View artifacts on a histogram

You can use Histogram view to build a visual baseline for your case to compare with other cases. The histogram reveals differences between the baseline and another investigation, which can help you build a profile of common investigation types and identify cases that fall outside the norm. For example, if you’re able to build a baseline of the common artifacts that are found in a case and then compare it with others, variations stand out and warrant further analysis.

Open the Histogram view

1. In AXIOM Examine, open the Artifacts explorer.
2. In the View drop-down list, click Histogram view.

Save a histogram baseline

1. In AXIOM Examine, in the Histogram view, click Save as baseline.
2. Provide a name and location for the saved baseline, and then click Save.

AXIOM Examine saves the baseline as a .ini file for comparison with later cases.

Load a histogram baseline

1. In AXIOM Examine, in the Histogram view, click Load baseline.
2. Select the histogram baseline that you want to load, and then click Open.

AXIOM Examine displays the baseline histogram alongside the current case to help visualize discrepancies between the current case and the baseline.