WinHex is a universal hexadecimal editor, particularly
helpful in the realm of computer forensics, data recovery,
low-level data processing, and IT security. An advanced tool
for everyday and emergency use: inspect and edit all kinds
of files, recover deleted files or lost data from hard
drives with corrupt file systems or from digital camera
cards.
* The index optimization step was reworked. It can now utilize an unlimited and user-defined number of processor cores simultaneously and a user-defined amount of main memory, for faster and more thorough optimization.
* Improved memory handling for search hits. No additional memory requirement for search hits any more when loading or saving the case. Memory for search hits is now needed only when the evidence object is open (same as before already with memory for volume snapshots). The limitation of the number of search hits in one evidence object by main memory was slightly increased (now several ten million search hits possible). Search hits saved by v15.3 cannot be loaded by older versions any more.
* Decoding the text in PDF, HTML, and various other documents for the logical search and for indexing can no longer cause the program to freeze or crash if the viewer component has problems processing the file e.g. because the file is corrupt.
* When attempting to view or preview a file with the viewer component that is a known to be a reason for crashes, you are asked whether you are really sure you would like to view the file.
* Detects if hash database is in use to avoid conflicts when updating it.
* When you add an excerpt from a file to the volume snapshot as a virtual file (select a block in File mode and use the Edit menu for that), the resulting file is now marked as "excerpt" in the Attr. column and is filterable like this.
* zip.exe was updated with a version that supports larger .zip files. That program is used for archiving cases.
* If multiple search terms were used in the original 15.3 version in Simultaneous Search with the GREP option enabled, only the first one was actually searched for. This was fixed.
* When the same file is added to the same evidence file container again, and if the version of the file in the container includes metadata only, because it was copied indirectly and only to replicate the path of one of its child objects, and when the same file is to be added again specifically along with its contents, then the new version of the file (with contents) will now replace the old version of the file (without contents). Previously, the file would not have been copied again.
* More user account information is extracted from the SAM registry hive as part of the Windows registry report.
* The Convert script command now supports the parameters "hiberfil Binary" for automated hiberfil.sys decompression.
* More thorough check for file systems in partitions defined by conventional Apple partition maps.
存放空间广告真多啊T_T
