DIGITAL FORENSICS

Lab Assessment - 6

NAME: Asmit Gupta

REG. NO.:18BCE0904
SLOT: F1+TF1
FACULTY: SURESHKUMAR N
BIT SHIFTING USING WINHEX

WinHex is a commercial disk editor and universal hexadecimal editor

(hex editor) used for data recovery and digital forensics.
WinHex, made by X-Ways Software Technology AG of Germany, is a
software application that can be used as an advanced hex editor, a
tool for data analysis, editing, and recovery, a data wiping tool, and a
forensics tool used for evidence gathering. Customers using WinHex
include academics and forensics practitioners, the Oak Ridge National
Laboratory, Hewlett Packard, National Semiconductor, law
enforcement agencies, and other companies with data recovery and
protection needs.
WinHex, compatible with Windows XP through Windows
10, offers the ability to:
• Read and directly edit hard drives (FAT and NTFS), floppy disks,
CD-ROMs, DVDs, Compact Flash cards, and other media
• Read and directly edit
• RAM Interpret 20 data types
 • Edit partition tables, boot sectors, and other data structures
using templates
• Join and split files
• Analyze and compare files
• Search and replace
• Clone and image drives
• Recover data
• Encrypt files (128-bit strength)
• Create hashes and checksums
• Wipe drives

WinHex is in its core a universal hexadecimal editor, particularly

helpful in the realm of computer forensics, data recovery, low-level
data processing, and IT security (XWays, n.d.).
A related, and well-known, technique for hiding data is shifting bit
patterns (scrambling) to alter the byte values of data. WinHex include
a feature for shifting bits and altering byte patterns of entire files or
specified data. As WinHEx can view the file on bit level, it also allows
the user to unscramble the data by shifting the bits back to the
original place.

Steps followed for Bit Shifting In WinHex:

1. OPEN THE WINHEX EDITOR
2. OPEN THE FILE OF YOUR CHOICE WHOSE BITS HAVE TO
BE SHIFTED

• Click on File Menu

• Select Open option
• Browse the file of your choice.
3. IF REQUIRED, YOU CAN VALIDATE THE AUTHENTICITY OF
THE FILE USING MD5 HASH

• Click on Tools Menu

• Click on Compute Hash Option
• Select the type of hash you want to calculate
• Click on OK
4. PERFORM BIT SHIFTING ON THE FILE

• Click on edit menu

• Choose the modify Data option
• Choose the bit shifting option of your choice
Click on OK
After Bit-Shifting :

You can finally save the file.