If the selected artifact has relations to other artifacts, these are shown in the artifact navigator at the top of the Details pane.

Examples of relations:

• Similar pictures (based on PhotoDNA)
• Identical files
• Attachments to an email or message
• A picture on a contact

When an artifact is selected in the Artifacts pane it's shown to the left in the artifact navigator, and all related artifacts are displayed to the right. If you choose to drill down and look at the relations for one of the related artifacts, then that artifact is shown in the position to the left, and its related artifacts to the right.

View related artifacts

• Click one of the related artifacts to show its details in the Details pane. The artifact category and the type of relation is shown in the gray field below the row of related artifacts.
• To show all relations for an artifact related to the artifact selected in the Artifacts pane, select the related artifact to show relations for and click the Show relations button. This artifact will now be shown in the position furthest to the left, and its relations to the right of it.
• To go back to show relations for the artifact you reviewed previously, click Back.

Tag all related artifacts

• Click More options at the top right corner of the artifact navigator, select Tags and then select the tag to apply.
  

  The tag is applied to all related artifacts shown in the artifact navigator.

Grade all related pictures and videos

• Click More options at the top right corner of the artifact navigator, select Project VIC and then select the grade to apply.
  

  The grade is applied to all related artifacts shown in the artifact navigator.

Artifact properties are grouped and displayed in order of relevance for an investigator. If the artifact is connected to an app, this is shown at the top of the properties section. Some apps store data in the common operating system databases, for example Apple's Biome. In these cases, the artifacts are shown as connected to two apps: the app where the data is used and the app where the data is stored.

Some properties are hidden under a blue Show technical details button. Click this to see all artifact properties. If you want the Details pane to always display all properties, select the Always show technical details check box on the Details pane page in Options.

Artifact property filter

1. In the Details pane, right-click a property and select Create filter.
2. Select to open the filter In this tab or In a new tab. The filter is added to the Filters pane and is automatically applied.

   The created filter contains all values available in the case for that property.

Note: Some artifact property filters cannot be edited.

Note: Some artifact property filters cannot be saved in Quick views.

Note: If you create a filter from a property that is related to an attachment inside an artifact, you might not automatically see the filter results. To see the filter results, ensure that the attachment category is selected in the Category filter. If the artifact is related to the "Messages" category, the attachment category is frequently "File".

Artifact Property Actions

You can right-click an artifact property to see a list of available actions. What actions are available in the right-click menu depend on what property is selected. Below are some examples.

• To copy selected artifact data, in the right-click menu, use Copy.
• To view artifact data in hexadecimal format and how it relates to memory addresses, use Examine in Source mode.
• To view artifact data in hexadecimal format and how it relates to memory addresses, use Examine in Hex viewer
• To translate a text to a different language, select the text property and use Translate.
• To further investigate artifact data that is decoded from an extracted file or SQL database, open the source file using Open source file.

The Details pane uses a number of viewers to display different types of data.

See File content viewers for more detailed information about each viewer.

Each viewer provides a set of actions. Click the three dots button in the top right corner to see available actions for the specific viewer.

• To save a file that is contained in an artifact, use Save to file.
• To open a file in your computer's default program, use Launch in default app.
• To open a file and select which program to open the file in, use Launch in app of your choice.
• To quickly find similar pictures, use Show similar pictures. For this option, finding similar pictures is done based on dHash.
• For artifacts that contain geodata, to open browser and see the location in Google Maps, use Open in Google maps.
• To decode QR data, use the inbuilt QR Decoder.
• To open a Viewer in a new tab, use Show in new tab.
• Choose to keep specific viewers expanded using a viewer setting. Each viewer has its own setting that controls if the viewer shall be expanded or collapsed upon changing artifact.

Note: To keep some viewers expanded will impact Details pane performance.

Use the screenshot button when you want to save a screenshot of a picture or copy it to the clipboard.

For unrecognized files where XAMN cannot display the content, use the available actions to investigate the file further in another tool.

Note: To see geodata as map positions, you must have an internet connection or a license for the optional Offline Maps functionality.

Note: If you cannot play video files in the Details pane, you probably do not have the necessary video codec installed on your computer. Download and install the K-Lite Codec Pack, available at https://www.codecguide.com.

When an artifact is found in a data source generated by XRY Photon, the source data is the screenshots that were taken during the extraction.

The screenshots are available from a Photon sources link on top of the Details pane. The link opens up a Photon screenshot in a Picture Viewer. Use the Save button on bottom right in the Picture Viewer to save the picture to your computer.

Photon sources are also available from the Additional Exhibit Data category in the Categories filter.

If audit logging is enabled in Options, performed actions related to the selected artifact are listed in the Audit information section of the Details pane.

The audit information included is the time of the action, what the action was, and the username of the user who performed the action. For more details about an action, right-click the action and select Show in Audit log. The full audit log will open, with the selected action highlighted.

Note: Actions that were performed for more than one artifact at the same time are not shown in the Audit information section for the individual artifacts. For example, if you select 20 artifacts and then add a tag to them, that is not shown in the Audit information section in the Details pane. It is included in the Audit log as one action performed on 20 artifacts, but without details on which artifacts that were tagged.

If you have connected your project to a Project VIC database, the picture and video artifacts in the case will have a VIC information section in the Details pane. This section contains information on the Project VIC category, region, and any pre-categorization. If there are any manually set properties for the artifact, those are also shown here.

Manually set Project VIC properties

1. Click the edit button in the VIC information section of the Details pane.
2. Select a category in the list.
3. Set any other Project VIC properties, for example if the victim or offender is identified or not.
4. Enter any Tags based on your organization's process. Separate each tag with a comma.
5. Enter any Series based on your organization's process. Separate each series with a comma.
6. Enter your Comments.
7. Click Save.

Add your own notes to an artifact by typing your note in the Examiner notes text box on the bottom of the Details pane.

It is also possible to add examiner notes in the Artifact pane. Select one or more artifacts, right-click and select Add Examiner notes.

• Examiner notes are saved when you save the file or case.
• Examiner notes can not be saved if the XRY file is locked or in Read-Only mode.

Add an Examiner note to multiple artifacts

1. Activate the Select multiple button on the top of the artifacts pane.
2. Select multiple artifacts.
3. Right-click on the artifacts and choose Add Examiner notes.
4. Type a note in the box.
5. Optional: Select the Add a timestamp check box to add a timestamp to the notes.
6. Click OK.

The note will be added to your artifact and is displayed in the Details pane. If an artifact already has an examiner note, the new note will be added after the previous one.

Your Examiner notes are included by default when you generate a report.

XAMN Pro license required.

If you have a case open, you can view the full conversation from a single message artifact. In the Details pane, click Open conversation to view the full conversation in the Conversation view.