Refine Volume Snapshot
1) Particularly thorough file system search
• FAT12/FAT16/FAT32: This option searches for orphaned subdirectories (subdirectories that are no longer referenced by any other directory).
• NTFS: This option searches for FILE records in sectors that do not belong to the current MFT. Such FILE records can be found e.g. after a partition has been recreated, reformatted, moved, resized, or defragmented. With a forensic license, in a second and third step, this option also searches INDX buffers and $LogFile for noteworthy index record remnants, which either reveal previous names or paths of renamed/moved files/directories that were known to the volume snapshot before or deleted files that the volume snapshot was not aware of before (without file contents, though).

WinHex is in its core a universal hexadecimal editor, particularly helpful in the realm of computer forensics, data recovery, low-level data processing, and IT security. An advanced tool for everyday and emergency use: inspect and edit all kinds of files, recover deleted files or lost data from hard drives with corrupt file systems or from digital camera cards. Features depend on the license type (license type comparison), among them

WinHex is in its core a universal hexadecimal editor, particularly helpful in the realm of computer forensics, data recovery, low-level data processing, and IT security. An advanced tool for everyday and emergency use: inspect and edit all kinds of files, recover deleted files or lost data from hard drives with corrupt file systems or from digital camera cards. Features depend on the license type (license type comparison), among them:

Disk editor for hard disks, floppy disks, CD-ROM & DVD, ZIP, Smart Media, Compact Flash, ...
Native support for FAT12/16/32, exFAT, NTFS, Ext2/3/4, Next3®, CDFS, UDF
Built-in interpretation of RAID systems and dynamic disks
Various data recovery techniques

WinHex is in its core a universal hexadecimal editor, particularly helpful in the realm of computer forensics, data recovery, low-level data processing, and IT security. An advanced tool for everyday and emergency use: inspect and edit all kinds of files, recover deleted files or lost data from hard drives with corrupt file systems or from digital camera cards.

WinHex is in its core a universal hexadecimal editor, particularly helpful in the realm of computer forensics, data recovery, low-level data processing, and IT security. An advanced tool for everyday and emergency use: inspect and edit all kinds of files, recover deleted files or lost data from hard drives with corrupt file systems or from digital camera cards. Features depend on the license type (license type comparison), among them:

Disk editor for hard disks, floppy disks, CD-ROM & DVD, ZIP, Smart Media, Compact Flash, ...
Native support for FAT12/16/32, exFAT, NTFS, Ext2/3/4, Next3®, CDFS, UDF
Built-in interpretation of RAID systems and dynamic disks
Various data recovery techniques
RAM editor, providing access to physical RAM and other processes' virtual memory
Data interpreter, knowing 20 data types
Editing data structures using templates (e.g. to repair partition table/boot sector)
Concatenating and splitting files, unifying and dividing odd and even bytes/words
Analyzing and comparing files

X-Ways Investigator is a powerful investigation/document analysis/report generation application for law enforcement, intelligence agencies, and the private sector. It runs under Windows. It was designed for investigators who are specialized in areas such as accounting, building laws, money laundering, corruption, homicide, child pornography, etc., also for investigative analysts, agents, attorneys, paralegals, prosecutors, internal and external auditors, for the analysis part of computer forensics and electronic discovery. X-Ways Investigator is based on X-Ways Forensics and is a subset thereof. It's simplified user interface offers much fewer technical options than WinHex and X-Ways Forensics, so that investigators can better concentrate on the matter at hand.

WinHex is in its core a universal hexadecimal editor, particularly helpful in the realm of computer forensics, data recovery, low-level data processing, and IT security. An advanced tool for everyday and emergency use: inspect and edit all kinds of files, recover deleted files or lost data from hard drives with corrupt file systems or from digital camera cards. Features depend on the license type (license type comparison), among them:

Disk editor for hard disks, floppy disks, CD-ROM & DVD, ZIP, Smart Media, Compact Flash, ...
Native support for FAT12/16/32, exFAT, NTFS, Ext2/3/4, Next3В®, CDFS, UDF
Built-in interpretation of RAID systems and dynamic disks
Various data recovery techniques

WinHex is in its core a universal hexadecimal editor, particularly helpful in the realm of computer forensics, data recovery, low-level data processing, and IT security. An advanced tool for everyday and emergency use: inspect and edit all kinds of files, recover deleted files or lost data from hard drives with corrupt file systems or from digital camera cards.

WinHex is in its core a universal hexadecimal editor, particularly helpful in the realm of computer forensics, data recovery, low-level data processing, and IT security. An advanced tool for everyday and emergency use: inspect and edit all kinds of files, recover deleted files or lost data from hard drives with corrupt file systems or from digital camera cards. Features depend on the license type (license type comparison).