WinHex is a hexadecimal, disk, and memory editor used for data recovery, digital forensics, and low-level data work, letting you inspect and modify bytes inside files, storage devices, and running processes.
WinHex is a universal hexadecimal editor that opens files, storage devices, and memory as raw bytes, which suits data recovery, digital forensics, and low-level data work. You point it at a file, a physical disk, a memory card, or a process, and it shows the contents in a hex and text view where every byte can be located, edited, or compared. From there the tool goes past simple editing: deleted files can be searched for by name or by file type, damaged system areas can be inspected and repaired, and a whole drive can be cloned to an image before anything is changed. WinHex is a working tool rather than a wizard, aimed at people who need to see what the media holds.
Three views make up most of the workflow. The disk editor reads and writes sectors on physical drives, memory cards, and optical media, which is how a corrupted partition table or boot sector gets repaired, and it can reach surplus sectors the file system ignores. The RAM editor opens physical memory and the virtual memory of other processes, useful when a program misbehaves and its state has to be examined directly. Underneath, WinHex understands FAT, exFAT, NTFS, Ext2/3/4, CDFS, and UDF structures, and it interprets RAID arrays and dynamic disks so a spanned volume is not a dead end. Documentation often travels after the technical work: when a case report needs editing before it is handed over, FlexiPDF handles that side.
The reason people keep WinHex installed is control. Most recovery utilities present a friendly list of files and a single Restore button, which is fine until the file system itself is the thing that is broken, or the data you want is sitting in slack space with no directory entry pointing at it. WinHex works at the level where those cases are still solvable: it shows the raw sectors, lets you search for a known signature, and writes changes back only where you decide, with unlimited undo covering every step. That combination also makes it the honest choice for verification work, because a hash of a disk can be compared before and after an operation to prove nothing shifted by a single byte. The secure wiping functions answer the opposite problem, clearing confidential files, unused space, and leftover records so that nothing recoverable remains, and the scripting engine turns a repetitive fix into a single command when the same problem appears across many files.
Key capabilities and highlights.
WinHex loads files far larger than memory allows and presents them in a hex and text view with adjustable columns, offset jumps, and a browsing history you can step backward and forward through. Edits support unlimited undo, clipboard exchange in many formats, and copy-and-overwrite pastes that ignore sector boundaries, so byte-level fixes are quick and reversible.
Hard disks, memory cards, USB sticks, and optical media open as sector-level objects rather than files, which is the only way to repair a damaged master boot record, partition table, or boot sector. The same view reaches surplus sectors the file system never uses, where leftovers and hidden data tend to sit.
Native interpretation in WinHex covers FAT12/16/32, exFAT, NTFS, Ext2/3/4, CDFS, and UDF, so you can browse a volume by its own structures instead of guessing where things are. RAID arrays and dynamic disks are interpreted as well, which means a striped or spanned set can still be examined when no controller is around to mount it.
Automated recovery works in two directions. By name, it uses the file system to rebuild deleted entries and nested folder structures on FAT and NTFS volumes. By type, it scans for the signature at the start of known formats and reconstructs matching files even where no directory record survives, which is how photos come back from a formatted camera card.
An entire drive can be duplicated sector by sector, either to another disk or into an image file that can be compressed or split into smaller parts. Working from a copy matters when the original is failing, since the physical media is read once and every later experiment happens against the image instead of the patient.
Files can be deleted irreversibly from WinHex's file manager, drives filled with zero or random patterns, and the unused and slack regions of a volume cleared so they stop carrying traces of earlier contents. Wiping slack space is also practical housekeeping, because initialized space compresses far better in later disk backups.
Files can be compared byte by byte to spot differences, and hashes such as CRC32, MD5, and SHA-1 confirm that data is intact or unchanged after an operation. Templates describe known structures on screen with named fields, which turns a wall of hexadecimal into something readable when a partition table or file header has to be repaired.
The RAM editor opens physical memory along with the virtual memory of other running processes, letting you inspect state that never reaches disk. It is used for debugging, for understanding how a program stores its data, and for examining memory when an application misbehaves in a way that logs cannot explain.
Browse historical releases and previous builds.
No old versions have been added yet.
Common questions about WinHex.
It is a hexadecimal, disk, and memory editor used for data recovery, digital forensics, IT security, and low-level data processing. Typical jobs include recovering deleted files, repairing a damaged partition table, cloning a failing drive before it dies, and clearing confidential data so it cannot be read again.
Yes, in the cases where the data has not been overwritten. Recovery by name rebuilds deleted entries and folder structures on FAT and NTFS volumes, while recovery by file type scans for the signatures of known formats such as JPEG, PNG, PDF, ZIP, and Office documents, which works even when the directory record is gone.
It is aimed at technicians, forensic examiners, and advanced users, because it exposes raw sectors and expects you to know what you are editing. The window layout itself is not complicated, but the work is, and a mistaken write to a disk can be permanent. Practising on copies and images is the usual approach.
Yes, and imaging is the recommended first step. Cloning or creating an image reads the original media once and lets every later search or repair happen against the copy, which reduces the risk of losing data to a drive that is already struggling.
WinHex's RAM editor gives direct access to physical memory and to the virtual memory of other processes. Users employ it for debugging, for research into how a program organizes its data, and for inspecting a program's state while it runs, which is information that never appears in a log file.
Yes. It calculates checksums and cryptographic hashes such as CRC32, MD5, and SHA-1 for files, disks, and images, so you can record a value before an operation and compare it afterwards. Matching hashes are common evidence that a copy is an exact duplicate.
It can delete files irreversibly, fill drives with zero or random patterns, and clear the unused and slack areas of a volume where fragments of earlier files may survive. The aim is to leave nothing behind that another recovery tool could reconstruct.
WinHex is a hexadecimal, disk, and memory editor used for data recovery, digital forensics, and low-level data work, letting you inspect and modify bytes inside files, storage devices, and running processes.
TreeSize is a disk space analyzer that scans drives, folders, and network shares, then shows exactly which subfolders and files are consuming storage so you can decide what to delete, archive, or move.
AOMEI Backupper is a backup and disaster recovery tool that images systems, disks, partitions, and files, then restores them to the same hardware or a replacement drive. It suits users who want scheduled backups, one-click cloning, and bootable recovery media.
Wondershare Recoverit is data recovery software that scans storage devices for deleted, formatted, or lost photos, videos, documents, and other files, then restores the ones it can find intact.
balenaEtcher writes operating system images such as ISO and IMG files to USB drives and SD cards, then verifies that the data was written correctly. It suits anyone preparing bootable installers, Raspberry Pi cards, or recovery media without using command-line tools.
Comments