WinHex...Data Recovery and Forensics Tool
WinHex as a disk editing program and has developed into a forensic tools that is useful to digital evidence examiners of all skill levels.
WinHex is a universal hex editor, particularly helpful in the realm of computer forensics, data recovery, low-level data editing. With WinHex you can view and hex edit the following:
- any kind of file, in particular binary files
- hard disks
- floppy disks
- CD-ROM & DVD (read-only)
- smart media, compact flash, memory sticks
- all other drive types accessible in Windows
- even your computer's RAM!
The disk editor specially supports the following file systems: FAT12, FAT16, FAT32, NTFS. Useful to inspect and edit all kinds of files, recover deleted files or lost data from hard drives with corrupt file systems or from digital camera cards. This hex editor opens files larger than 4 GB in a second. Very fast in general. Easy to use.
Download Winhex Sofware from here.
Let's See How to clone a USB Disk using Winhex.
Start the Winhex Software by clicking it's icon, and then...
- From the Tools menu in WinHex, select Open Disk.
- Select Removable medium (F/G/H:) and click OK. (Removable medium refers to your USB drive.)
- From the Tools menu, select Calculate Hash. This will give you a "digital fingerprint" of the original USB drive. Later we will get a digital fingerprint of the clone (bit-stream image file). They should match so that we will come to know that our cloning is done correctly and successfully.
- Select the MD5 (128-bit) hash algorithm and let the computer make the calculation. It could take a while. Be patient.
- Copy and paste the results (the hash) into a notepad (with a note about what it is, e.g. the MD-5 hash of the original disk).
- From the Tools menu, select Disk Tools and then Clone Disk.
- For the Source medium, click on the disk icon, and select Removable medium (F/G/H:).
- For the Destination, we will use a file. We will clone to a destination file (not to a disk).
- Make sure you see Destination File rather than Destination Disk.
- Click on the file icon.
- Tell WinHex that you will save the clone (image) to a file on your F/G/H drive. Name the file something like 007USBImage.
- Click OK to get the cloning started. The cloning may take a while. Be patient...
Once WinHex has completed cloning your disk, you should see a new window that shows the data in the image file.
From the Tools menu, select Calculate Hash. This will give you a "digital fingerprint" of the clone. It should match the fingerprint of the original USB drive.
Note we have once again calculated the hash to check whether we have cloned the USB Disk correctly.
Now you can use this cloned disk to perform operations like extracting information from the disk, getting what files were present and which files are deleted, etc....
Please Share it......