Hex editor is computer software used to view and edit raw data contents of a file, while other software tries to interpret data for you. Hex edit is able to edit binary files which contain data in machine-readable form that can't be read by human. If you edit data with hex editor, you are said to hex edit the file and operations using a hex edit is called hex editing. Hex editor is mainly used by computer professionals to fulfill various tasks such as data recovery, analyze files, edit data structure, disk clone, edit partition table, etc. If you are new to this, you can continue reading to learn about hexadecimal, hex editor and how to use it.
Hexadecimal Numbering System
Binary and hexadecimal
The word "hex" in comes from "hexadecimal", a standard numbering system. You've no doubt heard of binary in computing which expresses numbers using only two digits 0 and 1. Likewise binary, hexadecimal is another numbering system and it is widely used in computing as well. The word "hexadecimal", hex for short, means sixteen and this kind of number system consists of 16 different digitals: 0-to-9 and A-to-F. The hexadecimal numbering system is commonly used in computer and digital systems in order to reduce strings of binary system to a group of 4 digits which can be easily understood and get away from unnecessary errors.
The major drawback of binary system is that binary string can be quite long compared with its equivalent of decimal base. For instance, when binary system works with large digital systems like computer, it usually has to contain 16 or even 32 digits, which is difficult to read or write without generating any errors. But sometimes it has to work with quite a few 16 or 32 bit binary numbers. The way to get over the problem is to lay out binary numbers into groups of 4-bit, and these groups of four bits employ another form of numbering system which is in general use in computing and digital system: Hexadecimal Numbers.
The hexadecimal numbering system uses the base of 16 system and it is the popular way of showing long binary values, for this form is more concise and easier to comprehend. There are 16 different digit symbols to represent numbers from 0 to 15, but these sixteen symbols are not completely identical with decimal numerals. That's because there will be potential problem if using decimal digit notation that numerals 10, 11, 12, 13, 14 and 15 are written with 2 adjacent digits. More specifically, if we write 11 in hex, it might be regarded as the decimal eleven or the binary number 3 (1 + 1). To overcome this problem hexadecimal numbers represents values from ten to fifteen using capital letters A, B, C, D, E and F correspondingly. Hence, we use numbers from 0 to 9 and capital letters A to F, starting with the least significant digit at the right side, to represent its binary and decimal number counterpart.
So we know the symbols in hexadecimal, how would we count in hex numbering system beyond the final symbol F? The answer is shown as below:
0, 1, 2…9, A, B…F, 10, 11, 12…19, 1A, 1B…1F, 20, 21, 22…etc.
As already mentioned, binary strings can be extremely long and hard to read, and yet we can make it easier to write and understand by arrange these numbers into groups. For example, 1100001111012 can be written in this format: 1100 0011 11012. In daily usage of decimal numbers, we arrange numbers into 3-digit groups with comma from the right hand side. For example, 230,330,000 is more easier to read and understand than 230330000.
What is a hex editor?
A hex editor is a piece of software that allows users to edit fundamental data, as it shows content on storage devices sector by sector in both ASCII and hex. With a hex editor, you can view and edit raw and extract data of a file instead of the file interpreted by programs, also you can use it to correct corrupted data caused by system error or software problem.
PartitionGuru is a multifunctional program which is effective partition manager, data recovery software, backup tool as well as a hex editor. It contains a complete set of hexadecimal tool with which you can edit, cut, copy, paste, fill, delete, etc. binary raw data. You can also work with it to jump to file or sector location, find or replace data, find text, calculate, recover lost data, etc.
The main window of sector editing is divided into 5 smaller parts. As shown in the following picture, different areas, marked with numbers from 1 to 5, are toolbar, directory browser, interpreter, editing area and status bar respectively.
The toolbar pane contains 19 buttons representing different functions such as cave, copy, paste, undo, find hex value, find text, go to offset, go to sector and more. These are most commonly used features while editing raw data.
2. Directory browser.
This area displays files and folders of the partition being edited. You can view all files and open files by double clicking your mouse button. When you click a file, you can see changes in other parts, as the editor displays the beginning of selected file.
3. Editing window.
You can see the binary content in the main edit window with offsets placed at the left side and original file content in the center and right respectively. Offset area shows addresses in hexadecimal format. The middle part is the most commonly used area of the hex area which lists file by byte with 16 bytes. In the picture above, the first 8 bytes of the file are 89 50 4E 47 0D 0A 1A 0A, and these symbols are called hex code or hexadecimal notation.
4. Status bar.
This simple bar displays sector/ sector count, offset, interpretation, range of selected blocks and block size, etc. If you select other files or drag the scrollbar on the right-hand edge, you'll see changes on this status bar. What's more, you can click these parameters to open "Go to Sector" "Go to Offset" or "Interpretation Mode" window.
This area displays and translates information for the location cursor stays. Once cursor changes places, information in this area changes correspondingly. Click "Current Endian" to switch between little and big. Besides, users are allowed to edit other items such as signed or unsigned integrals (8 bit, 16 bit, 24 bit, 32 bit, 40 bit, 48 bit, 56 bit, 64 bit), binary, date, etc.
What can you know by looking at hex editor?
Computer specialists can do an infinite number of things with a hex editor, but that doesn't mean average users cannot do anything with it. Common users are able to learn basic information by looking at the hexadecimal editor. The following section touches upon the surface on the use of hex editor only and offers an simple introduction to complicated operations.
Whether there is data on the drive
If there is no data on the drive and the drive has been erased, you'll see numerous zeroes; if the disk still holds some kind of data, the editing area will not be filled by zeroes only.
Identify file system type used on the hard drive
Hex editor is able to tell file system type on the hard drive being viewed. Traditional partition table MBR is able to define up to 4 primary partitions on one hard drive. In general, sector 0 is referred as Master Boot Record and file system of each partition is circled in red below. In the following picture, the hard drive has 2 partitions and both partitions are NTFS (07 represents NTFS file system).
Other file systems you may encounter:
- 0B or 0C: FAT32
- 83: Linux
- EE: EFI GPT partition (commonly used for Mac HFS+)
Tell file format
More advanced operations are available to meet a variety of needs, for instance, file table is damaged due to some reason, and we are still able to locate individual files by scanning raw structure if you know the characteristic header of beginning of the file. The highlighted part on the following picture indicates a PNG file.
How to find lost data with hex editor
The following section talks about how to recover lost data manually using a hex editor. All operations require users have good knowledge of data structure, file system and other related information. In a real-world application, operations to recover data are far more complex. Here we only give simple examples to explain the ideal involved to help you get general understanding of the process.
Hex editor PartitionGuru enables you to access raw data in hexadecimal format, which is very useful when you try to access data from a hard drive whose partition is corrupted and file metadata is lost. If you know the characteristic structure of the file format you want to recover, you can carve out data manually. For example, you find out the header and footer of a PNG file and you can select these raw data and save it to a file using .jpg as the extension. Then you can open the file to view the picture.
Here is another example to find lost data. Click the "Fix text" icon, the sixth icon placed on Toolbar, and enter words included by the file you want to find out. Then click "Search" button, and the software starts scanning. As shown in the following picture, we are going to find a lost word (.doc) file which contains words "conference proceedings":
Once the software finds out the file, you will be able to view data in text area and check whether it is the data you need. If it is the right file you are looking for, you can select all text related to the file and paste it to a word processor.
Though hex editor is powerful, it should be used with extreme caution, as improper operation may lead to further data loss. If you are not skilled in using this kind of tool, you can use data recovery software to recover data.
Most of times, data recovery software works as effective as hex editor to recover lost files, and recovery software is much easier to use, as it comes with recovery wizard which requires only simple clicks of mouse button throughout the entire recovery process.
Recover deleted files using data recovery software
Hex editor is surely not the only way to recover lost data or partition, thus there is no need to learn the complex operations if you are not computer professional and want to recover lost data. Data recovery software that is easy to use will be your best choice, as recovery software does not demand its users have good command of computer knowledge or data recovery skills. All you need to do is following prompts of recovery software and perform required actions, and then lost files will be found out and finally recovered.
PartitionGuru is effective data recovery software supporting file recovery and partition recovery. It is able to recover deleted, formatted or lost data from any storage devices including computer hard drive, external hard drive, virtual disks, server, USB flash drive, SD card, RAID, etc. After downloading PartitionGuru, you can follow the step by step guide to recover deleted files.
Install and launch PartitionGuru. Select the partition that is waiting for recovering data and click button "File Recovery".
Select recovery mode "Recover Deleted Files Only" and select "Search for Known File Types" and click "Start" button to scan selected drive. Note: The option "Search for Known File Types" is used to perform deep scanning and the process takes more time, but it'll find out more files you may need.
Preview and recovery. After scanning completes, you can preview files to recognize files you need. Then select those you need and right click mouse button to choose "Copy to", so that you can save recovered data to a secure location.
Note: The little red garbage can marking on some files indicates these files got lost due to deletion. You need to double click to preview file and judge whether it is recoverable.