Welcome Guest. | Log In| Register | Membership Benefits

  • Email this page E-mail
  • |  Print Print
  • |   Bookmark and Share
  • icon

Langa Letter: Deep-Geek File And Disk Tools




(Page 3 of 4)

Real-Life Examples
There are literally hundreds of editors available, as even a cursory Google search will show. I've selected three examples -- one from each of the broad categories above -- simply as exemplars, not necessarily as recommendations. Please read the text and follow the search links before making a choice as to which one to try.

"Active Undelete" (feature-limited free trial; $40 and up to purchase full version) is a file-oriented tool optimized for file recovery. Its preconfigured "scans" (whole-disk searches) are designed to sniff out all recoverable deleted files on your system, and present them for easy undeletion.


Active Undelete is optimized for the easy recovery of deleted files and folders.

(click image for larger view)

Active Undelete is optimized for the easy recovery of deleted files and folders.

However, under the skin, it still is a hex editor, and the "Disk Hex Editor" tab reveals a basic interface for editing files, as Screen Two shows. Because this is only a demo, I've used the editor to open a completely nonessential, expendable file -- Freecell.Exe.

Active Undelete's hex editor interface is only a click away, letting you see (and optionally alter) the contents of any file. In this demo, we're editing the Freecell.Exe file because it's nonessential and thus reasonably safe to experiment with. Still, I'd made a copy of the original Freecell file just in case my tinkering did something fatal to the edited version.
Active Undelete's hex editor interface is only a click away, letting you see (and optionally alter) the contents of any file. In this demo, we're editing the Freecell.Exe file because it's nonessential and thus reasonably safe to experiment with. Still, I'd made a copy of the original Freecell file just in case my tinkering did something fatal to the edited version.

(click image for larger view)

Here, you can see that Active Undelete's editor window shows the tripartite information common to most hex editors -- the blue numbers show the reference position or "offset" within the file; the black two-place numbers in the middle are the actual hexadecimal coding of the file; and the far right pane shows the plain-text equivalent of the hex code. (Where there is no plain-text equivalent, a dot is used as a placeholder.)

Active Undelete's optimizations make it a good choice for its intended purpose -- deleted file recovery -- but the optimizations are extreme enough to that Active Undelete isn't very useful as a general purpose hex editor. For example, it can be hard to impossible to scan the unused portions of a hard drive for data scraps; and the hex editor interface has confidence-sapping defects, like labeling cluster as "cluser" in Screen Two. Still, Active Undelete does serve to illustrate the kinds of tradeoffs available to you in the spectrum from task-specific tools to more general-purpose ones.

The "Acronis Disk Editor" is another optimized, or special-purpose editor. It's part of their "Disk Director Suite" , (a feature-limited free trial of the Disk Editor is available; the full suite is $60 and down; price depends on quantity purchased). As you can see in Screen Three, the Disk Director Suite is mainly a partition- and boot-management and repair tool.


Acronis' Disk Director is an optimized or special-purpose editor aimed primarily at viewing and modifying a hard drive's data structures.

(click image for larger view)

Acronis' Disk Director is an optimized or special-purpose editor aimed primarily at viewing and modifying a hard drive's data structures.

The standalone Hex Editor -- Acronis calls it a Disk Editor -- bundled in the suite is likewise optimized for large-scale operations rather than anything as fine-grained as editing a specific file. For example, the Disk Editor's search does let you find data anywhere on the disk, whether in a file or not. But once found, you may be in for some head scratching because the tool simply isn't optimized for this kind of work. To continue the example, in Screen Four, I used Acronis Disk Editor to locate the text string "freecell" on the hard drive, and the editor did just as I asked. But look at the screen and tell me what you'd do next with the information shown.

Acronis' Disk Editor, bundled as part of the Disk Director Suite, is likewise optimized for viewing and modifying a hard drive's data structures -- not for general-purpose hex editing. In this case, I used the search function to locate the text string ''freecell,'' but the interface gives no hint as to what's available to do next.
Acronis' Disk Editor, bundled as part of the Disk Director Suite, is likewise optimized for viewing and modifying a hard drive's data structures -- not for general-purpose hex editing. In this case, I used the search function to locate the text string "freecell," but the interface gives no hint as to what's available to do next.

(click image for larger view)

What I did next was to click on Help and start wading through the text there.

So, like Active Undelete, Acronis' Disk Editor (indeed, the whole Disk Director Suite) is fine if you're looking for a special-purpose tool; in this case for manipulating and repairing partitions, book records, and the like. But it's so optimized that it's not very good at other hex editing tasks.

One of the best general-purpose hex editors I know of is WinHex (free trial; prices are in Euros, and at current exchange rates range from about $50 (US) for a personal-use license to about $500 (US) for a full "Forensics" version with extremely sophisticated features.)

I like this tool a lot. You'll find a full description at the Web site, but here's a snippet:

WinHex is a universal hexadecimal editor, particularly helpful in the realm of computer forensics, data recovery, low-level data processing, and IT security. An advanced tool for everyday and emergency use: inspect and edit all kinds of files, recover deleted files or lost data from hard drives with corrupt file systems or from digital camera cards....

WinHex's interface isn't flashy, but it's extremely functional. (The help system's good, too.) WinHex will search anywhere on a hard drive, locating data in or out of active file areas. It will show you all the normal and deleted files on a hard drive, much like Active Undelete. It can manipulate partition tables and boot records, much like Acronis' tool (though not as colorfully or graphically). But unlike the special-purpose tools we looked at, WinHex is also an outstanding text-finder and manipulator.


WinHex is a general-purpose hex editor that can do just about anything the special-purpose editors can, and more. In this simple demo, we've loaded Freecell into the editor and changed the first occurrence of the word "Freecell" to "Fredcell." Total elapsed time -- in, out, and done -- was maybe 30 seconds.

(click image for larger view)

WinHex is a general-purpose hex editor that can do just about anything the special-purpose editors can, and more. In this simple demo, we've loaded Freecell into the editor and changed the first occurrence of the word

In fact, WinHex makes it incredibly easy to get at almost anything on the hard drive -- if the information's there, you'll be able to get at it, manipulate it, and save it. As a general-purpose hex editor, I think it's an outstanding tool; and this one, I do recommend. Check out the Web site and grab yourself a demo copy.


Page 4: 
« Previous Page | 1 | 2 | 3 | 4 Next Page »


Subscribe to RSS


Advertisement






Get InformationWeek in Print

Apply for a free 52-week subscription to InformationWeek (a $199 value)



NOTE: Offer valid for U.S., U.S. possessions, & Canada only.