In the Case group, you can open and close cases and save any changes, like added notes or tags. This is also where you can import .xry files or other types of data, like warrant returns or vehicle data, and add them to your case.

When you click Open, a list of the most recently opened cases and files are shown in the dropdown menu. If no case or file is open, the list of recent cases and files is displayed on the main screen for easy access.

In the Time zone group, you can adjust timestamps to see time data normalized to any time zone.

In the Bookmarks group you can select a data segment of special interest and bookmark it to quickly find and select the data segment later.

View artifact properties and bookmarks in a compressed list

1. In the file and artifact properties pane, click the settings button .
2. Select the Condensed option button, and then click OK.

View artifact properties and bookmarks horizontally aligned to their data segments in the Hex pane

1. In the file and artifacts properties pane, click the settings button .
2. Select the Aligned option button, and then click OK.

For more information, see Bookmarks.

In the Find group you can find specified data segments. For more information, see Search.

Click Options to access the XAMN application settings. The settings control for example:

• Appearance settings, like theme and language.
• Geographic settings, like offline maps and external geographical data sources.
• Organization info to include in reports.
• What to log in the Audit log.
• Connection to XEC Director.

To run and manage scripts, click on the Scripts button . The scripts can be used to automate tasks like searches, selections, or even creation of new artifacts from databases within the case or externally.

For more information, see Compare Mode.

Take a screenshot or a video of your screen with the Capture feature. Click Capture and select Video or Screenshot.

To minimize or maximize the file browser, click in the upper right.

In the file browser

• To navigate through the file tree, use the left and right buttons.
• To display the latest files viewed, click the previous button .
• To open files in a new tab, right-click the file and select Open in new tab.
• To export all files, right-click the folder and select Export all files.

Tip: In the File and artifact properties pane, you see an overview of all files in the selected folder, and its subfolders. To see the hex data in a preview mode, with yellow background, click the file. To open the file, and to work with it, double-click the file.

To set a memory address in the Hex pane

1. Click the Go to address button and select an memory address. Click ok. The address search will be saved.
2. To choose hexadecimal or decimal as standard, check the related check box.

To select and highlight the next artifact property, in a horizontally aligned property list, click the next button.

To select the previous artifact property, in a horizontally aligned property list, click the previous button.

Tip: To collapse and expand different panes in the Hex viewer tab, click the collapse button and the expand button.

Tip: The number next to an artifact property shows how many more identical properties there are in different artifacts.

You can open multiple Hex viewer tabs to easily analyze and compare different findings.