I’ve been attending Brett Shaver’s X-Ways Forensics Practitioners Guide (2E) course. From a live-session last week, one of the topics he discussed is the value of creating/customizing tools tips.
Tool tips are in-program hints/reminders on “check boxes, radio buttons, drop-down boxes/combo boxes, and ordinary push buttons (except for”OK”, “Cancel”, and “Help”).”
This reinforces a basic understanding XWF features, which ensures appropriate checkboxes are selected before creating a case. Some checkboxes cannot be unchecked after a case is created.
One of the tool tips encountered is a General notation option with a three-way checkbox, “Symbol for existence representation”. We didn’t have a tool tip for this, so I did a some digging.
Changing the options, I found it simply changes the value displayed in the Existent column. This is also described on page 21 in X-Ways Forensics/WinHex Manual (Updated 2021-12-31).
Based on the manual, I created a tool tip to remind myself:
Display options for the Existent column.
Fully checked: A check mark.
Half-checked: ∃ for “there exists”.
Unchecked: “Yes”, it exists.
mr. eerie 