Shortcuts

O
open saved case or forensic image (.dd)

S
save case to a case file


⇧⌘M
analyse current offset as device Master Boot Record (including GPT)

⇧⌘V
analyse current offset as Volume Boot Record

⇧⌘I
analyse current offset as file or folder entry


⌘N

create a new bookmark entry

G
goto offset dialog

H
add current offset to history

M
set current offset as magic one (will move automatically)

B
goto $bitmap position associated with current block

⎇⇧B
goto block associated with current $bitmap position (check the bit selection when not FAT16/FAT32)


B
Find sequence of bytes (hex values)

F
Find sequence of characters (ASCII or UNICODE)

0
Find next non null (0x00) offset

R
Find next NTFS MFT record


1
set moves by BYTEs

2
set moves by SECTORs

3
set moves by BLOCKs (only when volume locked)


A
set moves from Absolute values (start of the device)

C
set moves relatives from Current position

V
set moves relatives from Volume start

M
set moves relatives from Magic offset (adaptative)


when clicking on decoded values, you can combine it with some shortcuts too :


⎇ jump clicked decoded value by bits 

Ctrl jump clicked decoded value from magic offset


tyrhex © Yves Vandermeer  2015-2017   #tyrhex