All You May Want To Know About File Comparison

This article provides an extensive description of the FlexHEX file comparison feature.

How To Compare

First, open the file you wish to compare. We call this object the primary file.

NOTE: Although we often say file comparison, it is not only files that can be compared. You can also compare physical and logical drives, alternate streams, compound file streams, in fact, you can compare any object that can be opened for hex editing

Second, open the comparison window using the Search / Compare command and select the object to compare the primary file with. We call this object the secondary file, although it may also be a logical or a physical drive.

Block comparison

You can compare only a part of the file by specifying the starting address and the block size.

NOTE: If the primary file has an active selection, FlexHEX assumes you are requesting block comparison and pre-fills the appropriate fields.

The block comparison mode is fairly obvious; the only thing worth mentioning is how the program interprets empty fields. An empty offset field means the lowest address, which is usually, but not always, zero. An empty size field means the rest of the file.

Comparison Result

There are three block types that can be found as the result of a comparison operation:

• Green identical (matching) blocks,
• Red replaced (differing) blocks,
• Blue inserted (unique) blocks.

Basically, differing and unique blocks are similar - both contain data not present in the other file, and both reside between two green blocks. The only difference is whether the other file also contains some non-matching data between the corresponding green blocks. If yes, we call the block differing, otherwise it is unique.

Click the picture to open a larger view.

The screenshot above includes three screen parts related to the comparison. They are the main edit window (in the two-file view mode), the comparison map, and the Comparison pane.

Edit Window

The edit window shows both the file being compared - the primary file in the top pane, and the secondary file in the lower pane (if you select the side-by-side arrangement, the primary file will be shown in the left pane).

The primary and the secondary file are treated slightly differently: the secondary file is always read-only. There is a reason for such a limitation - the secondary file is not being edited, it is just being compared with. It may be in use by the system or another application, and an attempt to open it for read/write access may cause an error. This is the only limitation though - you can browse the secondary file, define bookmarks and data fields, copy, drag, export data, and so on.

Comparison Map

The map in the left of the edit area shows the file layout and the correspondence between blocks in a graphical form. It is extremely useful, especially if the files being compared don't contain too large or too small blocks.

If you don't need the map, use the Show Comparison Map command in the View menu to turn it off.

Comparison Pane

The Comparison pane provides the complete information about the file layout. Note however that there are in fact two panes because each file has its own layout. If you switch between the primary and the secondary file, you will notice that the block list in the Comparison pane changes accordingly.

As with other navigation panes, clicking the Start field moves the caret to the start of the appropriate block, and clicking the Size field selects the block. There is one more field though: Corresponds To. It displays the address of the another file's block corresponding to this one; clicking this field moves the caret to the start of that block (switching the currently active file).

A Few Tips

Switching to the Standard View

In order to switch to the standard single-file view without discarding the comparison result, select the Stream pane in the lower left Navigation panel. Selecting the Comparison pane again will switch the edit window back to the two-file view. Selecting any other pane will not affect the edit window.

Recomparing

If you modify the primary file, the comparison result becomes invalid. Unfortunately, it is not possible to update the comparison result on the fly - you will have to repeat the compare operation. The Search / Compare Again menu command repeats the previous compare using the same arguments.

As a rule of thumb, if the text in the header of the active file pane changed its color from black to red, this means that the primary file has been changed and that the current comparison result is no more actual. Re-comparing or undoing the changes will make the result actual again.

Will it find all matching blocks?

Sometimes it won't. Don't expect the algorithm to find a 100-byte long match immediately after 50 megabytes of non-matching data. The only way to ensure that all matching blocks are found is to try every byte against every other byte. FlexHEX does this when comparing small files, but for larger files this approach would take ages. A more practical method is to try only selected patterns, resynchronizing when a match is found. Unfortunately this means that small matching blocks sometimes may be overlooked.

This applies to matching blocks only. All differing blocks, no matter how small, are guaranteed to be found.

Comparison Order

Sometimes you may get different results comparing A to B and B to A, specifically when A and B are large files with many small matching and differing areas. As explained before, the comparison algorithm is not wholly deterministic, and so resynchronizing might occur in different positions depending on what is compared to what.

Comparing with an alternate stream

Although the comparison dialog allows selecting files and drives only, it is also possible to specify an alternate stream as the secondary file. Enter the file path either by typing it, or by using the Browse button, and then add the colon character and the name of the alternate stream.

If the stream name contains a special non-printable character, enter it by holding the Alt key and typing a three-digit decimal character code (you can't use the character escape sequences in the comparison dialog).