Hex Viewer

Hex Viewer is used to view or examine the raw constituents of an item—file, process, data source, or even a partition—from a case or standalone file.

Hex Viewer consists of 2 panes: Raw data and Type converter. The Type converter pane may be hidden—click on its toggle to hide/unhide it.

To open a file in Hex Viewer, click on the menu bar at the top. Specify the path to the file.

Hex Viewer Toolbar

When a file is open in Hex Viewer, Belkasoft X provides these toolbar functions for your use:

Save selection: Belkasoft X saves the section highlighted on the raw data pane. On the Save as window, give the file a name and choose its format. Click on Save.
Copy as hex: Belkasoft X sends your selection (in hex) to your clipboard. For example, if you highlight ‘Types’ or ‘54 79 70 65 73’ and then use the copy as hex function, Belkasoft X sends ‘54 79 70 65 73’ to your clipboard.
Copy as text: Belkasoft X sends your selection (in text) to your clipboard. For example, if you highlight ‘Types’ or ‘54 79 70 65 73’ and then use the copy as text function, Belkasoft X sends ‘Types’ to your clipboard.
Go to: Belkasoft X navigates to a specific offset in the presented data. On the Go to window, type in the figure, specify the numeral system, specify the offset position, click on OK.
Search: Belkasoft X searches for a keyword. On the Find window, type in the keyword, tick the Match case checkbox—if you want the search to be case sensitive. Or you can search for hex.

When you click on Find, Belkasoft X presents the first match for the keyword or hex.

Note: The search operation may take some time to complete.

When you click on Find next, Belkasoft X presents the second match, and so on (in that order).

To terminate the search operation, click on Stop search.
Previous bookmark: Belkasoft X navigates to the previous bookmark.
Next bookmark: Belkasoft X navigates to the next bookmark.
Create bookmark: Belkasoft X gives your to highlight a bookmark.
Edit bookmark: Belkasoft X displays Hex Bookmark Editor.

Hex Bookmark Editor. Here you can edit, delete, and navigate to bookmarks on this window. Simply click on a bookmark and then click on an action (Edit bookmark, Delete bookmark, or Go to bookmark).
- Edit bookmark. You can give the bookmark a name, change its color, modify its start position and length, and provide a description. These details may help you better identify or locate the bookmark.
- Delete bookmark. Belkasoft X removes the color on the selection.
- Go to bookmark. Belkasoft X takes you to the bookmark’s position.
Bytes per row: Specify the number of bytes you want Belkasoft X to show on a row.
Bytes per group: Specify the number of bytes you want Belkasoft X to show in a group.
Change encoding: Specify your preferred encoding. Click on Additional encodings to see more encoding options.

Raw data

When you click on a byte, Belkasoft X states the position of the byte in the file at the bottom of the raw data pane. When you highlight a section, Belkasoft X states the position of the first byte (in the selection) and the number of highlighted bytes.

When you highlight a section on the raw data pane, Belkasoft X displays the corresponding details for the highlighted section on the type converter pane.

The Raw data pane contain the Size and Position in the file.

Raw data context menu

When you right-click on an object or select on the raw data pane

Copy as text
Copy as hex
Selection: Belkasoft X provides these actions for selections:
- Select all: Belkasoft X highlights everything
- Deselect: Belkasoft X deselects the highlighted section
- Go to selection start: Belkasoft X takes you to the start of the selection
- Go to selection end: Belkasoft X takes you to the end of the selection
- Save selection: Belkasoft X saves the selection. On the Save as window, type in a name, specify the file format, click on OK.

Type converter

Belkasoft X displays selected bytes (highlighted) on Type converter. You get to see interpretations of the bytes and figure out what the selected parts of a file mean. For example, when examining a file with an unknown structure, you may infer that an IP address exists inside the file. In that case, you can find the address through the raw data and type converter pane.

Depending on your selection, the Type converter displays these fields and their values: Signed byte, Unsigned byte, Signed short, Unsigned short, Float, Double, Unicode, string, ASCII string, IPv4, IPv6, and many others.

Hide empty values: Belkasoft X shows only the types that matches the selected bytes. If you do not want to see fields with empty values, tick the Hide empty values checkbox.
Little and big endian: Belkasoft X switches to another sequence. To switch between little endian and big endian, click on the toggle at the top-right corner.