WinHex lets you delete files at the binary level, which means the data is harder to recover than with a standard delete

When you delete a file normally in Windows, the operating system marks the space as available for reuse but leaves the actual data on disk. WinHex is a hex editor — a tool that reads and writes the raw bytes on your hard drive — and it can overwrite that data directly, making recovery much more difficult. This matters if you're disposing of a computer, selling a drive, or handling files with information you want genuinely gone rather than just hidden from view.

WinHex is not a file manager. You don't use it the way you'd use Windows Explorer. Instead, you open the drive or partition itself, locate the file's data in the hex view, and overwrite it with zeros or random bytes. The process is manual and technical, which is why most people use dedicated wiping software instead — but WinHex gives you control over exactly what gets overwritten and where.

Key Takeaways

  • WinHex works on the raw drive level, not through the file system, so you need to understand partitions and sectors to use it safely.
  • You must run WinHex as administrator and have physical access to the drive you want to edit.
  • Overwriting a file in WinHex does not delete the file entry from the directory — it only overwrites the data, leaving traces in the file system.
  • For most people, dedicated wiping tools like Eraser or CCleaner are safer and faster than manually editing in WinHex.
  • WinHex costs money (around $40 for a single license) and requires technical knowledge to avoid accidentally overwriting the wrong data.

Why WinHex is not the easiest way to delete files

WinHex is powerful but not designed for routine file deletion. If your goal is straightforward to delete a file so it doesn't show up in your file manager, use the Recycle Bin or press Delete — that's what those tools exist for. If your goal is to make a file unrecoverable before you sell or donate the computer, use a dedicated wiping tool instead.

Dedicated wipers like Eraser (free, open-source) or CCleaner (free version available) are built for this job. They find deleted files automatically, overwrite them with multiple passes of random data, and remove the file system traces. WinHex requires you to manually locate the file data in hex, understand sector addresses, and perform the overwrite yourself — which is slower and carries a real risk of overwriting the wrong data.

Use WinHex for file deletion only if you need to inspect what you're overwriting before you do it, or if you're working with a drive that's too damaged for normal tools to recognize.

How to open a drive in WinHex and locate a file

Start by opening WinHex as administrator. Right-click the WinHex icon and select "Run as administrator" — the program needs full system access to read and write to drives directly.

Go to File → Open and select the physical drive or partition you want to work with, not a folder. On Windows, drives appear as "\\.\PhysicalDrive0", "\\.\PhysicalDrive1", and so on. If you're unsure which number corresponds to which drive, open Disk Management (right-click Start, select "Disk Management") and note the drive letters and sizes before you open WinHex.

Once the drive is open, WinHex displays the raw hex data. To find a specific file, use Search → Find and search for a distinctive string from the file — the first few bytes of text, a filename, or a known phrase. This is slow on large drives and requires you to know something unique about the file's content. If the file is already deleted, its filename won't appear in the directory, and you'll be searching through unallocated space by byte pattern alone.

Overwriting file data in WinHex

Once you've located the file data, select the bytes you want to overwrite. Click at the start of the data, hold Shift, and click at the end. The selection will highlight in the hex view.

Right-click the selection and choose Edit → Fill. WinHex will ask what byte value to use — enter "00" to fill with zeros, or use a random pattern if you want multiple passes. Click OK, and WinHex overwrites the selected bytes on the drive itself.

This overwrites only the data, not the file system entry. If the file was already deleted, the directory entry is already gone. If the file still exists in your file system, the file entry remains — the file will now be corrupted and unreadable, but the entry itself stays in the directory until you delete it normally.

Why this method leaves traces

Overwriting file data in WinHex does not fully erase the file from a forensic perspective. The file system still contains metadata — the filename, creation date, size, and location — even after the data is overwritten. Forensic tools can see that a file existed and was overwritten, which may be enough to raise questions if the computer is seized.

If your goal is to leave no trace that a file ever existed, you need to also wipe the file system metadata, which WinHex is not designed to do cleanly. Dedicated wiping tools handle this by overwriting the entire free space on the drive, which removes both the data and the orphaned metadata entries.

Safer alternatives to WinHex for file deletion

Eraser is free and open-source. Install it, right-click any file or folder, select "Erase", and Eraser finds the file data and overwrites it with multiple passes. It also cleans up the file system entry. read it from eraser.heidi.ie.

CCleaner (free version) includes a file shredder. Drag files into the shredder, and CCleaner overwrites them before deletion. The free version is adequate for routine file deletion; the paid version adds scheduled wiping and drive-wide cleanup.

If you're wiping an entire drive before selling the computer, use DBAN (Darik's Boot Negator), which is free and boots from a USB drive to wipe the entire drive with multiple passes. This is the most thorough option and requires no knowledge of hex or sectors.

All three of these tools are faster, safer, and more complete than manually editing in WinHex.

When WinHex is actually useful for deletion

WinHex becomes useful when a drive is partially corrupted and standard tools won't recognize it. If a partition is damaged but you can still mount it in WinHex, you can manually locate and overwrite sensitive files before sending the drive for repair or disposal.

WinHex is also useful if you need to inspect a file before you overwrite it — for example, to confirm you're deleting the right version of a document, or to see what metadata is attached. The hex view shows you exactly what's on disk, byte by byte, which can be valuable for troubleshooting or verification.

For routine deletion of files you want to keep private, or for wiping a drive before you sell it, use a dedicated tool instead. WinHex is the right choice only if you have a specific reason to work at the binary level.

Frequently Asked Questions

Does overwriting a file in WinHex make it impossible to recover?

Overwriting the data makes recovery much harder, but not impossible with specialized forensic equipment. A single pass of zeros is considered adequate for most purposes. Multiple passes (five or more) make recovery impractical for anyone without laboratory-grade tools. Dedicated wiping tools typically use three to seven passes by default.

Can I use WinHex to delete files from an external drive or USB stick?

Yes, but the process is the same — you open the physical device in WinHex, locate the file data, and overwrite it. USB sticks and external drives appear as physical drives in the Open dialog. Make sure you select the correct device, because overwriting the wrong drive is permanent.

What happens if I accidentally overwrite the wrong data in WinHex?

The data is gone. WinHex does not have an undo function for drive-level writes. Always work on a backup or test drive first, and always verify the sector address and file size before you overwrite anything.

Is WinHex legal to use?

Yes, WinHex is a legitimate tool sold by a German software company. It's legal to own and use. Using it to destroy evidence or to tamper with a drive you don't own is illegal, but the tool itself is not.

Do I need to wipe my entire drive, or just the files I want to delete?

Wiping individual files is faster if you only have a few sensitive files. Wiping the entire drive is more thorough and removes all traces of deleted files, but takes hours. If you're selling the computer, wiping the entire drive is the safer choice. If you're just cleaning up a few old documents, file-level wiping is enough.