File Menu
New: This command is used to create a file. The file is principally opened in default edit mode. You have to specify the desired file size. In X-Ways Forensics you can also use this command to create dummy segments for .e01-Images.
Open: Lets you open one or more files. You may choose an edit mode in case it is not predetermined in the Options menu.
Also allows to open physical disks, partitions and volumes as a file, by clicking a button labeled "Device..." in the file selection dialog. You can enter a device path such as
\\.\PhysicalDrive1 (for hard disk 1)
\\?\Volume{12345678-9abc-11a1-abcd-0123456789ab} (for a volume with that GUID)
\\.\C: (for a volume mounted as drive letter C: )
This functionality allows to open volumes that are not mounted as drive letters. To get an overview of volumes known to Windows, type "mountvol" in a command prompt window. You can also try to open exotic devices supported by Windows such as tapes and changers (not tested). Also this is how you can open alternate data streams whose path and name you know, which cannot be opened through the ordinary File | Open dialog, without opening the volume on which they reside.
Opening a hard disk as a file can be useful for example if you wish to clone that disk and if source and destination disk have different sector sizes (whether it makes sense in the first place to clone a hard disk despite the sector mismatch depends on the data). When treated as a file, there is no defined sector size and hence no possibility for a sector size mismatch. Device files can also be interpreted as disks like images can.
Save: Saves the currently displayed file with all modifications to the disk. In in-place edit mode, using this command is not necessary. When using the disk editor, this command is named "Save Sectors".
Save As: Saves the currently displayed file under a different name.
Create Disk Image/Make Backup Copy
Restore Image: Select an image that you would like to restore, i.e. whose sectors you would like to copy back to the original medium or some other medium, or select a or WinHex backup (.whx) file whose contents you would like to restore (could be a file or disk sectors). In the case of an image, the image will be preset as the source in the Clone Disk window (with a specialist license or higher, interpreted). Without a speciaIist license or higher, only WinHex backups can be restored if they are split.
Execute: Executes the current file if executable, or otherwise the associated program.
Properties: Allows you edit the size, the time stamp and attributes of a file or a directory in your own Windows system. Changeable attributes are: A (to be archived), S (system), H (hidden), R (read-only), X (not to be indexed), T (temporary), ~ (sparse). After entering new values in any area (size, timestamps or attributes), simply press the Enter button to apply them. Click the button with the ellipsis to select a new file, or enter path and name directly into the edit box next to that button and press the Enter key. The latter will also work to target a directory.
Please note that setting or removing the sparse attribute does not necessarily change the allocation status of already assigned clusters, but will definitely have an effect on newly assigned clusters when you expand the file by setting a larger file size in the same dialog window.
Open Directory: Opens a window that represents a directory on your own computer and allows you to see all its files and subdirectories.
Open Files: This command is used open several files that meet special requirements at a time. Select a folder in which to open files. Subfolders are browsed optionally. You may specify a series of file masks (e. g. "w*.exe;x*.dll"). There is also a switch that permits opening only those files that contain a certain text or certain hex values. The standard search dialogs are displayed upon request for this purpose. If WinHex is not set up to work as a viewer or in-place editor (this can be done in the Tools menu), you may choose an edit mode.
Save Modified Files: All files which have been changed are written to the disk.
Save All Files: All files that have not been opened in view mode are written to the disk.
Exit: Use this command to end WinHex. You will be prompted to save any modifications to files and disks.