Disk Cloning
This function copies a defined number of sectors from a source to a destination. Both the source and the destination can be either a disk (click the button with the disk icon) or a file (click the button with the file icon).
In case both the source and the destination are disks, both disks must have the same sector size. In order to effectively duplicate a medium (i.e. copy all sectors), simply copy all sectors. Select the appropriate option, so the correct number of sectors is entered automatically. The destination disk must not be smaller than the source disk. As a disk you can also select an interpreted image or a partition opened from within a physical disk in the background. As a target you cannot select an interpreted .e01 evidence file as such images cannot be rewritten, only raw images. As a file you can only specify unsegmented raw images, e.g. .dd, .001, .img etc., no other image types such as .e01, .vhd., .vmdk etc.
Disk cloning offers options that control the behavior when bad sectors are encountered on the source disk:
� By default, you are notified of the error and prompted for either continuing or aborting the operation. 'Log procedure silently' creates a complete log file of the entire operation in the folder for temporary files (filename 'Cloning Log.txt'), including a report on unreadable sectors (which cannot be copied), and prevents WinHex from reporting each unreadable sector separately.
� WinHex can either leave the destination sector that corresponds to a damaged source sector unchanged or fill it with an ASCII pattern you specify (e.g. your initials, or something like 'BAD '). Leave the pattern edit box blank to fill such sectors with zero bytes. BTW, this pattern is also used to display a bad sector's contents in the disk editor.
How To Use Winhex To Recover Data Sheet
Contents hide 1 Common ways to delete a file 2 Common cases of file deletion (FAT32) 3 Recover deleted files (FAT32) 3.1 Method (1) Copy the deleted file to the specified directory. 3.2 Method (2) Restore the deleted file to the state.
- Screencast: Recovering lost data with WinHex WinHex is a forensics tool that allows users to examine running programs, wipe confidential files or unused space, and perform drive imaging and drive.
- WinHex include a feature for shifting bits and altering byte patterns of entire files or specified data (Nelson, Phillips, & Steuart, 2016). As WinHEx can view the file on bit level, it also allows the user to unscramble the data by shifting the bits back to the original place.
� Bad sectors often occur in contiguous groups, and each attempt to read a bad sector usually takes a long time. You may have WinHex avoid such damaged disk areas. When a bad sector is encountered, WinHex can try to skip a number of subsequent sectors you specify. This is useful if you wish to accelerate the cloning process and if you do not care about some actually readable sectors not making it to the clone.
Winhex Download
Regular disk cloning is not an option if you want to duplicate a disk in a removable drive (e.g. a floppy disk) with only one removable drive present. The correct concept for this application is disk imaging, where the data is first stored in an image file. The image can then be copied to a different disk. The result is the same as disk cloning.
Winhex X Ways
When you specify a file named 'dev-null' as the destination, the data will only be read and not copied anywhere (and you will be warned of this). This is useful if you are interested in the report about bad sectors, but do not wish to actually clone or image a disk.
You may try 'simultaneous I/O' if the destination is not the same physical medium as the source. Offers a chance to accelerate the cloning process by up to 30% by reading and writing simultaneously.
Specialist license or higher: In conjunction with simultaneous I/O you may also have WinHex copy the sectors of a disk in reverse direction, backwards from the end of the source disk. Useful if the source disk has severe physical defects that for example cause a disk imaging program or your entire computer to freeze or crash when reaching a certain sector. In such a case you can additionally create an image in reverse order, by reading sectors from the disk backwards one by one, or better, you can even automatically complete an existing incomplete unsegmented conventional ('forward') raw image from the rear end to get an image that is as complete as possible, filled from both ends, with ideally only a small zeroed gap in the middle that represents the unreadable damaged spot on the source hard disk. For that you simply select an incomplete raw image file that you already have as a destination file, and you will be asked whether you wish to complete it instead of overwrite. WinHex will do the rest, e.g. allocate the missing sectors in the image file (zeroed out) so that it has the complete size of the source disk and then fill the file backwards as much as possible. Be sure to create reverse images on NTFS volumes, not FAT32. The source start sector to specify for reverse imaging is the same as for conventional forward images, i.e. usually 0 when imaging a complete hard disk.
For disk imaging in general it is recommended to use the File | Create Disk Image functionality for various reasons (with a forensic license: support for .e01 evidence files, compression, splitting, hashing, encryption, metadata, technical details report, more convenient). Only in specific cases, for example when dealing with several physical disk defects or when the goal is to copy only certain ranges of sectors, advanced users can use Tools | Disk Tools | Clone Disk to have more detailed control over which sectors are copied from where to where in which order.
More hints on disk cloning and disk imaging.
