New artifacts and artifact properties

For information about how to find relevant information in unrecognized data, see Search.

Procedures

Define a new artifact

1. In the file browser, select the file you want to define a new artifact to.
   
2. In the mode list, select Construct property.
3. In the Artifact pane, click the add button .
4. In the Create new artifact dialog box, select an artifact category, and then click OK.

• To browse the artifacts in a selected file, click the previous button and the next button .

 

Define a data segment as a new artifact property in an existing artifact

1. Select the artifact of interest and click the pin to construct mode button .
2. In the mode list, select Construct property.
3. In the property pane, click the add segment button .
4. In the property pane, click the copy segment mode button .
5. In the Hex pane, select the data segment you want to define.
6. In the property pane, click the lock segment mode button .
   
7. In the formats pane, in the list, select a type for the data segment.
8. In the formats pane, select a format for the data segment.
9. In the Artifact pane, click the add property button.
10. In the Add new property window, select a property type for the data segment, and then click OK.

If you switch to another file from the Tree, a Clear button appears. To delete the added ranges and to switch to the other file, click the Clear button.

Tip: You can define fragmented data segments as one artifact property. In Construct property mode, click the add segment button to add one more data segment to the artifact property.

For information about how to give new artifact properties a data format and how to make new data formats, see Artifact Property Data Formats.

Note: Any artifacts and artifact properties that have been manually defined are shown with a notification in XAMN, in reports, and in exported files.