File format v2.1. Supported by WinHex 12.05 and later. POS files are
used to store selected file or disk offsets along with a textual description. Look here for file format v2.0, which can still be read by
WinHex.
| Offset (0X) | Type | Description |
|---|---|---|
| 0 | char[16] | File signature. ASCII characters “WinHex Pos v2.1” + 0X00 |
| 10 | 32-bit integer | Flags. Currently all zero. Flag 0X01: All descriptions in Unicode instead of ASCII characters. |
| 14 | 32-bit integer | Specifies the number of position chunks stored in the POS file. |
| 18 | PositionChunk[] | Position chunks of variable size, each containing one position offset and description. |
The following section is optional and for internal purposes only. It may occur repeatedly. Extension of WinHex 9.3 and later. |
||
| n/a | 16-bit integer | Designates the length of the following string in ASCII characters. |
| n/a | char[] | Contains a string. Not null-terminated. |
Position chunk format:
| Type | Element | Description |
|---|---|---|
| 16-bit integer | Size | Size of this chunk in bytes. |
| 16-bit field | Flags | 0x0001 = Position is a search hit. 0x0002 = volatile/temporary (NTFS MFT auto-coloring) 0x0004 = volatile/temporary (new search hit highlighting) 0x0080 = Position is selected. 0x0100 = Extended chunk needed/available/saved. 0x0200 = Relative offset in extended chunk corresponds to raw text extract of the file (viewer component needed). 0x0400 = Descr is the path and name of a deleted file. 0x0800 = Descr is the path and name of a file whose slack contains the search hit. 0x1000 = Logical search hit that is located in a file that is part an archive. |
| 64-bit integer | Offset | Specifies the start offset of the position itself, i. e. the offset within a file or a disk. In case of disk partitions with a file system: absolute offset. |
| 64-bit integer | Size | Specifies the length of the position in bytes. |
| FILETIME | Time | Specifies the time this position was entered. 64-bit Win32 FILETIME format. |
| byte[3] | RGB | Color highlighting for this position. (0,0,0) designates the default color. |
| byte | Padding | Reserved. |
| 16-bit integer | DescrLen | Designates the length of Descr in ASCII characters. In the current implementation of WinHex, 8192 at max. May be zero if no description is provided. |
| char[DescrLen] | Descr | Contains the position description in ASCII. Usually the name and path of the file where the search hit is located in. Null-terminated. |
| 64-bit integer | Relative Offset | Optional. In extended chunks only. In case of disk partitions with a file system: relative offset in a file. |
| 64-bit integer | FileID | Optional. In extended chunks only. In case of disk partitions with a file system: file identifier |
| 16-bit integer | PathLen | Optional. In extended chunks only. Designates the length of the filename path in ASCII characters. |
| char[DescrLen] | Path | Optional. In extended chunks only. Contains a filename including the position description path n ASCII. Null-terminated. |
THE INFORMATION PROVIDED ON THIS PAGE IS PROVIDED “AS IS” WITHOUT WARRANTY OF
ANY KIND.