Winhex Full Version Keygen Crack
Elwanda Menhennett
v20.0 [Aug 23, 2020]
File System/Disk Support:
- UFS support has been revised. Significantly more UFS variants are now understood.
- APFS: Supports new Catalog ID structure as created by Mac OS Catalina.
- Technical Details Report/evidence object properties now show details of MacOS X Installations on HFS or APFS volumes: Exact OS X version, timezone, the system's network and display names.
- Support for much more deeply nested subdirectories in XFS volumes.
- Supports Ext4 volumes with version 2 of sparse superblocks.
- Slightly more complete output of Ext* file system timestamps.
- Ability to choose which copy of a FAT12/FAT16/FAT32 file allocation table to work with, in Options Volume Snapshot. This can be either a user-designated copy or the one that is defined as active in the boot sector (in case of FAT32). If neither the user selects a copy nor the boot sector defines a single copy as active, the first copy will be used, labelled as "FAT 1", like in earlier versions. The copy that was selected at the time when the volume snapshot was taken will be used for the whole lifetime of that volume snapshot, even if the settings are changed. It is displayed in the Info Pane. The Technical Details Report now informs which copy or copies are considered active in the file system.
- Identifies unpartitioned physical disks or disk images as such in some rare cases where it previously didn't.
- General option to open volumes including the slack that doesn't add to another cluster just like when opening an entire partition. The data in that area, aside from a potential NTFS backup boot sector, does not belong to that volume logically and was stored there before the volume was created. It is not needed to parse the file system or to mount the volume (though some tools may output an error message if it's not included). Including such data in a volume image can be an IT security leak if only the regularly accessible part of the volume had been sanitized before usage.
- Identifies some new bus types of currently attached storage devices.
- Active sector superimposition is now remembered in an evidence object and automatically re-activated when the evidence object is opened next time, and you will be reminded of that.
- Generally improved handling of incomplete/corrupted .e01 evidence files, similar to storage media with unreadable areas (bad sectors). NTFS: A limited listing of system files is now presented based on $MFTMirr if in an such an incomplete image $MFT is not included, but $MFTMirr is.
- Ability to abort the potentially time-consuming preparation of a cluster allocation map for huge volumes and still proceed with taking the actual volume snapshot if desired (without reverse cluster allocation information).
Picture Support:
- New version of the internal picture viewing library.
- WEBP pictures are now supported in Preview, Gallery, and for the View command.
- Ability to view pictures in some variants of the DICOM format.
- Metadata extraction from WEBP pictures revised. Output of processing states, similar to PNG files. File type identification/verification for DICOM and WEBP revised.
- All JPEG files are now presented with a processing state in Details mode. Two additional state values were introduced.
- The processing state now depends on the detected generator, where each generator is now assigned to one of three generator classes D (device), E (editor), or C (content management system). JPEG files produced by generator class D are absolute originals. The processing state is always "original". JPEG files produced by the generator class E are relative originals. Their processing state is always "Edited normally". Examples are photos published by news agencies like Reuters.
- The detected processing state of the third generator class (CMS like WordPress, Drupal, TYPO3, Joomla etc.) can assume different values. They are usually irregularly edited, i.e. their edited status is not officially indicated. The state can be deducted indirectly based on filename, generator signature, pixel dimension. The state "irregularly edited" can also result from picture manipulations.
- The new processing state "scaled" means that a picture was created with a content management system such as WordPress, TYPO3, Drupal. It can be said with a high probability that such pictures have been released to the public, which entails a reduced intelligence value. Practically such pictures cannot be regarded as documents. They were automatically and individually adapted to the respective output display in order to optimize the loading time of the web page.
- The state "EXIF stripped" refers to JPEG pictures, whose device origin was detected although no EXIF metadata is present. The device can potentially be detected based on generator signature, filename or a characteristic pixel dimension.
v19.9 [Nov 26, 2019]
Recover/Copy Command:
- There is now an option to convert files of certain supported types to PDF format, to share those files with computer users that otherwise would not have suitable applications to view the files or if you generally prefer a fixed, context-insensitive representation. You can define the file types that do not need to be converted, e.g. those that can easily be displayed by a web browser or ordinary Windows tools. If no conversion is possible, the original file is copied unconverted.
- Ability to extract pure text from files of various types and output it as plain text files. That is the same representation that you get when switching from ordinary Preview mode to raw Preview mode with the Shift key held, and the same text that a logical search would get to see of a file when you have X-Ways Forensics "decode" the text in a file. Files that are not suitable for text extraction (e.g. pictures) or from which no text can be extracted for whatever other reasons are copied normally if the corresponding checkbox is only half checked, or are omitted if fully checked.
- There is now an option to output all selected files as a single PDF document. This includes even file types that would usually not be converted to PDF individually. For example it may not make sense to recode original PDF files as PDF files again individually, but if the purpose is to bundle multiple files in a single document for easier sharing it has merit.
- You now have the option to output the alternate name of a file, or both the main name and the alternate name in the copylog.txt or copylog.html file depending on what you prefer to see.
- That same option also exists for the Export List command.
Case Report:
- Files that are copied for and linked from the case report can now be converted to PDF format if needed, similar to the aforementioned option of the Recover/Copy command.
- You can now choose to convert the entire HTML case report to PDF format. This cannot be used in conjunction with the option to split the report file after a certain number of files. If the box with the PDF option is fully checked, that means that you will receive only a PDF version of the report. If half checked, that means that you you will receive both an HTML and a PDF version of the report.
Please note that if you later delete one of the two files (.html and .pdf) in the Windows Explorer/File Explorer, this will automatically and involuntarily also delete the corresponding subdirectory that contains the copied files for the report, if there is such a directory, even if those files are still needed for the respective other version of the report.
- The generation of report thumbnails for non-picture files with or without shrinking is now possible in current versions of Windows 10 (1809 and 1903).
- The report generation no longer makes copies of files with a size of 0 bytes.
Case Management:
- Images of a case are now found automatically in the case directory even if they are not remembered to have been there previously (this condition existed in earlier versions). This works even if the path of a case changes. Please remember, the case directory is the directory of a case, with the same name as the .xfc file of the case, not to be confused with the default directory for cases, which may contain many cases (multiple .xfc files and multiple case directories).
- A dedicated case-specific default path for images can now be defined and enabled in the properties of a case, which then overrides the generic default path for images. That means it will be preselected when creating new images and when adding images to the case. It will also be a place where X-Ways Forensics will automatically look for images that cannot be located any more in the path were they were last known to be. The case-specific path may be a relative path, where a . refers to the case directory and .. to the parent directory of the case directory. A suggested dedicated place where to put the images of a case is the subdirectory \!images of cases that are newly created in v19.9.
Please note, however, that for performance reasons it can still be advisable to store cases and images on different physical storage devices. If you define a case-specific image path in v19.9 and open the case in v19.8 or earlier, you will get a warning about unknown data being ignored and lost, but can still work with that case in the older version and later enter the path again in v19.9 if necessary.
- Project Vic categories for the USA are now predefined in the user-editable text file PVicCat.txt. Law enforcement users from UK and Canada can download their own definitions from the PhotoDNA download section on our web server and replace the default PVicCat.txt file in their installations. Users in other countries with differing categories can gladly share their category definitions with us for the benefit of other users.
Search Functionality:
- Indexing and index searches were revised.