Challenger Rocket Hex View¶
Hex View is a Task Integrated Tool for complex analysis, display, forensic tasks and data recovery in pure binary mode.
Hex View Interface¶
Hex View View is divided into 3 columns, Offset,Hex Values and ASCII Values. Offset represent the position into file in hex or in decimal, hex values are the exadecimal representation of binary values and ASCII is the text representation fof binary values.
Hint
Learning HEX displayed values will transform you from a rookie to a data recovery engineer.
| figure: | Hex Displayed Values of a NTFS Boot Sector |
|---|
Hex View Toolbar¶
Hex View Windows¶
Opening a File in Binary Mode¶
Opening a Device in Binary Mode¶
Searching¶
Search Tool is probably the most important feature of the Rocket Hex View.
Using Search tool will transform you into a True Data Recovery Engineer.
Search Input Field¶
insert text you are looking for into Search Field in Lower Case or in Hex.
If you are using hex values check As Hex Value
Sector Boundaries Filter¶
Set Sector boundaries Filter after inserting a file signature or file system object signature.
Results will be all Sectors with positive match at relative offset 0x00
Create Html Report¶
Rocket will create a HTML file with search results in Human Readable Mode.
Relative Offset¶
Using Relative Offset Settings, you will able to locate occurrences of your search query on a relative offset of a sector of 512 bytes.