About the Hex viewer

The XAMN Hex viewer is a powerful hex analyzer and data reconstruction tool. Only artifacts with known properties can be exported from XAMN and included in forensic reports. With the Hex viewer you can manually select data segments in files and define them as new artifacts and artifact properties. This process is known as file carving.

Note: Any artifacts and artifact properties that have been manually defined are shown with a notification in XAMN, in reports, and in exported files.

XAMN Hex viewer features include:

• Automatic file carving (GIF/JPG/PNG)
• Advanced manual file carving
• File header detection
• Advanced data formatting
• Data segment bookmarks
• Advanced data segment search

Open the Hex viewer in XAMN

1. In a work tab, in the view pane, select an artifact.
2. In the Details pane, right-click an artifact property.
3. In the right-click menu, select Examine in Hex viewer.

Note: If the property you have selected in the Details pane is a known property, the Hex viewer will automatically browse to the file, and highlight the property data segment in the Hex pane.

Tip: In the pane that shows settings for selected objects, you can prevent the segment endpoints from accidentally changing by using the lock button .

Related topics

• For information about how to find relevant information in unrecognized data, see Search.

• For information about how to bookmark specified data segments, see Bookmarks.

• For information about how to define data segments as a new artifact properties, see New artifacts and artifact properties

• For information about how to give new artifact properties a data format and how to make new data formats, see Artifact Property Data Formats.

• For information about how to define new artifacts that contain new artifact properties, see User-defined artifacts and artifact properties.