View Menu

WinHex & X-Ways

View Menu

 

Text Display Only: Hides the hex column and uses the full width of the editor window for the text display.

 

Hex Display Only: Hides the text column and uses the full width of the editor window for the hexadecimal data display.

 

Character Set: Select a character set or code page for the text display. You may also use Shift+F7 to toggle the active character set/code page. The default setting is ANSI ASCII. It uses the most efficient and uncomplicated display method, invoking only the most simple Windows API functions, and it seems to always show character interpretations according to code page 1252, even if regional settings in Windows are different, if in the font selection dialog (accessible via General Options) the "Western" script is selected.

 

To better utilize widescreen monitors and to assist examiners in particular in Asia, who may encounter text encoded in many different character sets and code pages in the same case, it is possible to see multiple text interpretations of binary data in the hex editor's text diplay at the same time depending on the license type. This is also useful to walk through the raw data of Outlook PST files that use cipher coding, to be able to read encoded ANSI text, encoded Unicode text, and totally unencoded text at the same time.

 

Personal license for WinHex: no more than 1 character set at a time

Professional license for WinHex: up to 2 character sets at a time

Specialist license for WinHex, X-Ways Investigator: up to 3 character sets at a time

WinHex Lab Edition, X-Ways Forensics: up to 4 character sets at a time

 

Please note that any text input from the keyboard is interpreted as being based on the ANSI code page that is active in Windows, except if the primary text column is set to the IBM/OEM/DOS code page 850 (Latin I), in which case input is based on that code page.

 

Record Presentation: When editing subsequent data records of the same size (for instance, table entries of a database) you may now have WinHex display every other record with a different background color, as a kind of visual aid. The color can be selected in the General Options dialog. Also, WinHex offers to display the current record number and the offset within that record (relative offset) in the status bar, based the record size and the offset of the first record as specified.

If any of the two record features is enabled, the Go To Offset command allows moving the current position in units of the current record size. If relative offsets are enabled, the Page Dn/Up keys move the cursor in units of the record size, except if you hold the Ctrl key.

 

Show: The Case Data window is part of the forensic user interface of WinHex/X-Ways Forensics and required for working with a case (when hiding the window, the case is closed). The directory browser is available for logical drives/partitions opened with the disk editor. The Data Interpreter is a small window that provides "translation services" for the data at the current cursor position. The toolbar is displayed optionally, too. A tab control makes each edit window accessible with a single mouse click only. The info pane provides in-depth information on any open object (file, disk, RAM).

 

Template Manager

 

Tables: Provides four conversion tables (cf. ANSI ASCII/IBM ASCII).
 

Lines & Columns

 

Synchronize Scrolling: Synchronizes up to four tiled windows on identical absolute offsets. Hold the Shift key when enabling this feature to tile the windows horizontally instead of vertically.

 

Synchronize & Compare: Synchronizes up to four windows and visually displays byte value differences. If no more than two windows are involved, WinHex maintains the initial distance between the offsets of the first shown byte in these windows when scrolling. Not synchronizing on absolute offsets is useful for example when comparing two copies of the file allocation table, which are obviously at different offsets. You may jump to the next or to the previous byte value difference by clicking the extra arrow buttons that are provided in one of the two edit windows.

 

Refresh View: Redraws the contents of the current edit window. In case the current file was updated by an external program, WinHex offers to dismiss any changes made in WinHex and reload the file from scratch.

Also refills the directory browser if the directory browser has the input focus. Useful for example when a filter for tagged items is active and you remove the tag marks of some of the listed files, if you wish to update the listing in the directory browser and get rid of those files that are no longer tagged.