Hex & Text Viewer

Every forensic examiner is familiar with hex and text viewers; they are the cornerstone of the most basic forensic examination. If all your tools and scripts fail or don’t support a given artifact, you can always fall back to a hex viewer to dig into an artifact to uncover any evidence within. New with IEF version 6.6, we are happy to include a Hex and Text Viewer to assist investigators in their examination.

One of IEF’s greatest assets is that it will interpret raw, unstructured data and organize it into meaningful columns for examiners to facilitate their analysis. But quite often, forensic examiners need to dig a little deeper into a particular file of interest to verify their results, which is where a Hex and Text viewer can help. Typically, IEF will pull all of the relevant data you need from a given file or artifact, but sometimes as examiners we want to look at additional data found in a file or look for additional context that might provide further insight into a suspect’s activities. We also want to verify the results IEF has produced and validate our findings. Again, a hex or text viewer can give us that additional validation by presenting the raw data from the image or drive right beside the refined data collected by IEF. Using these features together will help investigators save time.

We have had several customer request to have this feature added to IEF and we’re happy to have included it in this release. To use the hex and text viewers in the IEF Report Viewer, simply select an artifact that has been recovered and in the lower right window you will see three tabs: Details, Hex, and Text (there may be additional tabs depending on the artifact you are looking at). The Details tab will show the traditional refined data that IEF reports and the other two tabs will show the new hex and text data for that particular artifact.

Hex and text viewers will help improve your analysis capabilities within IEF and we hope your investigations will benefit from their use. As always, if you have any questions or feedback, feel free to reach out: jamie.mcquaid@magnetforensics.com.

Here are some related resources you might also be interested in:

1. Resource: Magnet IEF Feature Profile: Hex & Text Viewer
2. Read the next blog in our series: Profiles & Identifiers
3. New to IEF: Request a 30-day trial
4. Current customers: Upgrade to Magnet IEF v6.6

Jamie McQuaid
Forensics Consultant, Magnet Forensics