WinHex vs. X-Ways Forensics

WinHex & X-Ways

More Differences between WinHex and X-Ways Forensics

 

WinHex (main executable file is winhex.exe or winhex64.exe) always identifies itself as WinHex in the user interface, X-Ways Forensics (main executable file xwforensics.exe or xwforensics64.exe) as X-Ways Forensics. The shared program help and the shared manual, however, statically refer to the name "WinHex" in most cases, sometimes "X-Ways Forensics".

 

WinHex and X-Ways Forensics share the same code base. X-Ways Forensics offers numerous additional forensic features over WinHex with a specialist license, but does not allow to edit disk sectors or interpreted images and lacks various functions to wipe data known from WinHex. In X-Ways Forensics, disks, interpreted image files, virtual memory, and physical RAM are strictly opened in view mode (read-only) only, to enforce forensic procedures, where no evidence must be altered in the slightest. This strict write protection of X-Ways Forensics ensures that no original evidence can possibly be altered accidentally, which can be a crucial aspect in court proceedings.

 

Only when not bound by strict forensic procedures and/or when in need to work more aggressively on disks or images (e.g. you have to repair a boot sector or wipe classified or unrelated data), then a user of X-Ways Forensics would run WinHex instead. With WinHex you can edit disk sectors and wipe entire hard disks, free space, slack space, selected files, selected disk areas etc.

 

Users of X-Ways Forensics may simply copy their xwforensics.exe executable file and name the copy winhex.exe (or for the 64-bit edition copy their xwforensics64.exe executable file and name the copy winhex64.exe) to get WinHex. The setup program creates such copies automatically. Or you can create hardlinks instead of copies (higher coolness factor). If the program is executed as *winhex*.exe, it will identify itself as WinHex everywhere (in the user interface, case report, case log, image descriptions, and all screenshots) and act/behave like WinHex. That version is the best of both worlds, with the full forensics feature set of X-Ways Forensics plus the sector editing and data wiping capability of WinHex in one.