Viewer Programs & Gallery Options
Here you may activate the separate viewer component and specify the path where it is located (by default: subdirectory "viewer"). The path may be relative to the directory where X-Ways Forensics is executed (.), e.g. ".\viewer" or relative to the parent directory of that directory, e.g. "..\viewer".
If the internal graphics viewing library is used to view pictures, not the viewer component, then optionally the picture viewer window can be closed automatically when a new picture is viewed (if "View multiple pictures simultaneously" is not selected). In that case an auto update option is available that allows to automatically load the next picture into the single picture viewer window as soon as a new picture is selected, one way or the other, for example with a single mouse click or when defining a report table association for the preview picture or when pressing one of the arrow keys. This should be useful mainly when working with multiple monitors, where the picture viewer window remains on the 2nd monitor.
You may select your preferred text editor and HTML viewing program. The HTML viewer program can be e.g. MS Word or NVU, i.e. a program that can be used to further edit the HTML case reports the X-Ways Forensics can create automatically. For merely viewing and printing we recommend Internet Explorer.
You can also specify the path of the .exe file of MPlayer, a program that allows X-Ways Forensics to extract pictures from videos. If mplayer.exe is found in a subdirectory \MPlayer of the installation directory of X-Ways Forensics, it will defined as the video extraction program and as an external viewer program automatically. Relative paths started with .\ or ..\ are supported, where . stands for the directory from which X-Ways Forensics is executed and .. its parent directory. Please note that we cannot provide support for external programs.
You may also specify up to 32 custom viewer programs that can be conveniently invoked from inside X-Ways Forensics via the directory browser context menu. Also you may specify which file types you prefer to view in the program that is associated with their extension in your system, typically file types that the separate viewer component does not support. There is a checkbox labelled "Append type as extension if newly identified" checkbox. Allows to more easily get Windows to run the right program for misnamed files, files without extension etc. The paths of these external viewer programs are defined in a separate file, named Programs.txt, so that it is easy to share a collection of external programs separately, or keep them when taking over all other program settings from someone else. In that text file you may also change absolute paths to relative paths (with . and ..), for programs that are as portable as X-Ways Forensics itself and that you wish take along on a USB stick for analyses of live systems.
An alternative e-mail representation is available in Preview mode (also in the case report). Attachments are not linked directly from this kind of e-mail representation yet in Preview mode. The e-mail headers can optionally be excluded (not Raw mode). Useful with the standard e-mail representation if you would like to see more of the body of the e-mail without scrolling. You can see subject, sender, recipient and dates already in the directory browser, and attachments are listed when exploring the parent .eml file.
Crash-safe text decoding: If enabled, text extraction from certain file types for logical searches and indexing will be done by the viewer component in a separate process, such that if the viewer component crashes or becomes unstable, it does not render the main process (X-Ways Forensics) unstable or cause it to crash. If this option is only half selected, .eml files will not be decoded in the crash-safe manner.
Buffer decoded text for context preview: If enabled, the result of the text extraction from certain file types for logical searches and indexing will be stored by X-Ways Forensics in the volume snapshot for reuse when searching/indexing again, to save time.
Gallery Options
Gallery screen space is utilized very efficiently because thumbnails are not forced to be squares. You can specify your preferred thumbnail width and height separately, in pixels. The specified dimensions will be dynamically adjusted (increased) to best fill the available screen space without partial thumbnails being visible. Since most photos and practically all videos are shot in landscape format, you may want to select width and height accordingly (width larger than height) when viewing pictures. Document thumbnails can often be freely adjusted to any rectangle shape, for example those representing word processing documents or spreadsheets, but not presentations. For most documents other than presentations, portrait format feels like a more natural way of representation. The aspect ratio of the width and height that you specify is displayed in the options dialog to quickly give you a rough idea how compatible the measures will be with ordinary photos, videos or documents.
If the creation of thumbnails for pictures within large (e.g. solid RAR) archives for gallery view is too slow, you may want to disable it. This will also disable search hit context preview for search hits in files in archives.
If large JPEGs contain embedded thumbnails and those have been included already in the volume snapshot or if internal thumbnails have been computed for large pictures, then they can be optionally used as auxiliary thumbnails in the gallery to represent the main picture. The benefit is that they are of course much quicker to load than the main large picture. Also video stills exported from videos can be used as auxiliary thumbnails to represent the video, even all of them dynamically rotating if fully checked.
The gallery has its own "Dbl-click=View instead of Explore" 3-state option, analogously to the directory browser. By default, double-clicking means View in the gallery.
There is an option to view files with a single click in the gallery instead of with a double click. Useful for example if you wish to view certain pictures on a separate monitor, where you do not have to close the view window to see the gallery again, when not viewing all pictures one after the other (for which the Page Up or Dn key is more efficient).
Another option allows to tag a file by clicking anywhere in the thumbnail, not just in the tag square. That makes it more convenient to tag a large number of files, and is more comfortable that selecting multiple files while holding the Ctrl key.
The gallery can optionally show thumbnails for any file type supported by the viewer component, including Office documents, PDF, HTML, e-mails, and pictures that the internal graphics viewing library cannot display (e.g. .emf, .wmf, ...). You can choose between normal and slightly shrunk and strongly shrunk thumbnails of documents. Shrunk thumbnails show much more detail from an original document and the original layout, but at the cost of readability. Larger fonts (in particular captions) in an original document, if not shrunk, are typically readable in the thumbnail and can already give you an idea what kind of document it is even if don't view it, so you can more quickly find the documents that you are looking for. Plus, you will be able to see which files can be nicely viewed with the viewer component at all. It is strongly recommended run X-Ways Forensics with Aero enabled in Windows when using the gallery with the non-picture option.
Files that are larger than 16 MB are not represented with a thumbnail, for performance reasons. X-Ways Forensics tries to abort the generation of a thumbnail if it takes longer than a few seconds. If the generation of a true thumbnail is unsuccessful, you may see a viewer component error message like "Operation cancelled" in tiny red letters in the thumbnail instead. If thumbnail generation is not even attempted by X-Ways Forensics, you will just see the filename and an icon.
Thumbnails of true-color pictures can be optionally converted to grayscale images in the gallery. This option is meant for law enforcement users whose job is to review child pornography photos, to reduce the mental impact and stress level.
The timeout in milliseconds when loading pictures with the internal graphics viewing library is aborted (e.g. corrupt or unsupported or extremely large picture files), is user-definable.