwerb der aktuellen Version (oder das Upgrade darauf) berechtigt Sie dazu, mind. 15 Monate auf zukünftige Versionen kostenlos upzudaten.

 

#37: WinHex 10.0 SR-2 released

Oct 29, 2001

A service release is available that may be important for
some users:

* With the initial release of WinHex 10.0, write access to physical disks failed with an error message under Windows 95/98/Me. This has been fixed.

* Checking for surplus sectors is now disabled by default because of bad side effects it may have on a few systems.

* Exporting positions as HTML will work again.

 

#36: WinHex 10.0 released

Oct 21, 2001

This mailing is to announce the major update of the year, WinHex 10.0.

What's new?

* Scripting supersedes the Routine feature. Most of the functionality of WinHex can now be used in an automated way, e.g. to speed up repetitive manual work or to perform certain tasks on unattended remote computers. The ability to execute other than the supplied sample scripts is limited to owners of a professional license. Scripts can be run from the Start Center or from the command line.

* WinHex now keeps a history of your offset jumps within an edit window and allows to go back and foward in the chain later.

* When viewing the sectors with the file allocation tables of logical drives (FAT12, FAT16, or FAT32), you will be shown the meaning of each table entry (next cluster in the chain, end marker, etc.).

* WinHex can check for additional sectors at the end of physical disks now also under Windows 9x/Me, and thus possibly access sectors that would have remained undetected otherwise.

* Modified bytes are optionally displayed in a different color.

* WinHex now allows to compare not only files, but also disk sectors, using File Manager | Compare. You may also start a comparison at different offsets within the two files/disks.

* Appropriate menu commands have been moved to the new "View" menu.

For a complete list of changes since WinHex 9.92, please see http://www.winhex.com/winhex/winhex10.html. The user manuals on the web site have been updated as well.

Upgrading to WinHex 10.0 is free for all users who purchased WinHex 9.5 or newer (e.g. online later than July 7th 2000). If you do not qualify any more, you can find details on online upgrading here: http://www.winhex.com/winhex/upgrade.html. Note that it is possible now to upgrade from private to a professional licence.

Purchasing the current version (or upgrading to it) entitles you to upgrade to future versions at no cost for at least 15 months.

 

#35: WinHex 9.97 Beta released

Oct 12, 2001

This mailing is to announce another preliminary version, WinHex 9.97 Beta.

After the beta phase, this version will be released as WinHex 10.0, the major update of the year. For now, WinHex 9.92 SR-5 is still the latest official release.

-------------------------------------------------------------

Changes from WinHex 9.95 Beta to 9.97 Beta:

* A scripting feature has been added. Most of the functionality of WinHex can now be used in an automated way, e.g. to speed up recurring routine tasks or to perform certain tasks on unattended remote computers. Scripts can either be run from the Start Center or from the command line. Except in this beta version, the ability to execute scripts other than the supplied sample scripts will be limited to owners of a professional license.

Please see the accompanying text file of the beta version for a preliminary documentation of currently available script commands. Sample scripts are contained as well.

* WinHex now keeps a history of your offset jumps within a document and allows to go back and foward in the chain later.

* When viewing the sectors with the file allocation tables of logical drives (FAT12, FAT16, or FAT32), you will be shown the meaning of each table entry (next cluster in the chain, end marker, etc.).

* WinHex can check for additional sectors at the end of physical disks now also under Windows 9x/Me, and thus possibly access sectors that would have remained undetected otherwise.

* The project and script lists in the Start Center have a context menu.

* The details panel's context menu was extended for logical drives.

* Makes use of new file selection dialogs in Windows Me, 2000, and XP.

* Compiler upgrade

The WinHex 9.97 Beta page in the WinHex support forum is http://www.winhex.com/cgi-bin/discus/show.cgi?1/136.html .

 

#34: About the next WinHex version

Sep 7, 2001

This mailing is to keep you informed of my plans for what will ultimately be released as WinHex 10.0.

Some of the improvements can be tried already in a preliminary version tentatively labeled WinHex 9.95 Beta. Please see http://www.winhex.com/cgi-bin/discus/show.cgi?1/113.html for details. Most important so far are the ability to display modified bytes in a different color and to compare not only files, but also disk sectors using File Manager | Compare.

Also, I plan the ability to execute scripts for professional users. Most of the functionality of WinHex could then be used in an automated way, e.g. to speed up recurring routine tasks or to perform certain tasks on unattended remote computers.

Please see http://www.winhex.com/cgi-bin/discus/show.cgi?1/115.html for details and please let me know your suggestions and needs regarding such a functionality.

 

#33: WinHex 9.92 released

July 12, 2001

This mailing is to announce a minor update, WinHex 9.92.

What's new?

* Previously, WinHex had a limit of 65,535 files when scanning cluster chains on FAT-formatted drives. This has been overcome. New cluster map files are 24-bit, allowing for up to 16,777,215 files to be recorded.

* WinHex now ignores line break, space, and tab characters when converting from Hex ASCII to Binary.

* Some bug fixes and minor improvements.

Upgrading to WinHex 9.92 is free for all users who purchased WinHex 9.4 or later (e.g. online later than May 1st 2000). If you do not qualify any more, you can find details on online upgrading here: http://www.winhex.com/winhex/upgrade.html

Purchasing the current version (or upgrading to it) entitles you to upgrade to future versions at no cost for at least 12 months.

 

#32: WinHex 9.9 released

June 22, 2001

This mailing is to announce a major update, WinHex 9.9.

What's new?

Several user interface enhancements:

* There is a new concept called the "Start Center", a dialog window that is optionally displayed at startup and that allows to quickly open files, disks, memory modules, and backups as well as recently edited documents.

The Start Center will remember up to 255 documents (15 by default). These may be files, folders, logical drives or physical disks. When opened again, WinHex restores the last cursor position, the scrolling position, and the block (if defined) of each document, unless this option is disabled.

From the Start Center you are also able to access so-called "projects". A project consists of one or more documents to edit (files or disks). It remembers the editing positions, the window sizes and positions and some display options. By saving a window arrangement as a project you can continue to work in several documents right where you left them, or facilitate beginning with a recurring task which involves more than one document.

WinHex will automatically save the window arrangement from the end of your last session as a project, too, and can re-create it at startup.

* Compatibility with Windows XP confirmed. WinHex 9.9 will make use of Windows XP's new visual styles.

* WinHex now offers several alternative 3D button styles for true color mode (optional).

* You can conveniently browse through various records of the same template using Ctrl+Left and Ctrl+Right now.

Additional improvements include:

* A new template header statement ("fixed_start") was introduced that allows for applying a template at a predefined offset within a file or disk rather than at the current cursor position.

* WinHex does not validate filenames in the List File Clusters dialog any more, so you can even type in the names of hidden system files or directories.

* Error in synchronized scrolling fixed.

* Some minor improvements and bug fixes.

Please note that, unfortunately, WinHex cannot re-use your existing configuration from previous versions this time.

 

#31: WinHex 9.86 released

May 30, 2001

This mailing is to announce a noteworthy update, WinHex 9.86.

The WinHex web site is hosted in the USA since last week.

What's new?

Several security enhancements:

* There is now a dedicated menu command for securely deleting unused clusters on a logical drive: Tools | Disk Tools | Initialize Free Space.

* Editing and initializing free space will work with more than 4 GB free on FAT32 drives.

* When irreversibly deleting (=wiping) files or initializing free space, you can now choose between overwriting with zero bytes, with any hex value pattern or with random data.

* You can also have WinHex write the same new bytes more than once, for maximum security.

* When irreversibly deleting a file, its name will be completely erased also on FAT drives (full version only). Note that there may still remain old orphan long filename entries on FAT drives if the file had previously been renamed. (ScanDisk offers an option to get rid of orphan entries).

Additional improvements include:

* WinHex now supports a dedicated Java date & time type in the Data Interpreter and in templates ("JavaDateTime"). It is always treated as big endian data. You can have WinHex translate it from GMT to any time zone.

* The file recovery function has a new option that makes WinHex ignore read errors. You will not have to dismiss any messages boxes. Useful for recovering from physically damaged disks.

* If a read error occurs when reading from a disk in any situation where error messages are not suppressed, WinHex will now tell the exact sector number where the error occurred.

* You can now select lines as the current block by clicking between the offset column and the left vertical line. The mouse cursor will change its direction in this area, as known from common text editors and word processing software.

Upgrading to WinHex 9.86 is free for all users who purchased WinHex 9.3 or later (e.g. online later than March 24th 2000). If you do not qualify any more, you can find details on online upgrading here: http://www.winhex.com/winhex/upgrade.html.

Purchasing the current version (or upgrading to it) entitles you to upgrade to future versions at no cost for at least 12 months.

 

#30: WinHex 9.82 released

May 1, 2001

This mailing is to announce a minor update, WinHex 9.82.

What's new?

* WinHex now lists all primary partitions and logical drives in the shortcut button menu when editing a physical disk.

* There are new items in this menu that allow you to create backups of partitions of that physical disk conveniently with two mouse clicks only.

* Copying from the virtual memory of a running process into a file using "Copy Block Into New File" did not work correctly before. This has been fixed.

* Some minor additions to the program and its help/manual.

 

#29: WinHex 9.8 released

Apr 16, 2001

This mailing is to announce a major update, WinHex 9.8.

What's new?

* WinHex 9.8 finally has full FAT12 support. When opening a logical drive with the disk editor, you will be able to use the menu commands "List File Clusters", "List Directory Clusters", and "Scan Cluster Chains Again". You can also see for each sector which file it is allocated to.

* Cluster listings for a file or directory are now always shown in correct logical order instead of sorted by cluster number.

* Floppy drives will now be present in the Disk Editor as logical drives under Windows 2000, too.

* When editing logical drives or physical disks, there is now a shortcut button for quick access to important disk positions: partition start sectors, boot sectors, FATs, root directories, next cluster in the cluster chain, logical and physical surplus sectors, MFT, and more.

* Physical hard disks will now be checked also under Windows NT/2000 for unused surplus sectors that exceed the C/H/S geometry.

* The Master Boot Record template will now display sector and cylinder numbers correctly as decimal numbers. This has become possible because of a new template data type that allows to compose an integer from arbitrary bits in any order within a 32-bit range.

* The big endian setting now effects Unicode characters and Unicode strings.

* Double-spaced printing provides for more room for hand-written comments on the paper in between the lines. This is a new option in the Print dialog.

* The contents of the Data Analysis window can be printed from the system menu of that window.

* Press Alt+G in templates to close the template and move the cursor in the edit window to the template's last position.

* Several minor improvements and fixes.

Upgrading to WinHex 9.8 is free for all users who purchased WinHex 9.2 or later (e.g. online later than March 4th 2000). If you do not qualify any more, you can find details on online upgrading here: http://www.winhex.com/winhex/upgrade.html. When upgrading, you will need to know what version you
actually paid for. If you have a recent version of WinHex, this information is displayed in the About box of the software. Otherwise please ask.

Purchasing the current version (or upgrading to it) entitles you to upgrade to future versions at no cost for at least 12 months.

 

#28: WinHex 9.75 released

Apr 4, 2001

This mailing is to announce a minor update, WinHex 9.75.

What's new?

The concept of relative record offsets in the status bar has been extended. For all of the following, please see the new menu item "Record Presentation" in the Position menu.

* Previously, record counting always began at offset 0. Now you can specify any offset.

* When editing subsequent data records of the same size, you may now have WinHex display every other record with a different background color, as a kind of visual aid. The color can be selected in the General Options dialog.

* In addition, the Go To Offset command now supports moving the current position in units of the specified record size.

 

#27: WinHex 9.74 released

Mar 14, 2001

This mailing is to announce a minor update, WinHex 9.74.

What's new?

* Routines are now capable of common search operations. This can prove useful e.g. to concatenate different search operations and have WinHex record found occurrences in the Position Manager, without further user interaction.

* A graphic error, that could occur in rare circumstances under Windows 9x, has been corrected.

 

#26: WinHex 9.73 released

Mar 2, 2001

This mailing is to announce a minor update, WinHex 9.73.

What's new?

* WinHex now supports the 128-bit MD5 message digest in backups to ensure data authenticity, in addition to the 256-bit PSCHF hash. The MD5 is very safe as well, but can be calculated much faster.

* Causes for some rarely occurring errors have been removed. This concerns for instance the display at high screen resolutions (1800x1440 and above) and the use of the "Copy as Editor Display" command at more than 16 columns.

Upgrading to WinHex 9.73 is free for all users who purchased WinHex 9.1 or later (e.g. online later than February 7th 2000). If you do not qualify any more, you can find details on online upgrading here: http://www.winhex.com/winhex/upgrade.html. You will need to know what version you actually paid for. If
you do not know any more, please ask.

Purchasing the current version (or upgrading to it) entitles you to upgrade to future versions at no cost for at least 12 months.

 

#25: WinHex 9.72 released

Feb 4, 2001

This mailing is to announce a minor update, WinHex 9.72.

What's new?

* In addition to a command to search for the clusters allocated to a given file on a FAT16, FAT32, or NTFS drive, there is now an equivalent for directories. (Tools | Disk Accessories | List Directory Clusters)

* You can now override the detected number of clusters on a logical drive. This can be useful to fully access a huge DVD that is only detected as 2 GB under Windows 9x. (Tools | Disk Accessories | Set Disk Parameters)

* When restoring a file from a backup, you are now prompted for how to save the file, similar to the restoration of disk sectors.

* WinHex 9.72 incorporates the common MD5 message digest algorithm. You will be able to calculate the MD5 for any file, disk, or currently selected block.

* Some minor improvements and bug fixes

-------------------------------------------------------------

(FAQ) "What is the recommended procedure to update an existing WinHex installation?"

- No need to uninstall first.
- Install the update into the same folder as before, using the setup program.

 

#24: WinHex 9.7 released

Jan 24, 2001

This mailing is to announce a major update, WinHex 9.7.

What's new?

* Enhanced support for NTFS drives. WinHex now shows which file is allocated to the currently displayed cluster, and it can list all the clusters associated with a given file.

* WinHex has been translated into (Brazilian) Portuguese. That means WinHex is now available in 7 languages.

* A file recovery function (based on file headers and footers) can now be found in the Tools | Disk Accessories menu. You can apply it to logical drives, physical disks, and drive image files.

* WinHex now supports synchronized scrolling in up to 4 windows.

* Synchronized scrolling with the visual display of byte value differences is available for 2 windows.

* The inspection of FAT cluster chains has been sped up under Windows NT/2000.

* Keyboard navigation within templates is more convenient now.

* As a first step to make the details panel more interactive, the panel now provides buttons to access boot sector and MBR templates.

* WinHex now allows decimal offsets up to 99,999,999,999 (approx. 100 GB).

* Some minor improvements and bug fixes.

Upgrading to WinHex 9.7 is free for all users who purchased WinHex 8.9 or later (e.g. online later than January 17th 2000). If you do not qualify any more, you can find details on online upgrading here: http://www.winhex.com/winhex/upgrade.html. You will need to know what version you actually paid for. If
you do not know any more, please ask.

Purchasing the current version (or upgrading to it) entitles you to upgrade to future versions at no cost for at least 12 months.

-------------------------------------------------------------

More announcements:

Visit http://www.winhex.net, the new online forum. Your comments, questions, suggestions, and requests for support are welcome there, if you think they might be of general interest. Among many other topics, I've added instructions on how to recover deleted files using WinHex.

I have also added a page (http://www.winhex.com/winhex/analysis.html) that demonstrates the data analysis feature in WinHex. The underlying assumption is that graphical diagrams of the byte value distribution can
help to recognize the type of unknown data. This can prove useful e.g. when examining hard disk sectors or recovered files without a meaningful name (as generated by ScanDisk and similar programs).

The results of the (ongoing) online survey can be found here: http://www.winhex.com/cgi-bin/discus/show.cgi?1/19.html

 

#23: WinHex Online Forum

Jan 6, 2001

I would like to invite you to visit the new online forum. It is meant as a place where to ask questions, exchange ideas, and get to know other WinHex users. For the moment, the following topics have been created:

- announcements (current official announcements)
- hex editing (general use of WinHex as hexadecimal file editor)
- disk editing (examining and editing disk sectors, file systems, ...)
- advanced features of WinHex (data interpreter, templates, encryption, ...)
- special application (hard drive cleansing, cheating in PC games, ...)

http://www.winhex.com/winhex/forum/

Thanks in advance for dropping by some time!

 

#22: WinHex 9.64 released

Jan 3, 2001

And thanks to everyone who already participated in the survey at http://www.winhex.com/cgi-bin/poll.cgi?start (still active)!

This mailing is to announce a minor update, WinHex 9.64.

What's new?

* Previously, WinHex used an incorrect CHS (cylinders, heads, sectors) numbering scheme on some systems running Windows 95/98/Me when editing large physical hard disks. This problem is solved now.

* Under Windows 95/98/Me, WinHex will display the number of "surplus" sectors at the end of a disk which exceed the regular CHS numbering.

* You can now override the disk parameters with any CHS scheme you like. Under Windows NT/2000, this is currently the only way to access surplus sectors.

What's planned for WinHex 9.7?

* Enhanced support for the NTFS file system. WinHex will be able to tell which file resides on a given sector, and what sectors are used by a given file.


> Archive of the year 2000 <