Filter by accessible and inaccessible files

Use the Content types filter to discover which files are accessible to users and which ones aren't. The filter option only appears if there are inaccessible files in the evidence that you are examining.

The Content types filter is available in the Artifacts explorer.

In AXIOM Examine, on the Filter bar, click Content types.
Select the Items accessible by users or Items inaccessible by users option.

Inaccessible files are files recovered from the following locations:

pagefile.sys
hiberfil.sys
swapfile.sys
$Mft
$MftMirr
$Logfile
$Volume

$AttrDef
$Bitmap
$Boot
$BadClus
$Secure
$Upcase
$Extend

Unallocated space
Unpartitioned space
File slack
Uninitialized file area
Orphaned files
Overwritten files
Deleted files

Files recovered from all other locations are considered accessible.