User manual · Chapter 21
Version 6 Interface Reference
Reference the Version 6 Case Manager work areas, case and evidence details, recorded acquisition options, and review navigation.
This section is a quick-reference map of the principal controls shown in the current desktop screens. It complements the procedural chapters; the legal and technical requirements for each operation still apply.
21.1 Case Manager: Work Areas
| UI area | What it shows | Typical operation |
|---|---|---|
| Left navigation rail | Case Manager, About, Settings, Support, Close | Move between the primary application functions. |
| Cases List | Case identity, external reference, open/closed status, date, acquisition count, description | Select a case; create or import cases. |
| Acquisitions in Selected Case | Each acquisition’s ID, type, name, date, duration, size, version, description | Start web/mobile/mail acquisition; select a session to inspect. |
| Evidence in Selected Acquisition | Each item’s ID, type, time, investigator, domain, URL | Select a capture item and review the snapshot and hash data. |
| Right Details Panel | Context for current case, acquisition, or evidence selection | Review record metadata, attachments, hash and blockchain references. |
21.2 Case Details: File Handling and Timestamp Fields
When CASE DETAILS is active, the Attached Files section lists supporting case documents separately from collected evidence. For attachments, the panel can display a submitted Summary SHA-256 hash and a Celo transaction identifier. A copy control and a link control appear beside the transaction in the example. Inspect the complete case package when validating both the attached document and its corresponding integrity record.
The EDIT CASE → FILES view includes the columns FILE, COMMENT, SIZE, and ADDED, plus ADD FILES and per-file operations. File changes are saved immediately, and all attached files are accessible to whoever receives an exported case. This is especially relevant when attachments contain warrants, internal notes, privileged legal material, or identifiers.
21.3 Acquisition Details: Recorded Options
The acquisition details list is the post-acquisition record of which technical options were active. The illustrated example reports True and False for each enabled feature, including Video Recording, System Network Traffic Dump (PCAP), Application Network Traffic Dump (HAR), Chromium Network Audit (NetLog), Realtime Evidence Timestamp, Advanced Resources Collection, Advanced Cookies Collection, and several domain/system options. It also records Automatic Cookie Consent and Content Language.
Compare this record to the original collection plan. If expected data such as a HAR or packet capture was not enabled, document that limitation rather than implying the artifact should exist.
21.4 Evidence Details: Snapshot and Package Records
For the selected screenshot, the interface displays Package File Name and SHA2_256 File Hash, Summary File Name and SHA2_256 File Hash, a blockchain Submitted Hash and transaction reference where available, and a visual Evidence Snapshot. The same evidence ID appears in the evidence list and in filenames. This allows reviewers to cross-reference one visible capture with its packaged forensic records.
21.5 Suggested First Acquisition Checklist
- Select the correct open case and check the internal/external case references.
- Start New Web Acquisition from the acquisitions band.
- Enter a descriptive acquisition name and objective.
- Confirm investigator, user agent, proxy/Tor, content language, and DNS settings.
- Enable the intended PCAPNG, HAR, NetLog, and video outputs, considering their privacy and size implications.
- Decide whether the target warrants WHOIS, system information, certificates, advanced resources, or cookie collection.
- Configure automatic cookie consent only when the protocol requires the interaction.
- Enable realtime timestamping where the engagement requires it, then start collection.
- After closure, select the acquisition and inspect the settings that were actually recorded.
- Inspect evidence snapshots, review reports and logs, validate hashes, and export through a secure handoff process.
21.6 Acquisition Review Tool Navigation
The review workspace contains eleven tabs: SUMMARY, TIMELINE, EVIDENCES, VIDEO, SCREENSHOTS, REPORT, COC, DOWNLOADS, RESOURCES, CERTIFICATES and COOKIES. Chapter 12 provides illustrated workflows for each tab and explains how to distinguish previewed content from the preserved evidence and its integrity records.