The List view shows all types of artifacts within your case. Depending on the selected artifact type, different properties are shown in the description. The data source is displayed at the top on the left hand side on each artifact.

Click on artifacts to use the quick tagging function, add examiner notes, or to select specific artifacts to export.

Double-click picture thumbnails to show the picture in the Picture viewer. For more information on how to use the Picture viewer, see the Picture viewer section on the File content viewers page.

Sort artifacts in the List view

• When sorting by category, artifacts are shown in the same order as in the category filter. To change the sorting order, click A-Z or Z-A.

• When sorting by time, click Newest or Oldest.

  Note: The Time filter finds artifacts based on any time property. The List View does not always show the same time property that the Time filter is based on. You can see all artifact time properties in the Details pane.

• To change the sorting order when sorting by file size, click Largest or Smallest.

  Note: When sorting by File Size, any files that are attached to artifacts are not counted in the measured size.

• When sorting by File name, artifacts are sorted in alphabetical order based on the name of the file. To change the sorting order, click A-Z or Z-A.
• When sorting by Deleted, the artifacts that are marked for deletion are shown at the top of the list.
• When sorting by Recognized content relevance, artifacts with a high relevance rating for any automatically recognized content are shown at the top of the list.
• When sorting by Attachment count, artifacts with a high number of attachments are shown at the top of the list. To change the sorting order, click Largest or Lowest.

• To hide artifacts with no relevance for the current sorting, click the Hide artifacts with no relevance for the current sorting eye icon .

  Note: For performance reasons, the alpha-channel information in image files is not always shown in the List view. Use the Gallery view to see images in full resolution.

The Column view shows all types of artifacts in a table. Depending on the artifacts currently shown in the Artifacts pane, a mode is applied to display the most relevant columns for those artifacts. If the artifacts are all in the same category, the mode is specifically adapted to that category. If there are artifacts from more than one category, the Mixed categories mode is used.

Example: If you have selected the subcategories Chat and SMS, the Messages mode is used. It contains columns relevant for messages, like Direction, Subject, and Text. If you also add Calls, the Mixed categories mode is used. This mode has a dynamic Key details column, which contains the value from the most relevant property for the each of the different artifact categories.

Tip: Hover the file name of picture or video artifacts for a preview. The preview is shown if thumbnails are available for the picture or video.

The columns in the column view

The most common columns are listed below, in the order that they are placed by the default. This order is chosen to help you answer When something happened, What happened, Who was involved, and Where it happened.

Tip: You can adjust which columns that are shown in each mode and place them in the order that suits you. See the procedures below for information on how.

Icon	Columns	Content
	Review status	If case review tracking is enabled, there is a thin blue line in the first column for artifacts which have not been reviewed.
	Tags	If any tags are applied to an artifact, they are displayed here. Right-click this column area and select a tag to apply it to the selected artifacts.
	Time	The most relevant time property for each category, for example when a chat message was sent or the duration of a video. When sorting based on the Time column in Mixed categories mode, the time property shown might change. When sorting ascending, the time property with the earliest timestamp is shown. When sorting descending, the time property with the latest timestamp is shown.
	Category	The sub-category that the artifact belongs to. The color indicates the main category.
	- Depending on mode -	In Mixed categories mode, the generic Key details column is used. It contains the values from the most relevant property for each of the different artifact categories. In the modes for the specific categories, the included columns are chosen based on the types of data that are relevant for the category.
	Participant	Participants in for example a chat or a call, and if the message or call was to or from that participant. This column is included in the Mixed categories mode and in any mode where participants are relevant. It is only shown if working in a case and requires a XAMN Pro license.
	Owner	The owner of the data source from which the artifact originates. This column is only shown if working in a case and requires a XAMN Pro license.
	Data source	The name of the data source file or, if set, the data source display name.
	App	The app from which this artifact was decoded. Hover the icon to see the name of the app.
	Location	If the artifact contains location data, a map pin icon is shown.
	Attachments	If the artifact has attachments, the number of attachments is shown.
	Examiner notes	If examiner notes have been added to the artifact, the notes icon is shown. Hover the icon to see the note.
	Deleted	If the artifact has been reconstructed based on deleted data, the deleted icon is shown.

 

Select multiple artifacts

• In the Column view, it's possible to drag over several artifacts in the table to select them.

Sort artifacts

• Click on a column header to sort ascending based on that column.
• Click on the column header again to sort descending based on that column.

Note: Some columns are not possible to sort on, such as Key details and Participants.

Add and remove columns

Add or remove columns for the different modes. You can add up to 40 columns for each mode.

1. Click Select columns at the top of the table.
2. On the left side, select the column view mode to edit.
3. On the right side, select the check boxes for the columns to include for the selected mode.
4. Clear the check boxes for the columns to remove.
5. To change the order of the columns, drag the rows to your preferred order.
6. Click OK.

Change the order of the columns

• Drag the column header to a different position.

Export artifacts

The Column view has its own export function. It includes the columns currently visible in the view.

1. Click the Export button at the top of the table.
2. In the Column export dialog window, select which artifacts to export.
   • Select Filtered to export the artifacts currently shown in the table.
   • Select Selected to export only the ones that are currently selected.
3. Select the format to export to.
4. Enter a Name for the export.
5. Select the Location to save the export in.
6. Select any Other options that are applicable.
7. Click Export.

The Gallery view gives you a quick overview of all types of pictures and videos in your case. It shows only picture and video files, no artifacts of any other type. In the Gallery view, you cannot see pictures that are included as attachments inside an artifact.

The Gallery view opens in Pages mode. Use the arrows at the top of the view or the Page Down and Page Up keys to move to the next or previous page. The number of pictures per page is by default controlled by the window size, but can be set to a fixed number of pictures. See Gallery view page settings for more information.

If you prefer, you can instead use the Scroll mode to scroll through all pictures or select Slideshow to automatically run a slide show of the pictures.

You can select what thumbnail size to use; small, medium, or large.

Sorting

In the Gallery view, you can sort artifacts by

• Category
• Time
• File name
• File size
• Deleted
• Recognized content relevance

You can change the sorting order on:

• Categories and file name, click Z to A or A to Z.
• Time, click Newest or Oldest.
• File size, click Largest or Smallest.

Pin the Picture viewer in the Gallery view

1. Double-click a picture in the artifacts pane to open the Picture viewer.
   You can move the Picture viewer to a second screen.
2. Click the Pin button in the Picture viewer. You can now click through pictures and view them in the Picture viewer.

Run slideshow

You can run a slideshow to automatically view pictures in the Gallery view. Do the following:

1. In the drop-down menu, select Slideshow.
2. Click the play icon to start the slideshow. You can modify the speed and pause the slideshow whenever you want to.

To export the pictures from the Gallery view to Excel

1. Mark the relevant pictures, or mark all pictures using Ctrl+A.
2. Click the Report/Export button on the Ribbon and select the output format Excel.

Note: Some mobile apps store images in WebP format. If you cannot see images in WebP format, download and install the WebP codec. Go to Microsoft Store and search for Webp Image Extensions.

The File Tree view shows how artifacts relate to the extracted file structure. It only shows artifacts that contain a file path. The number of files and folders contained within each folder is indicated next to the folder name.

Note: The indication of the number of files and folders in a folder requires that the extraction or a redecoding is done with XRY 11.1 or later.

When a filter is applied, the file and folder structure of the matching artifacts is shown. Artifacts within the folder structure that do not match the filter settings are shown in a light gray color.

One artifact can be in many folders within the same file structure. These artifacts are shown with a black dot adjacent to the file icon. If you click a file with a black dot, every other folder that contains the same file are automatically expanded to show the files.

Any artifacts that were deleted on the extracted device are displayed with a red cross in the file icon.

Export files from the File Tree view

• To export all files in a folder, right-click an .xry file or a folder and select Export all files....
• To export all files to a .zip file, right-click an .xry file or a folder and select Export to Zip....
• To export all files including keystore keys to a .zip files, right-click an .xry file or a folder and select Export to Zip (include Keystore).... This option is only shown if there are security key artifacts in the selected .xry file.

Get an overview of all chat messages from different apps in the Chat View.

The Chat view groups messages by their thread ID, so that conversations can be viewed chronologically and independent of what app was used.

XAMN uses the contact names found in each extraction when grouping messages to chats. The same chat can be shown with different names, depending on which extraction file you are viewing.

• To sort a column, click the column header. Click again to reverse sorting.
• Select a row to look at the different message artifacts on the right side in the Chat view.
• To open the message details window, click a message artifact in the Chat view.
• To add a tag to a chat artifact, right-click a chat artifact, in the Tag list, select the tag you want to use.
• To view a list of all attachments related to a selected conversation, click Conversations at the top of the conversation and select Attachments.

Copy text-based content

Copy text-based content in the view and paste it to other apps, such as Microsoft Word and Excel.

1. Right-click a message artifact.
2. Select Copy.

Tip: Generate a PDF report with relevant chat messages quickly with the PDF report button. The report dialog includes information about how many chat messages will be included in the report.

Note: When you open a case file in XAMN Pro, the Chat view is replaced with the Conversation view.

For a quick overview of extracted data, you can open the Classic Mode in a new tab.

Note: In the Classic Mode you can not use Quick Views, or create a new Quick View.

The Classic Mode shows a simplified overview of the extracted artifacts. For a fast search, only the most common filters are available in this view mode.

• the Categories filter
• the Apps filter
• the Tags filter
• the Text filter

In the Classic Mode, the artifacts in the Artifacts pane always show in Column view first.

Open the Classic Mode

• In the Start tab, under Quick Views, select Classic Mode.

If you want to change to another view, on top of the Artifacts pane, select the view of interest.

To find specific artifacts, use Ctrl+F.

XAMN Pro license required.

The Connection view shows relations between Persons in a case and how these have communicated. To access the Connection view, open your investigation as a case.

Connection view

XAMN Pro license required.

The Conversation view displays all communication artifacts, such as calls, messages, and emails, as conversations. It is split in two parts; the list of conversations to the left and the messages and calls of the selected conversation to the right.

Conversation view