Topic89

WinHex & X-Ways

Optionally, files can be indirectly added to evidence file containers, via your own hard disk. That means they are not copied directly into the container, but to your folder for temporary files first (cf. General Options), and only then from there into the container. This can be beneficial because it allows a resident antivirus software to intercept these files (check them for viruses, disinfect/disarm them, rename them, move/delete/lock them, etc.), so that it prevents viruses from making it into a container. The resulting container is free of known viruses (depending on the antivirus software in use) and can reasonably be passed on to and used in an environment with higher sensitivity, higher security requirements, and/or less sophisticated virus protection.

 

Important: Please verify first, by testing with known malware, that your antivirus software works as intended in this situation.