Data Window Context Menu

WinHex & X-Ways

Data Window Context Menu

 

When you right-click the hex editor display (consisting of offset column, hex column, text column) of a file or a disk, you will get a context menu that allows you to define the boundaries of the block (start and end) and invoke a few more commands that apply to that block:

 

Add to User Search Hits: Forensic license only. Allows you to define search hits manually. Whenever you come across some relevant text, for example floating around in free space in Disk/Partition/Volume mode or within a certain file in File mode, you can select it as a block and right-click the block to add it as a so-called user search hit (i.e. some kind of search hit not found by the program). You can assign the search hit to an arbitrarily named search term/category. For example, if what you have found is related to suspect A, assign it as a search hit to a search term named after suspect A. If also related to suspect B, you can also assign it to another search term. You could also assign it to a real search term that you have used for an automatic search.

User search hits can be conveniently listed in and nicely exported from search hit lists just like ordinary (automatically generated) search hits. To distinguish then from ordinary search hits, in the search hit description column user search hits are marked with an asterisk (*). You can specify the correct code page for user search hits yourself when you define them, which may be essential to get the text displayed correctly. User search hits are stored related to an object in the volume snapshot if you define them in File mode. User search hits are forward compatible, i.e. older versions (v16.2 and later) can also see user search hits created by v16.6.

 

Add Block as Virtual File: Forensic license only. See Edit menu.

 

Add Position: Allows you to remember the position indicated by the currently defined block, either in the General Position Manager or in the Position Manager of the evidence object (when working with a case, if you right-click a block that is defined in an evidence object, forensic license only). Makes it easier to find the same position again later, and can be used to nicely highlight and explain (with tooltips) the structure of files or records of a certain format that you are analyzing/trying to reverse-engineer etc.

 

If search hits are highlighted in File mode (see General Options), you can also delete them via the context menu.

 

You can also get the complete Edit menu from here.