WinHex 21.9

WinHex (Version 21.9) — Hexadecimal and Disk Editor for Forensics and Data Recovery

WinHex by X-Ways Software Technology AG is a compact, high-capability hexadecimal and disk editor designed for computer forensics, low-level data processing, and data recovery. The application exposes raw bytes on disks, removable media, and image files while providing utilities for disk imaging, file recovery, memory analysis, and structured data interpretation. The current release (WinHex 21.9, Sep 14, 2026) supports Windows 7 through Windows 11 and Server editions including 2008, 2012, 2016, 2019, 2022, and 2025 in both 32- and 64-bit builds.

Key Features and Functionality

• Universal hex and disk editing: Direct inspection and modification of sectors on hard disks, SSDs, optical media, removable cards, and image files. Supports files of any size with fast response and instant window switching.
• Data recovery: Multiple recovery techniques for deleted or lost files from damaged file systems, digital camera cards, and partitions. Drive images and backups can be created, optionally compressed or split into archives.
• Forensic workflows: Drive cloning and imaging (including X-Ways Replica under DOS), evidence-preserving imaging options, and a dedicated X-Ways Forensics edition with expanded capabilities for forensic examiners.
• Memory and process access: Built-in RAM editor provides access to physical RAM and other processes' virtual memory for live memory analysis and forensic use.
• File system and RAID interpretation: Native handling of FAT12/16/32, exFAT, NTFS, Ext2/3/4, Next3, CDFS, and UDF. Built-in interpretation tools for RAID arrays and dynamic disks to aid reconstruction of complex storage layouts.
• Data interpretation and templates: Interpreter for over 20 data types and editable templates to analyze or repair structures such as partition tables and boot sectors.
• Scripting, comparison and analysis: Simple scripting for automating repetitive tasks, fast file comparison, flexible search-and-replace, and analysis functions tailored to forensic and recovery use cases.
• Security utilities: Secure erase and wiping options for files, unused space, slack space, or entire drives; checksums and hash support (CRC32, MD5, SHA-1); and 256-bit AES encryption.
• Data handling and format conversion: Concatenating/splitting files, unifying/dividing bytes and words, importing all clipboard formats (including ASCII hex), and conversion between binary, Intel/Motorola hex formats and multiple character sets including ANSI, IBM ASCII, EBCDIC, and Unicode.

Usability and Practical Applications

• Engineered for forensic examiners, data recovery specialists, and IT security practitioners who require low-level access to storage and memory. Typical tasks include file carving, sector-level repair, drive imaging, and live memory inspection.
• Extensive program help and a detailed user manual support users handling complex data structures and forensic procedures, though proficiency with hex editing and file system internals is necessary to exploit advanced features.
• License-dependent feature sets mean functionality varies between commercial, professional, and forensic editions; a license-type comparison is available from the vendor to determine which edition meets specific operational needs.
• Toolset includes utilities useful in incident response and secure archival workflows, such as image creation, checksumming, encryption, and secure erasure.

Compatibility and Limitations

• Officially supports a wide range of Windows desktop and server versions in 32- and 64-bit variants. Some older Windows versions impose restrictions; for example, on Vista/2008 Server/Windows 7 physical RAM cannot be opened and writing sectors on partitions that contain Windows and WinHex is not possible.
• Feature availability is governed by the purchased license; certain forensic and advanced automation capabilities are part of the X-Ways Forensics or other higher-tier editions.

Technical Notes and Localization

• Includes hashing and encryption primitives, a random-number generator, and support for printing and multiple clipboard formats.
• User interface and program help are fully available in English and German, with partial translations for Chinese, Ukrainian, Russian, French, Spanish, Italian, and Portuguese.
• Registered professional users listed by the vendor include organizations from the technology, consulting, and government sectors.