Overview page

When you open a case containing data sources, you will see the XAMN Overview page on the Case tab. The Overview page has three panes; Case info, Data sources, and Investigate. See the respective sections below for more information on what you can find and do in each pane.

If you open an individual extraction file with XAMN, you will see the File tab instead of the Overview page. The File tab contains the same information as the Data sources page. See Manage data sources for more information.

The Case info pane shows detailed information about the selected case, for example when the case was created, the encryption level of the case, and the case ID.

Click the three dots next to Case info to open the More options menu. From this menu, you can:

  • Edit details: Edit the case ID and the name of the case operator and add custom fields. To add a new field, enter the new field name and field data and click Add fields. This is a valuable way to keep track of information related to your case, such as an organization-specific reference number.
  • Edit notes: Add and edit notes. This can be considered as case-spanning examiner notes on things that are important for the investigation.
  • View case log: Open and view the case log. The case log contains basic information on the data sources added and removed from the case.
  • Open folder location: Opens the folder where the file is saved in a File Explorer window.
  • View audit log: If the audit log is enabled, it shows details of the actions performed within the case, for example when the case is opened and closed, the views that are selected, and the notes and tags added.

In the Data sources pane, all .xry files contained in your case are listed. Select the checkboxes for the .xry files to investigate.

Note: When data sources are added to a case you must activate them on the Data sources page in order to view all files on the Overview page.

The Notifications section displays important changes in the set of data sources, such as when a new data source is added but not yet activated or when an activated data source is removed. It will also highlight issues like if a data source for some reason cannot be opened and why, or if the audit log has been removed.

To see extraction details for individual .xry files, click Data sources in the upper right corner of the Case tab. In the Data sources page you can administrate the .xry files contained in your case.

If you would like to perform an integrity check of an XRY file, you must open the Data sources page.

See Manage data sources for more details on how to manage data sources.

The Investigate pane is the starting point for your investigation. This is where you open a work tab to look at the artifacts. The Investigate pane has two tabs; Highlights and All data. On the Highlights tab, system files are hidden to highlight data categories that contain more user-related data, which is more likely to be of interest to the investigation. To see all data, including system files, go to the All data tab. You can set which data tab to use as the default on the General tab in Options.

Note:

  • When you open a work tab from the Highlights tab, the categories containing system files are not included. To see all categories, go back to the Overview page, select All data, and then open a new work tab.

  • When you open a work tab from the All data tab, all categories are available.

In the Investigate pane, select a Quick view, a category, an app, a tag, recognized content, a Project VIC category or a camera model to open a new work tab and view the content of interest. Select the Classic Mode Quick view to open a simplified view with only the most common filters available. For more information on Quick views, see Manage quick views.

Additional sections might be added to the Investigate pane depending on the data available and the Smart processing tools used. For example, if you have run Early hash matching for an extraction in XRY, you'll see the Hash watchlist match section. If you run the Language detection tool in XAMN, you'll see the Identified languages section.

Categories available in Highlights tabs

Related topics