These screen shots cover most of the screens and features. Click on an image to zoom in. Features are labeled by the tier that they are included in, ex: [Bus]iness, [Pro]fessional Investigator & [Adv]anced Researcher. Each tier includes all of the features from the lower tier(s).
The Drives tab, in the upper left corner, provides a list of all detected storage devices. One can start by selecting a device, browsing the path on that device, then clicking on the Start button. These buttons are located in the Details tab, in the upper right corner. [Bus] Displayed here are the currently selected Drive and Search details. On the bottom, the File Types viewer is showing the detailed list of all supported file types, which updates when a new file is selected in the Files tab list. [Pro]
The Searches tab, in the upper left corner, lists prior and current searches. Selecting an entry in this list updates the Details, Charts & Files tabs in the upper right corner. The Charts tab, currently selected here, shows the statistical search results, in Content Types by Files. [Pro]
This Chart displays the File Types (Top 30) quantities. [Pro]
This Chart displays the Platforms quantities. [Pro]
This Chart displays the Storage Methods quantities. [Pro]
The Files Tab, in the upper right corner, lists a filtered subset of the files recorded in the selected search. The filter(s) can be changed, then clicking on the Refresh tool strip button will reapply the filter(s) to the files database. The filters are enabled and disabled from the Filter menu. When a file is selected, from the list, the viewer in the bottom window will update to view that new file. The Metadata viewer is used here. The status bar, at the bottom of the screen, shows how many files have currently been added to the search database, how many filtered for the currently displayed list, and how many files are selected. [Bus][Bus]
The Search tab, in the upper right corner, provides access to the advanced settings used in the next search. [Bus] The Prioritized Folders list accelerates the initial search results, by skipping duplicate and out of scope paths as well as targeting most pertinent paths first. [Pro]
The Case tab, in the upper right corner, provides the data entry fields necessary to maintain proper Chain of Custody. [Pro]
The Actions tab, in the upper right corner, provides access to the advanced search settings that control every aspect of collecting statistics, metadata and files. Triggers specify when to initiate an action on each file found in the search. Actions specify what to record about, or execute on, each file. [Pro][Pro]
The Background viewer provides more information about the currently selected file’s type, in order to further your research or find software to view edit and/or convert the file with. [Bus]
The Hex viewer displays the currently selected file’s raw bytes. [Bus]
The Text viewer has received more of a redesign, to show you exactly where in the file each string was found and what type of string it is. [Bus]
The Multimedia viewer has made a come back from the past. It displays the currently selected file, if it is stored in a file format compatible with MS Windows’ internal image and audio/video file formats libraries. [Bus]
The Web viewer displays the currently selected file, if it is stored in an Internet file format compatible with MS Windows’ Edge browser. In this example, an Adobe Acrobat PDF document is displayed. [Bus]
In this example, a JPEG image is displayed in the Web viewer. [Bus]
The Visual viewer is used to verify the type(s) of contents stored in a file. The 2D Digraph chart is used here. [Pro]
The Bit/Byte Plot, selected in the Visual viewer’s Chart Type drop down list control, proves to be very effective for finding the object boundaries in files. In this example, the file contains compressed data that looks like random data. Note the top header, that contains non-compressed data. Down, towards the center of the file, there is another object that contains non-compressed data (in black). This is an example of what a JPEG image file might look like if someone inserted a Trojan Object that transports hidden communications and evidence. Steganography data could similarly include objects that stand out as obvious as this, but Steganography data is usually encrypted which looks similar to this compressed data. [Pro]
The BVD256 chart, selected in the Visual viewer’s Chart Type drop down list control, exhibits a type of signature that we have developed to identify files that contain no magic ID or other recognizable data for identification. This is the one chart that we provide for the Business version. [Bus]
The Objects Viewer breaks the selected file down to its individual building blocks/objects. In this case, we are looking at the objects inside an Amiga Interchange File Format Image. There is a tree view on the left, and multiple viewer tabs on the right to view the currently selected object with. [Adv]
Some additional screens, and explanations, are available in the Online Manual.