File Explorer - FAQs
Q1. What is the AIR File Explorer?
The AIR File Explorer is a built-in, cross-platform GUI browser tool within AIR, designed for seamless navigation of full disk or volume image files. It allows users to explore directory structures and efficiently inspect individual file contents in Hex, Text, or Meta Data views.
Q2. What value does File Explorer provide?
A full disk or volume image can provide crucial evidence for digital forensic investigations. Offering investigators easy access to disk image files allows them to navigate investigations swiftly in a unified view, minimizing the need for mastering multiple tools.
Q3. What are the plans for File Explorer?
The initial release of File Explorer (v4.7) introduced the ability to explore raw disk or volume images. Since then, we’ve added support for more image file types, whether they are segmented or single files. Subsequent versions have expanded functionality, adding support for additional disk types for ingestion into AIR and increasing the range of supported remote storage locations from which these image files can be pulled, presented, and mounted within the AIR File Explorer.
Please see this page, AIR File Explorer, for the list of supported disk types and evidence repositories from which they can be mounted.
Our plans include introducing a live version of File Explorer, enabling users to explore files directly on remote assets, and DRONE support.
Q4. Are there any requirements to use AIR’s File Explorer?
Existing customers (installed AIR 4.7 and below) who have yet to do so will need to add the new 'air-tornado' Docker container to support the File Explorer feature - please contact the support team to help do so. Customers who installed AIR v4.7 or later will already have the additional Docker container.
Q5. Why is a new Docker container necessary to support the feature?
Refer to Q15.
Q6. What does RAW, EWF, VMDK, or VHD/X mean when discussing an image file?
Whether acquired by AIR or captured by a third-party tool, a disk image can only be explored in the AIR File Explorer if it's in the RAW(dd), EWF (E01/Ex01), VMDK, VHD/X formats:
RAW format is a bit-by-bit copy of a disk or volume, preserving all data without interpretation or modification. AIR supports the generation of single or segmented RAW image files.
EWF2 is also commonly used in digital forensics to store and compress digital evidence but this format supports additional metadata. AIR supports the generation of single EWF2/Ex01 files but NOT segmented EWF2/Ex01 image files.
VMDK (Virtual Machine Disk) is a file format used to store virtual disk images for VMware virtual machines. It enables the encapsulation of an entire hard drive, including its filesystem and data, into a single file or set of files, facilitating easy management, migration, and backup of virtual environments.
VHD (Virtual Hard Disk): VHD is an older virtual disk format used by Microsoft solutions like Hyper-V. It supports up to 2TB and is ideal for compatibility with legacy systems.
VHDX (Virtual Hard Disk Extended): VHDX is the newer format, supporting disk sizes up to 64TB with improved performance and data protection. Use it for modern systems or larger disks.
NB re VMDK: We support reading RAW (Flat), COWD, and VMDK extent file formats.
For VMDK, we support the following disk types:
monolithicSparse
twoGbMaxExtentSparse
monolithicFlat
twoGbMaxExtentFlat
streamOptimized
However, the "vmfs" and "thin" disk types are not supported.
We can also open and read snapshots, but the actual VMDK files are required as well.
Q7. How does it work?
Clicking the “New Asset” button on the Asset page now offers the option to add “Disk Image”. Users can navigate to an SMB, SFTP, S3, or Azure Blob storage shared location, select the disk image, and add it as a new asset. Once created, users can browse the directory structure in the asset detail screen.
Q8. Where can the image file be saved so AIR can access it?
Currently, the image must be supplied to AIR from an SMB, SFTP, S3 or Azure Blob storage shared location, saved as:
a single or segmented RAW file, OR
a single or segmented E01/Ex01 file OR
a single or segmented VMDK file OR
a single or segmented VHD/VHDX file.
Q9. What are some important details about the displayed information?
The hash of the image file isn't calculated automatically to save time during asset creation. You can calculate the image hash on the Asset Info page as soon as it is created.
Various views for selected files include hex view, text view, and metadata view.
Q10. How long does it take to create an asset from an image file?
Testing has shown that a 107GB full disk image is available for exploration in AIR's File Explorer within 20 to 30 seconds after hitting the “Create Asset” button.
Q11. Can I bookmark items/files in File Explorer?
Not yet, but it's in the pipeline.
Q12. What actions are users able to take from within File Explorer?
Users can calculate the hash of individual or multiple files using the bulk action bar, and download individual files.
Q13. What other enhancements are planned?
In the future, users may have the ability to right-click a file for an option to 'hunt' for that item or other assets attached to the AIR console. Plans also include allowing users to run triage and acquisition tasks on the disk image and add the collections/results to the Investigation Hub.
Q14. Can deleted files be carved from File Explorer?
We present the logical file system, so we can only access existing files and folders; carving unallocated space is not an option currently.
Q15. Are we pulling raw data into the console or just parsed data?
In the AIR console, the latest Docker container, named 'air.tornado', acts as a proxy for commands from the front end. When an action is requested, such as opening a folder, AIR sends the command to the container, which reads the folder data from the disk and provides it to the front end on demand. Recent updates include indexing the entire image for search capabilities without downloading the entire image to the AIR server. The image remains in the evidence repository, so a revoked token from the evidence repository will result in a lost connection.
Last updated