File Explorer - FAQs

Q1. What is the AIR File Explorer?

The AIR File Explorer is an integrated cross-platform GUI tool within AIR, crafted for seamless navigation of full disk or volume image files. It enables users to explore directory structures, facilitating efficient inspection of individual file contents.

Q2. What value does File Explorer provide?

A full disk image can provide crucial evidence for digital forensic investigations. Offering investigators easy access to disk image files allows them to navigate investigations swiftly in a unified view, minimizing the need for mastering multiple tools.

Q3. What are the plans for File Explorer and what are we releasing for it in 4.17?

AIR version 4.7, was the initial phase with the capability to explore raw disk or volume images. Version 4.17 adds EWF capability to File Explorer so you can now explore EWF image file be they segmented or single files. Our plans involve introducing a live version of File Explorer, enabling users to explore files directly on remote assets.

Q4. Are there any requirements to use AIR’s File Explorer?

Existing customers (installed AIR 4.7 and below) who have yet to do so will need to add the new 'air-tornado' Docker container to support the File Explorer feature - please contact the support team to help do so. Customers you installed 4.7 or later will already have the additional Docker container.

Q5. Why is a new Docker container necessary to support the feature?

Refer to Q15.

Q6. What does "RAW" or "EWF" mean when talking about an image file?

Whether acquired by AIR or captured by a third-party tool, a disk image can only be explored in the AIR File Explorer if it's in the RAW or EFW2 format:

  • RAW format is a bit-by-bit copy of a disk or volume, preserving all data without interpretation or modification. AIR supports the generation of single or segmented RAW image files.

  • EWF2 is also commonly used in digital forensics to store and compress digital evidence but this format supports additional metadata. AIR supports the generation of single EWF2/Ex01 files but NOT segmented EWF2/Ex01 image files.

Q7. How does it work?

Clicking the “New Asset” button on the Asset page now offers the option to add “Disk Image”. Users can navigate to an SMB or SFTP shared location, select the disk image, and add it as a new asset. Once created, users can browse the directory structure in the asset detail screen.

Q8. Where can the image file be saved so AIR can access it?

Currently, the image must be supplied to AIR from an SMB or SFTP shared location, saved as a single contiguous RAW file, OR as either a segmented or single E01/Ex01 file.

Q9. What are some important details about the displayed information?

The hash of the image file isn't calculated automatically to save time during asset creation. Soon, an option to calculate the hash when required will be available. Various views for selected files include hex view, text view, and metadata view.

Q10. How long does it take to create an asset from an image file?

Testing has shown that a 107GB full disk image is available for exploration within 20 to 30 seconds after hitting the “Create Asset” button.

Q11. Can I bookmark items/files in File Explorer?

Not yet, but it's in the pipeline.

Q12. What actions are users able to take from within File Explorer?

Users can calculate the hash of individual or multiple files using the bulk action bar, and download individual files.

Q13. What other enhancements are planned?

In the future, users may have the ability to right-click a file for an option to 'hunt' for that item or other assets attached to the AIR console. Plans also include allowing users to run triage and acquisition tasks on the disk image and add the collections/results to the Investigation Hub.

Q14. Can deleted files be carved from File Explorer?

We present the logical file system, so we can only access existing files and folders; carving unallocated space is not an option currently.

Q15. Are we pulling raw data into the console or just parsed data?

In the AIR console, the latest Docker container, named 'air.tornado', acts as a proxy for commands from the front end. When an action is requested, such as opening a folder, AIR sends the command to the container, which reads the folder data from the disk and provides it to the front end on demand. Recent updates include indexing the entire image for search capabilities without downloading the entire image to the AIR server. The image remains in the evidence repository, so a revoked token from the evidence repository will result in a lost connection.

Last updated