Group identical or similar artifacts

XAMN Pro license required.

The display option to group artifacts helps you reduce the number of artifacts to review by grouping identical or similar artifacts within data sources with the same owner.

When performing actions such as grading, tagging, and reviewing for an artifact which is grouped with identical or similar artifacts, all artifacts in the group are affected.

The option to group identical artifacts is based on hash matching. The SHA1 hashes for the artifacts are compared. If the hashes are identical, the artifacts are grouped together.

The option to group similar pictures is based on PhotoDNA analysis of the pictures, which identifies pictures with similar PhotoDNA hashes. If the pictures are assessed to be similar, they are grouped together. Read more about PhotoDNA and how it works.

You can choose to group artifacts by one of the options or by a combination of the two. By default, identical and similar artifacts are not grouped.

Note: Grouping of identical or similar artifacts is done within data sources that have the same owner.

Prerequisites

  • To group similar pictures, the picture artifacts must have PhotoDNA hashes. This requires that the extraction, or a redecoding of an earlier extraction, was done with XRY 10.10 or later.

  • To group similar pictures, PhotoDNA identification must have been run for the case or file. If this is not done but PhotoDNA hashes are available, a notification about running the PhotoDNA identification is shown on the Overview page.

Procedures

Group identical files

  1. In the ribbon menu, click the Group artifacts icon.
  2. From the drop-down menu, select Group identical files.

If your case contains identical files, these are grouped now. The artifacts number at the top of the Artifacts pane decreases.

Group similar pictures

  1. In the ribbon menu, click the Group artifacts icon.
  2. From the drop-down menu, select Group similar pictures.

If your case contains similar pictures, these are grouped now. The artifacts number at the top of the Artifacts pane decreases.

View grouped artifacts

If grouping of identical or similar pictures is enabled, an icon is shown for the grouped artifacts.

In the Artifacts pane, is shown for grouped artifacts in the List view, Column view, and Gallery view. The number indicates the number of artifacts grouped.

In the Details pane, artifacts grouped with the selected artifact are shown in the artifacts navigator at the top of the Details pane.

Related topics