WinHex FAQ
(frequently asked questions)

Labelled here (German). The resizable rectangular area that appears when you open a file or disk is called a data window hereafter. Data windows are managed by the MDI interface that is common to many standard Windows programs.

1. Menu commands that help to manage the current case can be found in Case Data window's File menu and in the context menu that opens when you right-click the name of the case in the Case Data window.

2. Menu commands related to an evidence object can be found in the context menu that opens when you right-click the name of the evidence object in the Case Data window.

3. Menu commands that affect an entire search hit list or bookmark list or contents table can be found in their respective context menus in the Case Data window.

4. Menu commands that affect individual items displayed in the directory browser or in a search hit or bookmark list can be found in the context menu that opens when you right-click such items. You won't find such commands in the main menu.

5. Menu commands that either affect the binary data in a data window or the data window as such (and these are a lot), or that affect files or disks that are still to be specified (e.g. for opening, cloning, concatenating, ...), can be found in the main menu.

6. Menu commands specifically needed for computer forensics or IT security purposes can be found in the Tools and Specialist sections of the main menu. The commands in the Specialist section are only available with a specialist or forensic license.

To open PDF files, please use Adobe Acrobat Reader or GSView.

WinHex itself theoretically supports file sizes up to several thousand GB (no typo). Practically, file sizes are limited by the file system:

• FAT16: 2 GB
• FAT32: 4 GB

• NTFS: virtually unlimited (several TB?)

Please note that removing/deleting or pasting/inserting bytes within such a large file may require the creation of a huge temporary file of almost the same size.

Up to about 1000 GB (WinHex 10.82 and before) or 2000 GB (WinHex 10.9 and later).

Right-click the folder instead of each file individually and select Recover/Copy. Please note that the ".." folder represents the parent folder, not the folder itself. To recover the folder, go to the parent folder and right-click the folder there.

Other users who encountered this problem solved it like this:

“For nVidia users, in the Control Panel should be 'NVIDIA nView Desktop Manager'. Open it and uncheck the 'Enable nView Desktop Manager' and hit Apply and OK. Now, open the WinHEX and if you need, you can reverse the step above and check the 'Enable nView Desktop Manager'. Now you should have RAMedit and nView Desktop Manager active at the same time if you desire so. It seems that for RAMedit to work you need to disable the 'Enable nView Desktop Manager' when you open the winHEX.”

“My solution is: Remove all nVidia enhancements from windows(desktop explorer, etc). Now RAM editor works fine.”

“It was the Nvidia drivers, in particualar, I was getting other error messages from other programs pointing to nview.dll (ver 6.13.10.2942).  I uninstalled the drivers and upon rebooting installed fresh drivers and now it works fine.”

“I have the NVIDIA GeForce4 MX 420 card and the driver is version 6.13.10.2942. When my problem arouse with WinHex, it was also effecting a program called RamDisk XP by SuperSpeed Software. I also could not uninstall certain software using the uninstaller in the Control Panel. I then was receiving error messages pointing to nwiz.exe, and Nvidia file. I then uninstalled the Nvidia drivers and assorted files. Upon rebooting, Windows found new hardware and reinstalled the most current versions which were downloaded from Microsoft Update. I am not sure if the update benefited me or the reinstall of the Nvidia drivers, which could have become
corrupted. But upon reinstalling Nvidia drivers, WinHex, RamDisk and the Windows XP uninstaller all worked perfectly from that point on.”

Please use WinZip from http://www.winzip.com, WinRAR from http://www.rarsoft.com or an equivalent program to extract the files in the winhex.zip archive.

Previous versions of WinHex in rare cases did not initialize with the correct font size. Select the font again in the General Options dialog. 

Please try to start Windows again. If this does not help, please try deleting (or renaming) your winhex.cfg file before starting WinHex for full initialization. If this does not help either, you may also want to try installing again, or downloading and installing again. 

This problem can occur under Windows NT or Windows 2000 if a previous instance of WinHex terminated abnormally or after upgrading from a version prior to WinHex 9.6 to WinHex 9.6 or later. Please restart your computer or select a different font in the General Options dialog.

You can use the command “Delete irreversibly” in the File Manager menu to shred certain files. To wipe an entire hard drive (with the result of everything being deleted), fill all sectors of the hard drive with zero bytes, optionally more than once.

You cannot access remote hard drives (in a network) with the disk editor. And under Windows NT/2000, administrator privileges are needed to access local hard drives.

This is an inconsistency in the behavior of the MS Office shortcut bar that occurs in some cases in conjunction with WinHex appearing in the shell's context menu. Note that you can still run the MS software by right-clicking a button in the shortcut bar and selecting “Open” in the popup menu. This menu item should still be printed in bold, so it is not obvious why it is not the default command for this button any more.

To get rid of this problem, please disable “Add WinHex to the context menu” in the General Options dialog in WinHex. If this does not help, please run regedit.exe (the Windows Registry Editor) and remove the following entry manually:
"Edit with WinHex" under HKEY_CLASSES_ROOT\*\shell\