Source mode

XAMN Pro license required.

The Source mode pane is useful to validate the extracted data, and to see how data in hexadecimal format relates to the memory address register.

Procedures

View data in Source mode

1. In the Artifacts pane, select an artifact.

2. In the Details pane, select the property you want to see in Source mode, and then click the Source mode button .
   

   You can also right-click the property you want to see in Source mode, and then click Examine in Source mode.

   The Source mode is opened.
   

3. If the property selected in the Details pane is linked to a file, the file name is shown in the Physical layers section. To continue working with the file somewhere else, for example open it in another view or in another tool, right-click the file name to show the context menu.

   

4. If the selected property originates from a SQLite database, the name of the source database, the table name, the column name, and the row number are stated. Click Show to open the selected property in the SQLite viewer. The correct table is shown automatically in the viewer, with the property value highlighted.

   For data that is reconstructed based on deleted data, it might only be possible to show the correct table and column, not the row.

   Note: The table, column, and row information is available in extractions performed with XRY 10.8 or later.