Nick 2003
Platinum Member | Редактировать | Профиль | Сообщение | Цитировать | Сообщить модератору
Цитата: Changes:
· It is now possible to add files to newly created report contents tables that can be included in the report under unique names. This enables you to manage a large number of notable files in a more systematic way than in just a single generic table for noteworthy files. For example, you could gather relevant Internet Explorer favorite files in one table and revealing pictures in another. Use an evidence object's context menu to create a blank report contents table. (forensic license only)
· It is now possible to conveniently copy contents tables with the case data window's context menu. By working on copies you ensure that you don't lose original file listings when you remove irrelevant files in order to narrow down the list to possibly relevant files.
· In addition to simple, spanned, and striped volumes, WinHex now supports logical RAID 5 volumes on Windows 2000 dynamic disks. (specialist and forensic licenses only)
· WinHex can now internally destripe RAID 0 systems (physical hard disks or images) with up to 5 components and supports different RAID header sizes per component. This renders the use of a script that unstripes and exports RAID systems to a new image obsolete, and it saves time
· and drive space. First open the components, then try the Specialist | Assemble RAID System menu command. (specialist and forensic licenses only) The RAID configuration and the partitions defined in the RAID system can be saved as evidence objects, which allows to access them instantly in later sessions. (forensic licenses only)
· When you find the start sector of a volume (e.g. lost partition) on a physical disk, WinHex can now make such a partition easily accessible via the Access button menu when you use the new menu command Tools | Disk Tools | Interpret As Partition Start.
· Previously, files with a known extension, but an unknown (not matching) file signature, were flagged in the contents table file only, with the word "unknown" in the Mismatch column, visible e.g. when opening in MS Excel. Such files are now flagged in the directory browser as well when a
· contents table with mismatch detection is loaded, with "(sign. unknown)" in the sortable Attr. column. (since v12.15 SR-6)
· .jpg, .gif, .png, etc. files that cannot be displayed as pictures because they are corrupt or have an incorrect extension now appear with an ASCII representation in the preview area instead of with the notice "This picture cannot be displayed.".
· In addition to _exploring_ directories with the directory browser, it is now possible to _open_ their data structures in a separate data window, i.e. directory entries in FAT and INDX records in NTFS. (see directory browser context menu, since v12.15 SR-4)
· A special file ".badblocks" is now displayed in the root directory of Ext2/Ext3 file systems. This file contains the bad blocks that the file system is aware of.
· On Ext2/Ext3, WinHex can now optionally list deleted files of which nothing is known but the name (no data, size, or dates).
· The evidence object's folder being the default output target for recovered files is now optional. (see case properties, since v12.15 SR-6)
· There is a new case option that allows to automatically add all partitions to a case as well when a physical disk is added.
· A new script command - StrToInt - converts ASCII integer numbers in ASCII into integer numbers encoded in binary. The new Release command decommits the memory associated with a variable and destroy the variable.
· Depending on the chosen parameters, the search functions in v12.15 SR-2 through SR-9 aborted prematurely. This was fixed.
· Cloning disks with bad sectors with both simultaneous I/O and log file creation activated caused WinHex to crash. This was fixed.
· Various other minor improvements and bug fixes. |
|
Всего записей: 13879 | Зарегистр. 18-07-2003 | Отправлено: 21:07 02-05-2005 | Исправлено: Nick 2003, 03:14 16-05-2005 |
|
