Disk Editor

WinHex & X-Ways

Disk Editor

 

The Disk Editor, that is part of the Tools menu, allows you to access floppy and hard disks below file system level. Disks consist of sectors (commonly units of 512 bytes). You may access a disk either logically (i. e. controlled by the operating system) or physically (controlled by the BIOS). On most computer systems you can even access CD-ROM and DVD media. There is an optional raw mode for optical drives that allows to read from audio CDs and also the complete 2352-byte sectors on data CDs (CD-ROM and Video CDs) that contain error correction codes.

 

Opening a logical drive means opening a contiguous formatted part of a disk (a partition) that is accessible under Windows as a drive letter. It's also called a "volume". WinHex relies on Windows being able to access the drive. Opening a physical disk means opening the entire medium, as it is attached to the computer, e.g. a hard disk including all partitions. It could also called the "raw device". The disk normally does not need to be properly formatted in order to open it that way.

 

Usually it is preferable to open a logical drive instead of a physical disk, because more features are provided in this case. For example, "clusters" are defined by the file system, the allocation of clusters to files (and vice versa) is known to WinHex, "free space" and "slack space" have a meaning. If you need to edit sectors outside a logical drive (e.g. the master boot record), if you wish to search something on several partitions of a hard disk at the same time, or if a partition is damaged or formatted with a file system unknown to Windows, so Windows is unable to make it accessible as a drive letter, you would open the physical disk instead. From the window that represents a physical medium you can usually also open individual partitions, by double-clicking them in the directory browser of that window. WinHex understands conventional MBR partitioning, GPT (GUID partition type), Apple partitioning, superfloppy format, Windows dynamic disks as organized by the LDM (Logical Disk Manager, MBR and GPT style), LVM2 (MBR and GPT style) and PC-compatible BSD disklabel. All dynamic volume types are supported: simple, spanned, striped, and RAID 5. Holding the Ctrl key when opening hard disks disables detection and special handling of dynamic volumes and ensures the hard disk is treated like it has been partitioned in the conventional way. Some of the aforementioned partitioning types are supported with specialist and forensic licenses only.

 

Directory Browser

 

Please note the following limitations:

 

• Administrator rights are needed to access sectors on any kind of media. Under Windows Vista/7/8 you need to run the program as administrator specifically, just being logged on as administrator is not sufficient.

• Remote (network) drives cannot be accessed sector-wise.

• X-Ways Forensics cannot edit disk sectors or sectors in interpreted images at all, only WinHex can.

• WinHex cannot write to CD-ROM or DVD.

• Under Windows Vista/7/8, WinHex cannot write sectors on the partition with the active Windows installation and on the partition where WinHex is running from.

 

Save Sectors: To be used analogously to the Save command for files. Part of the File menu. Writes all modifications to the disk. Please note that, depending on your changes, this may severely damage the integrity of the disk data. If the corresponding undo option is enabled, a backup of the concerned sectors is created, before they are overwritten. This command is only available in the full version.

 

Here are some pieces of information concerning the Master Boot Record of a hard disk, that is editable using the disk editor.