Could someone please clear up a noob's confusion?
I have WinHex (as part of a CCE prep course - full license copy). I've been reading about X-Ways forensics additional features etc. but seems as though a major advantage to X-Ways Forensics is that it opens/read only views while WinHex is more of an editor potentially data changing. - how simplified (and incorrect) is MY understanding? If someone has 'time on their hands' to edumacate me…I really appreciated it!
as a note I'm trying to justify to myself, the possible purchase of X-Ways Forensic for 1) CCE cert exercises, 2) to have as a tool - all w/out at this time, having any other need for it (read I work in another discipline of I.T. right now)
Thanks in advance for the always, very informative replies……
Have you compared the feature list of
Opening a file as read-only is a trivial part of the power of X-Ways.
Winhex Is a good tool if you need basic forensic utilization like - Imaging, recovery of basic files, browsing the folder structure. It is very economical and a good buy for start up kit.
X-ways Have loads of extra features like extraction of data on date creation, modification or access and also by author of document, many more to the list. It does come a price but if you need the complete features it is a good buy.
My personal experience with X-ways forensics has been excellent never the less I did start with WinHex.
Awesome. thanks for taking the time to give me your personal experience/insight….great information, confirms much of what I've already read.