13- Reporting
.pdf
School
Staffordshire**We aren't endorsed by this school
Course
SCHOOL OF 124785
Subject
Computer Science
Date
Jan 1, 2025
Pages
9
Uploaded by SargentMandrillPerson1257
2Module 8Reporting & Exporting8.1 –Exporting & Subsets8.1.2 –Exporting & Save SubsetXAMN contains two distinct functions that carry out two very different tasks. They work closely together but have differences that are worth taking note of and understanding.The functions of Exportand Save Subsetare both very powerful tools within the XAMN suite and being able to make use of their unique functions can not only be useful but also a great time saver.XRY Version: 10.012
3Module 8Reporting & Exporting8.1 –Exporting & Subsets8.1.3 – Differences between the two…ExportA new XRY file that is simply a “subset” of the original XRY file containing only the artifacts you have chosen to include.Can be encrypted and locked for editing.The data extracted and held in the XRY extraction can be copied out in two distinct ways…Export chosen artifacts out to Windows to review in other tools or into newly created reports (e.g. PDF or Excel reports for producing as evidence)XRY FileSave SubsetororXRY Version: 10.04Module 8Reporting & Exporting8.1 –Exporting & Subsets8.1.4 –The Export FunctionThe Export function within XAMN provides you with a step-by-step options selection process to follow to export the data you want.•The Export window shows a form of "breadcrumb" trail outlining the steps involved, each of which provides the user with a list of options to choose from. •At the conclusion of the process, the options are processed, and the export actions are completed.XRY Version: 10.034
5Module 8Reporting & Exporting8.1 –Exporting & Subsets8.1.5 –Artifact Selections1)All –Every artifact in the case is included, regardless of what you currently have filtered or selected.2)Filtered–Only the artifacts currently filtered and present in the artifacts pane within your XAMN tab will be included.3)Selected–Only artifacts that are currently selected within the artifacts pane (so those artifacts with a yellow highlight on them).XRY Version: 10.06Module 8Reporting & Exporting8.1 –Exporting & Subsets8.1.6 –The Save Subset FunctionSo, what does Save Subset do...?•Creates an entirely new XRY file which is a•Replica of the original•Only contains artifacts chosen by the user. •Called “Save Subset” as you can savea subsetof the original content.•Creates new copies of ALLextraction files loaded within an XAMN tab.XRY Version: 10.056
Have an idea of items to include in your own forensic examination reportXAMN Viewer can be used by others to view the XRY filesCreate reports using XAMNSave an XRY Subset FileBy the end of this session you will be able toTaking steps to document your examinationDevelop a final report summarizing your actions and findingsFormalize your strategy:Review the case detailsEvidence receivedKeywords/Hash values78
Examiner, Case, Device ID Case SummaryDevice/Evidence InfoOwner/User/PossessionLegal AuthorityForensic Machine/Tablet UsedXRY/XAMN versions/cables usedFindingsExamination SummaryGlossaryThere is a sample examiner device report in the training manual and on the Customer portal Documents-OtherXRY Options Custom FieldsAdd the fields you needCase Data NotesIndividual Exhibit Notes-Cable included-Case on device-Device condition-Items missing or in wrong910
Aside from the XAMN Case Info and Exhibit data fields and notes.Examiners can Tag and use Examiner notes.Multiple items can be selected and given the same examiner note along with a timestamp.1112
Export all the dataExport Filtered data i.e., an Evidence ReportCreate an XRY Subset XAMN can be downloaded or distributed as an unlicensed viewer to view the XRY Extraction Files. 1314
1516
Data important to the case can be filtered, tagged and sent to a separate forensic examination report.The XAMN Viewer can be used to review the data in either an XRY Extraction File, XRY Case File, or an XRY Subset. XAMN offers many export/reporting optionsSaved an XRY Subset File1718