Resource Center


Examiner & Investigator Modes

    As we continue to add analysis features to Magnet IEF, one of the most common pieces of feedback we receive is that we needed a simplified report viewer for sharing IEF results with non-technical stakeholders. These stakeholders may include other investigators, lawyers, analysts, managers, HR, or anyone else who may be involved with an investigation, but not the forensic analysis. This is why we separated IEF Report Viewer into two modes, Examiner and Investigator.

    Examiner Mode works as it has in the past, allowing forensic examiners to search, filter, bookmark, tag, etc. any and all the results recovered by IEF. Not only is this the fully featured report viewer you’re used to, but it now includes some new features as a part of our latest upgrade.

    Investigator Mode simplifies this view to omit some features that might be confusing to non-forensic users. You can still search, filter, bookmark, tag, etc. any results found, however we’ve removed some features such as the Hex Viewer, located at fields, or some more complicated reporting formats such as XML. Our hope is that by omitting some of these more complex features, we allow for better collaboration between technical and non-technical people involved in your investigations.

    An excellent case example is a scenario where the forensic examiner uses IEF to recover and organize some data for a case, but they don’t have insight into the investigation to know what is valuable and what is not. The examiner can then produce a portable case in Examiner Mode and share that case along with the IEF Report Viewer to the lead investigator for the investigation who may not be as technical as the examiner, but knows additional details of the investigation. The lead investigator can use the portable case in Investigator Mode to bookmark and tag any relevant evidence and send that data back to the examiner, without having to deal with any of the technical details around the recovery. The examiner can then validate the relevant data that was recovered by IEF and produce a report based on the collaborated work done by both the examiner and investigator.

    By adding a simplified view of your case data, we hope that collaboration between all stakeholders becomes easier and produces better results. For a more detailed look at Examiner and Investigator Modes, including everything that is included or excluded from each mode, take a look at this helpful resource: Magnet IEF Feature Profile: Examiner & Investigator Modes.

    Subscribe today to hear directly from Magnet Forensics on the latest product updates, industry trends, and company news.

    Start modernizing your digital investigations today.