WinHex 21.9

WinHex is a hexadecimal editor and disk editor for Windows from X-Ways Software Technology. It works at the byte level on ordinary files, whole storage devices, partitions and the memory of running processes. This makes it a tool for data recovery, low-level repair, IT security work and computer forensics. WinHex is commercial software sold under several license types, and a free evaluation version is available with reduced write capabilities.

Editing files byte by byte

When you open a file in WinHex, its contents appear as hexadecimal values next to a text column. You can edit either side. WinHex shows text through ANSI or IBM (OEM) ASCII code pages. A Convert command translates data between character sets and representations.

The Data Interpreter sits alongside the hex view and decodes the bytes at the cursor position. It shows them as signed and unsigned integers from 8 to 64 bits, floating-point values and many date formats, including MS-DOS, Windows FILETIME, OLE, Unix, HFS+, APFS and Java timestamps. You can also enter values in the interpreter and write them back as raw bytes.

For files with a known structure, WinHex templates replace raw hex editing with a form. A template is a plain-text definition with a header and variable declarations. WinHex uses it to present each field of a record, header or data structure under its own name. WinHex writes edits from the form to the underlying bytes.

Searching and comparing data

WinHex searches for hexadecimal byte sequences or text, with options for case sensitivity, wildcards and regular expressions. A simultaneous search runs a list of terms in a single pass and logs each hit with its offset and term. On a logical drive, it also records which file and path the hit belongs to. Searches can continue past read errors on damaged media.

Combined search compares two files and finds offsets where the same variable sits in both, for example a counter in two game save files. You can keep hits and interesting addresses as bookmarks in the position manager and export them as an HTML table.

Disk, partition and RAM access

The disk editor in WinHex opens physical disks and logical drives below the file system level. This gives sector-by-sector access to partition tables, boot sectors and file system structures. A partition graphic marks deleted and overlapping partitions. In WinHex, disk sectors can be edited directly.

The directory browser interprets the file system on a disk, partition or image. It lists existing and deleted files and folders with timestamps, sizes, attributes and hash values. You can sort and filter the list. With a Specialist or forensic license, special areas such as free space appear as separate entries. WinHex can treat image files as if they were real disks, so you can browse their contents the same way.

The RAM editor opens the virtual memory of a running process. You can inspect and change values held in that memory. Memory editing is not available in the evaluation version.

Recovery, imaging and wiping

You can recover deleted files through the directory browser or by file name on FAT and NTFS drives. You can also recover them by file type through a search for header signatures. This search also works where file system information is missing.

For backups and evidence, WinHex clones a disk sector by sector to another disk or writes it to an image file, including free space and slack. You can compress images or split them into independent segments, and protect them with a checksum. You can later restore them completely or in part, for example only a boot sector.

The opposite task is secure deletion. WinHex overwrites whole disks, free space, file slack, individual files or selected areas with zeros, a chosen pattern or random data. The old contents cannot be recovered from those areas afterward.

Hashes, encryption and file tools

WinHex can calculate checksums, CRCs and hash values for files, disks, partitions or selected blocks. Supported algorithms include MD5, SHA-1, SHA-256 and SHA-512 among others. Checksums reveal accidental changes, while hashes show whether data was deliberately modified.

WinHex can also encrypt and decrypt data with a key the user enters. These keys are not saved to disk. WinHex scripts can automate repetitive work. The X-Tensions programming interface lets external add-ons extend the program.

License types and the evaluation version

The time-limited evaluation version of WinHex cannot save files larger than 200 KB, write disk sectors or edit virtual memory. Paid licenses build on each other:

Forensic licenses turn the same code base into X-Ways Forensics, which adds case management, reports, a gallery view and E01 evidence file support. X-Ways Forensics opens disks, images and memory in read-only mode and leaves out most wiping functions, while WinHex keeps direct sector editing and wiping available.