If there are multiple artifacts that are too close for individual markers to be shown on the map, the artifacts are clustered. A cluster of artifacts is displayed as a black field with the number of artifacts included. When you zoom out or into an area, the clusters adapt and rearrange themselves.

Individual artifacts are displayed with different symbols that indicate the classification of the location. The classes are introduced to make it easier to determine whether a location artifact could be relevant to the case or not, for example to understand which location artifacts that could indicate where a user has been.

There are four different location classes.

Warning: MSAB work continuously to improve the classification of locations. For now, the classification should be considered as guidance. Start with the Visited class that contains locations that we know indicate the actual location of the device. At this point though, we cannot rule out that some locations in the Other class might indicate a visited location.

Note: The improved location classifications are available in extractions performed with XRY 10.7 or later. In extractions performed with earlier versions of XRY, most artifacts will be in the Other class.

	Class	Description	Artifact categories
	Visited	Applicable when the location itself is the primary artifact. This means that there is no other user activity or device interaction that ca be associated with the location data.	Visited
	Referenced	Applicable in two situations. When a location is referenced by a user in user-created data. Example: A user has searched for “Nearby train stations” in a train travel app. The train stations suggested by the app have been decoded and can be shown on the map but there is no information about the user’s actual location. When a location is system-provided and directly linked to user-created data for which there is a relevant artifact category. Example: Longitude and latitude metadata is available for a photo artifact. Note: Referenced locations might indicate that the user has visited the location. In the example with the photo artifact, if the user took the photo, that means they were in the location available in the photo metadata.	Calls Pictures Videos Calendar events Chat Email SMS MMS Bookmarked Searched
	Indicative	Applicable when a location is indicative of a user's approximate location. Example: The device has identified and harvested the location of a known WiFi access point.	Downloaded areas Harvested areas Network information
	Other	Any other location, where there is no knowledge about the meaning of the location. Example: A travel app automatically downloads locations for all train stations, regardless of the user's actual location.	History Predicted Other

• At the top right of the Artifacts pane, click Maps.

  When activated, the Maps filter view is displayed above the artifacts in the Artifacts pane.

View details for an artifact with a location

• Hover an individual artifact on the map to show details about the artifact.
• Click an individual artifact or a cluster of artifacts on the map to show those artifacts in the Artifacts pane, below the map. Click on an artifact in the Artifacts pane to show it in the Details pane.
  • To remove the selection, click Selected in Maps in the Filter pane.

Zoom in and out

There are different ways to zoom to view the map in more detail or to get an overview.

• Hover the mouse pointer over the map and use the mouse scroll.
• Click the plus and minus buttons on the map.
• Double-click on the map to zoom into or out from a specific area.

Search in the map

Use the search function to search for specific areas. You can add an area of interest from the search hit.

• Click the search button in the Maps filter view.
• Type what to search for and select the Enter key.

Areas of interests are filters for specific areas that of extra interest in an investigation. They can be drawn on the map as a circle, a rectangle, or a polygon, depending on what you are investigating.

Example: To investigate reported violations of a restraining order, draw a circle from the specified location with the radius of the limitation in the restraining order.

The areas of interest can be named and saved as part of a quick view for easy access.

Create an area of interest by drawing on the map

• Click the arrow next to the Area of interest button in the Maps filter view and select what shape to use for your area of interest.
• Click the Area of interest button.
• Draw the area on the map.
  • When drawing a circle or rectangle, click and drag the mouse pointer to draw the area. The radius of the circle respective the height and width of the rectangle are shown while drawing. To show the dimensions for an existing area of interest, hover the mouse pointer over the area.
  • When drawing a polygon, click in multiple locations to define the outer limits of the area of interest. When you click again in the first location, the area of interest is created.

Create an area of interest by searching for a location

• Click the search button in the Maps view and search for a location.
• Right-click the area and select Create area of interest for search hit.

Create an area of interest based on imported reference data

To easily find artifacts within areas imported as external reference data, create areas of interest based on the imported shapes.

1. Click the Data layers button and ensure the imported reference data layer is selected.
2. Find the shape to add as an area of interest.
3. Right-click the shape and select Create area of interest.

See Use external reference data in the Maps filter view for more information on importing reference data.

Create an area of interest based on an artifacts cluster

• Right-click a cluster of artifacts on the map and select Create area of interest.

Filter artifacts based on an area of interest

The added area of interest is listed in the Filters pane, under Locations. You can activate and deactivate the specific Area of interest filter by selecting or deselecting it from the Filters pane. When you select a filter, the active filter is highlighted in the Filters pane and active on the map.

You can also activate or deactivate an Area of interest filter by right-clicking the specific area and selecting Activate or Deactivate.

Move an area of interest

1. Right-click the area of interest and select Edit.
2. Drag it to the new position.
3. Click outside of the area of interest to leave the Edit mode.

Change the size or shape of an area of interest

1. Right-click the area of interest and select Edit.
2. Click one of the white squares and drag it to change the size or shape of the area of interest.
3. Click outside of the area of interest to leave the Edit mode.

Rename an area of interest

By default, the area of interest is named AOI #<number>. Right-click the area in the map or in the Filter pane and select Rename to rename the area of interest.

Remove an area of interest

To remove an area of interest, right-click the area of interest and select Remove.

Create a quick view based on an area of interest

An area of interest can be saved as a quick view. Do the following:

1. Click the Save Quick view button at the bottom of the Filters pane.

2. In the Save Quick view dialog, in the Save as text box, write a name for the Quick view.

3. Click Add to save the new Quick view.

The possibility to import external reference data to the Maps filter view can be useful in multiple ways.

XAMN supports import of external data in shapefile format, which is a geospatial vector data format commonly used in geographic information system (GIS) software. In most countries, data sets in this format are available in Open Data Portals.

If your organization manages geographic data in a format that is not supported in XAMN, most formats can be converted to the shapefile format.

Import external reference data

Import external reference data in the shapefile format (.SHP). The imported data is shown as either specific positions or larger areas, and is stored in a database in XAMN.

1. Click the Data layers button and select Import.... The Options window opens.

2. On the Geographic tab, in the External data sources section, click Import....

3. Click Browse..., select the shapefile to use and click Open.

4. Adjust the display name if needed.

5. Select or clear the check boxes to define which data columns to include in the import. The data from the selected columns will show when you hover the data in the map.

6. Click Import.

7. When the import is done, click OK.

8. Reopen any tabs to be able to select the imported reference data.

Note: If a shape feature has multiple geometries, for example two polygon areas that are not connected, they are split during the import and treated as individual areas in XAMN. These areas will have the same feature attributes, like name and other metadata.

Show external reference data in the Maps filter view

1. Import the reference data according to the description above.
2. Click the Data layers button and select the check box for the reference data layer to show.

Adjust the visualization of a layer or external reference data

1. Click the Data layers button and select Visualization settings....
2. Click the Color field to select a new color for a layer.
3. Adjust the Opacity slider to define the level of transparency for a layer.
4. Adjust the Size slider to adjust the size of the areas shown in a layer. This setting is only available for positions, not for areas.
5. Click Save.

Change the order of the layers

Change the order of the reference data layers to, for example, ensure that a layer with specific positions is shown on top of a layer with larger areas.

1. Click the Data layers button and select Visualization settings....

2. Use drag and drop to change the order of the layers in the list. The layer at the top of the list will show on top in the map.