Open a case or a file

In XAMN, you can open one individual .xry file to review an extraction from one device or you can open a case to review several extractions at once.

Tip: It is strongly recommended to create a case and add extractions to that case to be able to view extracted data from different devices side by side. In addition, cases include the Persons concept and two additional artifact views; the Conversations view and the Connections view. These views visualize how different persons involved in a case have communicated across applications and devices. Using a case also makes audit logging possible. For these reasons, creating a case is recommended also in situations where there is only one data source.

Procedures

Open an individual .xry file

  1. On the start page of XAMN, in the ribbon menu, click Open and select Open file.
  2. Browse to the file to open, select the file, and click Open.

    The File tab opens and it has two panes. The left pane contains information about the .xry file you opened. In the right pane, you'll find ways to dive into the extracted data.

Open an existing case

Cases and extraction files you have opened recently can be found in the Open recent list. To open cases you haven't opened in a while or never have opened before, follow the instruction below.

  1. On the start page of XAMN, in the ribbon menu, click Open and select Open case file.
  2. Browse to the file to open, select the file, and click Open.
  3. If needed, continue by importing additional data sources. See Add additional data sources to a case for more information.

Create a new case from an .xry file

You can create a case from an already opened .xry file.

Note: When creating a case from an opened .xry file, the case you create will contain all files that are located in the same folder as that .xry file. Ensure that you do not store any unrelated data sources in this location.

  1. On the start page of XAMN, in the ribbon menu, click Open and select Open file.
  2. Browse to the file to open, select the file, and click Open.
  3. On the File tab, in the left pane, click Open as case and select to Open in a new case.
  4. Enter a Case ID and Case operator for the case. This information is used for example in reports.
  5. Optionally enter a Password for the case. If you add a password, the case cannot be opened without this password.
  6. Click OK. The new case is opened and the .xry file is added to the case.
  7. To add additional data sources to your case, use the import function. See Add additional data sources to a case for more information.

Create an empty case and add data sources

Creating an empty case and then adding the data sources is useful when you want to investigate data that is not originally in the .xry format.

  1. On the start page of XAMN, in the ribbon menu, click Create a new case.
  2. Enter a Case ID and Case operator for the case. This information is used for example in reports.
  3. Select where to save the case. Click Browse..., browse to the location, and click Select folder. In the selected folder, a new folder is created. The Case ID is used as the name for that folder.
  4. Optionally enter a Password for the case. If you add a password, the case cannot be opened without this password.
  5. Select the checkbox to Use AES-256-bit encryption. This is recommended to safeguard and ensure the privacy of the case.

    Note: To open cases with AES-256 encryption, XAMN Pro is required.

    If AES-256 encryption is not used, the case and data sources are still encrypted, but with 56-bit encryption.

  6. Click OK. The new case is created and opened.
  7. Continue by importing data sources. See Add additional data sources to a case for more information.

Related topics