Skip to main content
IPED’s bookmark system allows investigators to tag and organize evidence throughout the analysis process. Bookmarks provide a flexible way to group related items, track investigation progress, and prepare evidence for reporting.

​
Bookmark Basics

​
What are Bookmarks?

Bookmarks (also called tags or labels) are named categories that you assign to evidence items:

Organization

Group related evidence across file system boundaries

Workflow

Track reviewed items and mark items of interest

Collaboration

Share tagged evidence sets with team members

Reporting

Export specific bookmark categories for reports

​
Bookmark Features

  • Multiple Bookmarks: Assign multiple bookmarks to a single item
  • Color Coding: Visual identification with custom colors
  • Comments: Add notes to bookmark categories
  • Keyboard Shortcuts: Fast tagging with hotkeys (0-9, A-Z)
  • Persistent: Saved in case database
  • Searchable: Filter results by bookmark
Bookmarks are saved in the case state files and persist between IPED sessions.

​
Bookmark Manager

Access the Bookmark Manager via:
  • Ctrl+B keyboard shortcut
  • Top menu → Options → Bookmark Manager
  • Right-click bookmark tree → Manage Bookmarks
Bookmark Manager

​
Bookmark Manager Interface

Choose which items to bookmark:
  • Highlighted: Currently selected items in results table
  • Checked: All items marked with checkboxes
Include Duplicates: Optionally include duplicate files (by hash)

​
Creating Bookmarks

​
Method 1: Bookmark Manager

1

Open Bookmark Manager

Press Ctrl+B or click Options → Bookmark Manager
2

Enter Bookmark Name

Type a descriptive name in the text field (max 256 characters)
3

Add Optional Comment

Enter notes in the comments field
4

Click New

Creates the bookmark category with auto-assigned color
5

Select Items to Tag

Choose “Highlighted” or “Checked” and click Add

​
Method 2: Keyboard Shortcuts

1

Create Bookmark with Shortcut

  1. Open Bookmark Manager (Ctrl+B)
  2. Select a bookmark from the list
  3. Press desired key (0-9, A-Z, or key combinations)
  4. Shortcut is assigned to that bookmark
2

Use Shortcut to Tag

With items selected in results table:
  • Press assigned key to add items to bookmark
  • Press Alt+Key to remove items from bookmark
Some keys are reserved:
  • Ctrl+A: Select all (not available)
  • Ctrl+B: Bookmark Manager (not available)
  • Ctrl+C: Copy (not available)
  • Space: Check/uncheck items
  • R, P, F, D: Selection expansion
  • Arrow keys: Navigation

​
Tagging Items

​
Selecting Items to Tag

Highlighted Items (Table Selection):
  1. Click items in results table to select
  2. Hold Ctrl for multi-select
  3. Hold Shift for range select
  4. Open Bookmark Manager
  5. Choose “Highlighted” option
Checked Items (Checkbox):
  1. Check boxes next to items in results table
  2. Use Space key for quick checking
  3. R key to check recursively (all children)
  4. Open Bookmark Manager
  5. Choose “Checked” option
Use checked items for building large evidence sets across multiple searches. Check items as you review, then bookmark them all at once.

​
Adding Items to Bookmarks

  1. Select bookmark from list
  2. Choose Highlighted or Checked
  3. Click Add button
  4. Items added to bookmark immediately

​
Removing Items from Bookmarks

  1. Select bookmark from list
  2. Choose Highlighted or Checked
  3. Click Remove button

​
Including Duplicates

When tagging items, optionally include duplicate files:

​
Automatic Duplicate Detection

Check Add Duplicates in Bookmark Manager:
  • Finds all files with same hash as selected items
  • Two methods: hash-based search or linear scan
  • Optimized algorithm selected automatically
  • Progress dialog shows duplicate search status
Use Cases:
  • Mark all copies of evidence file
  • Track file distribution across devices
  • Identify data duplication patterns
Duplicate detection uses MD5/SHA-1/SHA-256 hashes. Empty files are excluded.

​
Managing Bookmarks

​
Edit Bookmark Properties

1

Select Bookmark

Click bookmark in Bookmark Manager list
2

Click Edit

Opens edit dialog
3

Modify Properties

  • Name: Change bookmark name
  • Color: Select new color from palette
4

Save Changes

Click OK to apply

​
Bookmark Colors

Auto-Assignment

Colors automatically assigned when creating bookmarks

Visual Coding

Different colors help distinguish bookmark categories

Customization

Edit to change color or maintain consistent scheme

​
Bookmark Comments

Add context and notes to bookmark categories:
  1. Select bookmark in Bookmark Manager
  2. Type notes in comments text area
  3. Click Update to save
Comment Uses:
  • Investigation notes
  • Reason for tagging
  • Follow-up actions needed
  • Evidence significance
Use comments to document why items were bookmarked for future reference or team collaboration.

​
Delete Bookmarks

Remove entire bookmark category:
  1. Select bookmark in Bookmark Manager
  2. Click Delete button
  3. Confirm deletion
  4. Bookmark removed (items remain in case)
Deleting a bookmark removes the category but does not delete the files themselves.

​
Bookmarks Tree

View and filter by bookmarks in the navigation panel:
Bookmarks Tree

​
Tree Structure

Bookmarks (Root)
├─ Evidence of Interest (128)
├─ Reviewed Items (1,542)
├─ Suspect Documents (45)
├─ Timeline Events (89)
└─ Exfiltrated Data (23)
  • Root node shows total bookmarked items
  • Each bookmark shows item count
  • Color indicators match bookmark colors
  • Expand to see bookmark details

​
Filtering by Bookmark

1

Click Bookmark Tree Tab

Select Bookmarks tab in navigation panel
2

Click Bookmark Name

Results table filters to show only items with that bookmark
3

Clear Filter

Click root node or use Clear Filters button
Bookmark filters can be combined with other filters (search, category, etc.).

​
Bookmark Tooltips

Hover over bookmark in tree to see:
  • Bookmark name
  • Item count
  • Assigned keyboard shortcut (if any)
  • Comment text (if set)

​
Keyboard Shortcut Management

​
Assigning Shortcuts

Keyboard shortcuts enable rapid tagging during analysis:
1

Open Bookmark Manager

Press Ctrl+B
2

Select Bookmark

Click bookmark in list (only one)
3

Press Desired Key

Press any key or combination:
  • Single keys: 0-9, A-Z
  • With Ctrl: Ctrl+0-9, Ctrl+A-Z (except reserved)
  • With Shift: Shift+Key
4

Shortcut Assigned

Key appears next to bookmark name

​
Using Shortcuts

Add to Bookmark:
  1. Select items in results table
  2. Press shortcut key
  3. Items added to bookmark
Remove from Bookmark:
  1. Select items in results table
  2. Press Alt+ShortcutKey
  3. Items removed from bookmark

​
Removing Shortcuts

To unassign a shortcut:
  1. Select bookmark in Bookmark Manager
  2. Press the currently assigned key again
  3. Shortcut removed
Shortcuts are saved with the case and persist between sessions.

​
Bookmark Workflows

​
Evidence Review Workflow

1

Create Review Bookmarks

  • “To Review” - Items pending examination
  • “Reviewed” - Completed items
  • “Relevant” - Items of interest
  • “Excluded” - Items ruled out
2

Assign Shortcuts

  • R key: Relevant
  • E key: Excluded
  • 1 key: To Review
3

Review Process

  • Start with filtered result set
  • Examine each item
  • Press R for relevant, E for excluded
  • Track progress via bookmark counts

​
Case Categories Workflow

1

Create Category Bookmarks

Based on investigation needs:
  • “Financial Records”
  • “Communications”
  • “Timeline Evidence”
  • “User Activity”
2

Tag During Analysis

As you find relevant items:
  • Assign appropriate category bookmark
  • Multiple bookmarks per item if needed
  • Add comments for context
3

Generate Reports

Filter by category bookmark and export

​
Multi-User Workflow

1

Assign User Bookmarks

  • “Analyst 1 - Assigned”
  • “Analyst 2 - Assigned”
  • “Analyst 1 - Completed”
2

Distribute Work

  • Check items for each analyst
  • Bookmark with assignment bookmark
3

Track Progress

  • Analysts mark items as completed
  • Monitor via bookmark counts

​
Advanced Bookmark Features

​
Recursive Checking

Quickly check entire folder hierarchies:
  1. Select folder in evidence tree
  2. Press R key
  3. All descendant files checked
  4. Bookmark the checked items
Use recursive checking to bookmark entire user directories or folder structures at once.

​
Selection Expansion

Expand selection to related items before bookmarking:
  • Select items
  • Press P
  • Parent containers added to selection
  • Bookmark all together

​
Bookmark Export

Bookmarked items can be exported:
  1. Filter by bookmark
  2. Options → Export
  3. Choose format:
    • HTML Report: Formatted report with thumbnails
    • CSV Report: Tabular data
    • ZIP Archive: Files with metadata
HTML reports include bookmark names and comments for each item.

​
Bookmark Best Practices

  • Use clear, descriptive names
  • Maintain consistent naming scheme
  • Consider prefixes for categories (e.g., “CAT: Documents”)
  • Avoid special characters in names
  • Create bookmarks before starting analysis
  • Limit to essential categories (10-20 max)
  • Use colors consistently
  • Document bookmark purpose in comments
  • Assign to frequently used bookmarks
  • Use logical key assignments (R for Relevant)
  • Document shortcuts for team members
  • Avoid conflicts with system shortcuts
  • Add creation date in comments
  • Document criteria for tagging
  • Note evidence significance
  • Track follow-up actions
  • Check items as you review
  • Batch bookmark at logical stopping points
  • Use filters to verify bookmark assignments
  • Regular backup of case state files

​
Bookmark Persistence

​
State Files

Bookmarks are saved in case state files:
  • Located in case output directory
  • Updated automatically on changes
  • Include bookmark assignments and metadata
  • Portable with case data

​
Backup and Recovery

Always backup the entire case directory, including state files, to preserve bookmarks.
State files contain:
  • Bookmark names and colors
  • Item-to-bookmark assignments
  • Keyboard shortcuts
  • Comments

​
Troubleshooting

  • Check case directory is writable
  • Verify disk space available
  • Close and reopen IPED
  • Check state file integrity
  • Verify no conflict with system shortcuts
  • Check focus is on results table
  • Confirm shortcut assignment in manager
  • Restart IPED if needed
  • Verify hash values exist (computed during processing)
  • Check “Include Duplicates” is enabled
  • May take time on large cases
  • Progress dialog shows status
  • Verify state files exist in case directory
  • Check file permissions
  • Restore from backup if available
  • Re-create bookmarks if necessary

​
API and Scripting

Bookmarks can be accessed via IPED’s API: 
IMultiBookmarks bookmarks = ipedCase.getMultiBookmarks();

// Get all bookmarks
Set<String> bookmarkSet = bookmarks.getBookmarkSet();

// Check if item is bookmarked
boolean isBookmarked = bookmarks.isBookmarked(itemId, "Evidence");

// Add item to bookmark
bookmarks.addBookmark(itemId, "Relevant");

// Get items in bookmark
// (filter by bookmark name in query)
See the Web API documentation for remote bookmark management.

​
Next Steps

Analysis Features

Learn advanced search and filtering techniques

Web API

Access bookmarks remotely via REST API

Build docs developers (and LLMs) love

Get started for freeTalk to us