File Explorer - FAQs

Q1. What is the AIR File Explorer?

The AIR File Explorer is an integrated cross-platform GUI tool within AIR, crafted for seamless navigation of full disk or volume image files. It enables users to explore directory structures, facilitating efficient inspection of individual file contents.

Q2. What value does File Explorer provide?

A full disk image is crucial evidence for digital forensic investigations. Offering investigators easy access to disk image files allows them to navigate investigations swiftly in a unified view, minimizing the need for mastering multiple tools.

Q3. What are the plans for File Explorer and what are we releasing for it in 4.7?

In the current 4.7 version, we're launching the initial phase with the capability to explore raw disk or volume images. The File Explorer feature is currently available by request only. Our future plans involve introducing a live version of File Explorer, enabling users to explore files directly on remote assets.

Q4. Are there any requirements to use AIR’s File Explorer?

Customers will need to add a new Docker container to support the File Explorer feature. For customers updating from an older version, please contact the installation support team.

Q5. Why is a new Docker container necessary to support the feature?

Refer to Q15.

Q6. What does "raw" mean when talking about an image?

Whether acquired by AIR or captured by a third-party tool, a disk image can only be explored in AIR if it's in the RAW format. RAW format entails a bit-by-bit copy of a storage device, preserving all data without interpretation or modification.

Q7. How does it work?

Clicking the “New Asset” button on the Asset page now offers the option to add “Disk Image”. Users can navigate to an SMB or SFTP shared location, select the disk image, and add it as a new asset. Once created, users can browse the directory structure in the asset detail screen.

Q8. Where can the image file be saved so AIR can access it?

Currently, the image must be supplied to AIR from an SMB or SFTP shared location, saved as a single contiguous RAW file. Segmented files are not supported.

Q9. What are some important details about the displayed information?

The hash of the image file isn't calculated automatically to save time during asset creation. Soon, an option to calculate the hash when required will be available. Various views for selected files include hex view, text view, and metadata view.

Q10. How long does it take to create an asset from an image file? Testing has shown that a 107GB full disk image is available for exploration within 20 to 30 seconds after hitting the “Create Asset” button.

Q11. Can I bookmark items/files in File Explorer? Not yet, but it's in the pipeline.

Q12. What actions are users able to take from within File Explorer? Users can calculate the hash of individual or multiple files using the bulk action bar, and download individual files.

Q13. What other enhancements are planned? In the future, users may have the ability to right-click a file for an option to 'hunt' for that item or other assets attached to the AIR console. Plans also include allowing users to run triage and acquisition tasks on the disk image and add the collections/results to the Investigation Hub.

Q14. Can deleted files be carved from File Explorer? We present the logical file system, so we can only access existing files and folders; carving unallocated space is not an option currently.

Q15. Are we pulling raw data into the console or just parsed data? In the AIR console, the latest Docker container, named 'air.tornado', acts as a proxy for commands from the front end. When an action is requested, such as opening a folder, AIR sends the command to the container, which reads the folder data from the disk and provides it to the front end on demand. Recent updates include indexing the entire image for search capabilities without downloading the entire image to the AIR server. The image remains in the evidence repository, so a revoked token from the evidence repository will result in a lost connection.