XWF Tool Tip, File Existence

I’ve been attending Brett Shaver’s X-Ways Forensics Practitioners Guide (2E) course. From a live-session last week, one of the topics he discussed is the value of creating/customizing tools tips.

Tool tips are in-program hints/reminders on “check boxes, radio buttons, drop-down boxes/combo boxes, and ordinary push buttons (except for”OK”, “Cancel”, and “Help”).”

This reinforces a basic understanding XWF features, which ensures appropriate checkboxes are selected before creating a case. Some checkboxes cannot be unchecked after a case is created.

One of the tool tips encountered is a General notation option with a three-way checkbox, “Symbol for existence representation”. We didn’t have a tool tip for this, so I did a some digging.

General Options | Notation: General

Changing the options, I found it simply changes the value displayed in the Existent column. This is also described on page 21 in X-Ways Forensics/WinHex Manual (Updated 2021-12-31).

Based on the manual, I created a tool tip to remind myself:

Display options for the Existent column.
Fully checked: A check mark.
Half-checked: ∃ for “there exists”.
Unchecked: “Yes”, it exists.


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.