Persons
XAMN Pro license required.
The Persons concept in XAMN uses advanced intelligence to link user identities to persons in your case. Accounts which are associated with the same phone number or the same email address will be automatically joined to the same person.
Note: The Persons functionality is available when you work in a case file, with one or more data sources.
You can view information about the data source owner and persons in the Details pane. If an owner is set for the XRY file, this person is displayed in blue after the XRY file name.
For each message, call, contact, and email in the Details pane, you can see which person sent it and who received it. If there is no person identified, a user identity will be shown, which might be a phone number, an email address, or a social media account.
To view all artifacts where a specific person appear, create a Participants filter by right-clicking a person in the Details pane.
To open the Person viewer and view person details, click on a hyperlink with the person's ID or name in the Details pane.
In the Person viewer, you can:
- Mark a person as a Person of interest by selecting the star icon in the top left.
- Join and unjoin the selected person with other persons in your case. XAMN automatically suggests other persons which might be the same as the one you clicked on. For more information, see Join Persons.
- Edit the name and picture of the person.
- View artifacts where identities of the selected person appear.
The Persons page lists the identified persons in your case. The page also contains a list of identities that could not be associated with a contact or account. On the Persons page, you can:
- Mark a person as a Person of interest by selecting the star icon next to the person's name.
- View all persons in your case or only persons of interest.
- Search for a specific person. You can search by name or any of the other metadata, such as phone number, email address, or chat app ID.
- View details of a selected person.
- Join persons, if you have reasons to believe that they are in fact the same person. For more information, see Join Persons.
- Generate a PDF report. For more information, see Generate a Persons PDF report.
- Rebuild the list of persons. For more information, see Rebuild Persons data.
Note: You might be prompted to rebuild the list of persons. This happens when there are any changes to the list of data sources in a case, such as .xry files being added or removed. If you choose to rebuild the list of persons, note that all manual changes will be lost. If you choose to not rebuild your list of persons when prompted to do so, there is an increased risk for duplicates of persons.
Procedures
You can join Persons when several identifiers belong to the same person. When you join two Persons, a new Person is created. The new Person contains all identifiers, for example, the email addresses and phone numbers of the joined Persons.
- In the Persons view, you see suggested persons that have at least one user identity, like a phone number or an email address in common. Click This is ... to join the user identities.
- Optional, to join other persons that are not suggested, click the Join with person button on the top right of the Persons view.
To unjoin persons, click Unjoin.
- On the Persons page, select a Person, click List only persons of interest, or search for a specific Person in your case.
- Click the export to PDF icon.
- In the Persons Export dialog, select Filtered.
- In the Include person drop-down, select one of the following:
- Overview - export an overview of the Person including picture and name.
- Details - export details of the Person including picture, name, and IDs.
- Enter export location and click Export.
