To open the Options window, in the ribbon click Options, and select the General tab.

Theme

The theme setting controls the color theme of XAMN. By default it is set to System default, which means XAMN is shown in either light mode or dark mode depending on the Windows theme setting.

Select to use the system default setting or to always use the dark or light mode in XAMN.

Open recent

• To change the number of recently opened files shown on the start page, type a number in the number box. You can also use the arrow buttons.
• To clear the list of recently opened files in the Open Recent pane, click the Clear button.

Language

• To change the language for the categories and artifact properties in the program and in exported files, select a language in the drop down list.
• To change the user interface language, select a language in the drop down list.

Note: You must restart XAMN for the changes to take effect.

Encryption

In the Encryption section, select which universal encryption to use when creating new cases and when saving a subset of a case.

Note: Files that are encrypted using AES-256 cannot be opened in XAMN Viewer. XAMN Pro is required.

Time zone

To show timestamps only in the original time zone, clear the Show in local time check box.

Known data

To use the known data functionality, you must download an MSAB hash file from the MSAB Customer Portal. Next, click Browse to choose an MSAB hash file, and then click Open.

Display settings

If you select the Remember display settings between sessions check box, XAMN keeps the settings for excluding artifacts and grouping identical or similar artifacts between sessions.

Case review tracking

Select the Enable case review tracking check box to visualize if artifacts in a case have been viewed or not. The case review tracking is enabled by default.

The artifacts that have not been viewed are indicated with a blue vertical line on the left side of the artifact in the List, Column, Gallery, and Conversation views in the Artifacts pane.

The case review tracking also makes it possible to show or hide artifacts based on if they have been viewed.

See Track the case review progress for more information on how it is used.

Filters

• To automatically expand categories, select the Automatically expand categories check box.
• To disable the dynamic artifact count, select the Disable dynamic artifact count check box.

XAMN dialogs

To clear all do not show again settings and show all hidden dialogs again, click Clear.

Case data history

You can clear the case and exhibit data history, click Clear.

Gallery view page settings

Select how to define the number of pictures to display per page. Either use automatic calculation based on the window size or specify a number of pictures per page.

Tab settings

The tab settings define two things:

• The tab to show in the Case page Investigate pane when you open a new case.
• The type of work tab to use when opening a new tab within a case.

This setting does not affect opening tabs by selecting options within the Investigate pane.

1. Select the tab to use, Highlights or All data. See Investigate for more information on what a Highlights tab is and the artifact categories included.
2. Click OK.

Note: The Highlights tab is the default setting for XAMN Viewer. The All data tab is the default setting for XAMN Pro.

Color settings

Set the colors for the deleted artifacts count, shown within parenthesis: red or black.

At start

Select the check box if you want to be prompted to update the software when a new version is available.

In the Options window, under Details Pane, you can change options for how text and images are shown in Details pane.

To open the Options window, in the ribbon, click Options.

Note: You must open a new extraction file for the changes to take effect.

Font options

• To change the font, select a font in the Font box.
• To change the font size, type a font size in the Size box. You can also use the arrow buttons.
• To use the default font and font size, click Restore Default.
• Choose to show property labels aligned to the left or the right in the Details pane.
• Choose to show property labels or the actual artifact data in bold font.

Picture options

• To hide image file metadata, select the Do not display full metadata check box.
• To prevent animated gif files from being played automatically, select the Prevent animated gif files from being played automatically check box.
• To limit the maximum image size, click the Small, Medium, or Large option button.

Geographic viewer

To disable the geographic viewer of artifacts that contain geodata, select the Disable the Geographic Viewer check box.

Note: If you disable the Geographic Viewer, you can still click to open the artifact geodata location in Google Maps.

Technical details

To always display technical details, select the check box.

In the Options window, under Geographic, you can change the display settings for geographic information in XAMN maps. You can also enable the usage of XAMN Offline Maps.

Note: You must open a new tab for the changes to take effect.

• Select your favorite display format for coordinates under Coordinates display format.
• If you have purchased an XAMN Offline Maps License, and downloaded the XAMN map pack from the Customer Portal, you can enable the offline maps usage under Offline maps. For more information about how to use offline maps, see Offline maps.
• If you want to use a new offline map pack, you can clear the Map cache under Map Cache.
• You can change distance units to Kilometers or Miles under Locations.

Import external reference data

1. On the Geographic tab, in the External data sources section, click Import....

2. Click Browse..., select the shapefile to use and click Open.

3. Adjust the display name if needed.

4. Select or clear the check boxes to define which data columns to include in the import. The data from the selected columns will show when you hover the data in the map.

5. Click Import.

6. When the import is done, click OK.

7. Reopen any tabs to be able to select the imported reference data.

The information and image that are added under My organization can be used in reports and exports generated in XAMN.

Add a logo and enter information about your organization in the appropriate fields.

The information you enter can then be selected to be included in reports and exports by default. Go to the Export page in Options to include the information or image in for example the header or footer.

In the Report Builder, you can manually add, remove, or move the information or image. To do so, click More options in the Report Builder's Report pane and select Edit header/footer.

Any fields that are left empty are not included in the report or export, even if they are selected.

Note: You must restart XAMN for the changes to take effect.

In the Options window, under Export, you can customize the folder structure for your exported documents and files.

You can also customize the report layout.

Folder structure

To save report/export output as sub-folders in the Export directory, select Sub-folder structure.

The picture below shows an Export directory with sub-folder structure when a user had selected Excel, PDF and File output formats.

To save report/export output in the top-level in the "Export" directory, not as sub-folders, select Flat folder structure.

The picture below shows an Export directory with flat folder structure when a user had selected Excel, PDF and File output formats.

Linked files

In the File folder, the media files can be stored in two alternative ways. To save the files with the original path taken from the extracted device, select Reflect original path. To save the files with a shorter path, select Short path.

The Linked files option affects report layouts with the following output formats: Word, PDF, Excel, HTML, OpenDocumentText, and OpenDocumentSpreadsheet.

Note: When the File output format is also selected in the same export procedure, the Reflect original path option from File options in the Export wizard is used instead of the setting in Options.

Report Layout Customization

For PDF, Word and ODT reports, it is possible to customize the report pages and the cover page by choosing relevant information from drop-down menus.

Name	Where it is shown
Page layout - Header	Select information to include in the header on each report page.
Page layout - Footer	Select information to include in the footer on each report page .
First page layout - Header	Select information to include in the cover page header.
First page layout - Content	Select content on the cover page.
First page layout - Footer	Select information to include in the cover page footer.

Note: If you choose to include any organization or department information, ensure that the required information is entered on the My organization page in Options.

XAMN Pro license required.

Project VIC is a hash data sharing initiative that permits automatic scanning and detection of CSAM image and video content, without having to expose visual content to forensic examiners. Usually, hash data comes from an official source (official type), but the Project VIC function in XAMN also supports management of local hash sets (local type).

On the Project VIC page in Options, you'll find all settings related to Project VIC.

When the settings are done and a database is added, click the Project VIC button on the ribbon menu to run the hash data scan to add VIC properties to artifacts that match hash data in the Project VIC hash database.

For more information about Project VIC and how to run the Project VIC hash data scan, see Project VIC.

Profile

Different regional law enforcement organizations use different categories for the Project VIC hash data. Select a regional profile from the Profile drop-down menu.

Supported regional profiles include

• US Standard
• UK Standard
• CA Standard (English)
• CA Standard (Français)
• AU Standard

List of databases

XAMN supports two ways to import a Project VIC database, Create new and Add existing.

To add an existing Project VIC hash database, click Add existing and browse to the database.

Create a new Project VIC hash database

1. In the Options window, on the Project VIC tab, click Create new.
2. Next, click Browse to import the hash set(s) from one or more JSON files.
3. In the Settings, choose the Type of the database. You can choose between an Official or Local. For more information about the Type, see Set Type.
   

4. Type the name of the source in the Source text box.

   Mandatory, if you selected the Type Official.
   

5. Under Location, type the .db name in the text box.
6. Browse to the location where you want to save the created database in.
7. Optionally, check the Save at default location check box to always save databases in this default location.

You can create more than one database, and also place the databases in other locations than C\:

Set Type

Under Change Type, choose between the following Change Type options:

• Official, if you are using an official regional database, for example Project USA. This means that matches are assessed as pre-categorized. For official databases, a source must be specified in the Source text box below.
• Local, if you are creating a database from unofficial sources, such as from storing hashes before adding them to the official database, or from personal gradings. Here, matches are not assessed as pre-categorized.

For more examples, see Project VIC.

Click save to return to the Project VIC Options.

You can always change the type later on.

For each Project VIC database, there are four blue action links, described in Project VIC.

Default location

Under Default location, browse to and set the default location to save the database in.

Categories

Under Categories, select the checkboxes for the categories for which you want to hide any matching pictures. This prevents users from being exposed to known child sexual abuse material. The hidden pictures are replaced with the Project VIC logo against a background of the color for the respective Project VIC category.

Incomplete rows

The audit log in XAMN logs user actions which are performed as part of an investigation, for example opening or closing a case, viewing or tagging an artifact, and creating a report. The log makes it possible to determine who did what, from what part of the system, and at what time. A separate log file is created for each case and stored in the case folder. The file extension for the log file is .xryaudit.

Under Audit log in the Options window, you can select to View audit log. The audit log is also available on the Overview tab. In the Case info section, click More options and select View audit log.

You can select the level of logging for this installation of XAMN.

• Enable full logging—Logs all relevant user actions.
• Enable partial logging (Important only)—Logs the most important user actions. This includes for example when an artifact is viewed by a user, exports and other actions resulting in artifact data leaving XAMN, and changes of settings.
• Disable logging—No user actions are logged. This is the default setting.

Note: If your installation of XAMN is connected to and managed from XEC, the user actions are logged in XEC and the local audit logging is disabled.

From time to time, MSAB will make it possible for you to preview and try out new features before they are officially released. Select the Enable MSAB Early Access checkbox to unlock these features.

Note: These features might have limited technical support and documentation.

Connect XAMN Pro to the MSAB UNIFY server to work with centralized evidence in UNIFY Collaborate, where multiple investigators can work simultaneously on the same cases.

Connect an XAMN Pro client to the MSAB UNIFY server

1. If your MSAB UNIFY server is set up using MSAB UNIFY's auto-generated self-signed certificate, first import the certificate. See the UNIFY Installation and Operations Guide for more information.
2. In XAMN Pro, click Options in the ribbon menu.
3. Select the MSAB UNIFY page.
4. Select the Connect XAMN to MSAB UNIFY checkbox.

   

5. Enter the Hostname and, if needed, the Port.
6. Click Check connection to verify that the XAMN Pro client is connected to the MSAB UNIFY server.

7. Restart XAMN Pro for the changes to take effect. When XAMN Pro starts again, you are prompted to log in with your username and password.

   

XAMN Pro license required.

When XAMN is connected to an XEC network, you can now enable or disable the XEC connection in XAMN Options.

Connect XAMN to XEC Director

1. In the Options window, on the XEC tab, select the Enable XEC check box.
2. Enter the IP address or DNS name.
3. Select the Protocol from the dropdown.
4. Enter the Port.
5. Click Test the connection to verify that it works.
6. Optionally, enter a client system alias. If no alias is added when joining the client system, the Windows Name is used as the default value.
7. When you are connected to XEC, you will see an XEC logo on the Start tab of XAMN.

Tip: Updated versions of Project VIC databases, Word lists, and predefined Quick views can be automatically downloaded to XAMN from the XEC server. This makes it easy to ensure the latest version is always used. When a new version is uploaded to the XEC server, it's automatically detected and downloaded in the background, even if XAMN is not running.

For more information about XEC, see the XEC Director User Guide available on the MSAB Customer Portal.