I've been working with winhex lately trying to figure out the software. I'm liking it more and more as I learn how to use it. It seems to be very powerful just not very straight forward and user friendly like ftk for example. But it does a very good job of carving files.
Is there a way to carve jpeg files out of deleted space and preview them without actually saving them somewhere? It just seems like this could be bad if your were to carve out contraband, since your just creating more contraband. This would apply to all files not just jpegs.
The standard version of WinHex does not have that capability, however the X-Ways Forensic version does.
-Gallery view for pictures
-Finds pictures embedded in documents (e.g. MS Office, PDF) automatically
-Skin color detection (e.g. a gallery view sorted by skin color percentage greatly accelerates a search for traces of child pornography)
-Ability to extract still pictures from video files in user-defined intervals, using MPlayer or Forensic Framer, to drastically reduce the amount of data when having to check to inappropriate or illegal content
-Extracts metadata and internal creation timestamps from various file types and allows to filter by that, e.g. MS Office, MDI, PDF, RTF, WRI, AOL PFC, ASF, WMV, WMA, MOV, AVI, WAV, MP4, 3GP, M4V, M4A, JPEG, THM, TIFF, GIF, PNG, GZ, ZIP, IE Cookies, SHD & SPL printer spool
However any Windows program you use that previews will create additional data and perhaps additional contraband.