Viewer Overview
IPED’s viewer architecture provides specialized viewers for different file types:Text Viewer
Plain text, extracted content, hit highlighting
Hex Viewer
Raw binary data, hex editor functionality
Metadata Viewer
Technical properties, EXIF data, file attributes
MultiViewer
Format-specific viewers: images, videos, documents, HTML
Viewer Panel Layout
Viewers are organized in dockable panels:
Viewer Controls
Each viewer panel includes toolbar buttons:Enable Pin Viewer to compare multiple files by switching between them without automatic updates.
Text Viewer
The primary viewer for text content extracted from all file types.Features
Content Display
Content Display
- Displays extracted text from any file format
- Syntax highlighting for source code
- Word wrap and formatting options
- Unicode support for multiple languages
Search Hit Highlighting
Search Hit Highlighting
- Automatic highlighting of search terms
- Color-coded matches
- Jump between hits with toolbar buttons
- Context display around matches
Text Selection
Text Selection
- Select and copy text
- Search selected text
- Context menu actions
Large File Handling
Large File Handling
- Efficient loading of multi-megabyte text files
- Pagination for very large documents
- Quick navigation to specific hits
Hits Table
The Hits tab shows all search term matches in the current file:| Column | Description |
|---|---|
| # | Hit number |
| Context | Text excerpt around the match |
- Click any row to jump to that hit in the text
- Hits are ordered by position in file
- Useful for quickly scanning match locations
Hex Viewer
Low-level binary file viewer for examining raw data.Interface Layout
- Hex Display
- Features
- Hit Highlighting
- Offset: Byte position in file
- Hex Values: 16 bytes per row
- ASCII: Printable character representation
Use Cases
File Signature Analysis
Verify file headers and magic bytes
Binary Data Examination
Analyze unknown or corrupted files
Data Recovery
Extract embedded data or examine carved files
Malware Analysis
Examine executable headers and structure
Metadata Viewer
Displays comprehensive file properties and metadata.Metadata Categories
- Basic Properties
- File System
- Format-Specific
- Forensic Data
- File name and path
- Size (bytes, KB, MB)
- Timestamps (created, modified, accessed)
- Hash values (MD5, SHA-1, SHA-256)
- File type and MIME type
Interactive Features
- Click Metadata Values: Filter results by that value
- Copy Properties: Right-click to copy specific fields
- Export Metadata: Save to CSV or JSON
The metadata viewer is automatically updated when selecting different items.
Image Viewer
Specialized viewer for image files with zoom and enhancement features.Capabilities
Image Display
Image Display
- Support for hundreds of image formats
- Automatic sizing to fit panel
- High-quality rendering
- Rotation and flip controls
Zoom Controls
Zoom Controls
- Zoom in/out with buttons or mouse wheel
- Fit to window
- Actual size (100%)
- Pan with click-and-drag
Filters
Filters
- Grayscale (Ctrl+W): Convert to black and white
- Blur Filter (Ctrl+Q): Obscure sensitive content
- Filters apply in viewer without modifying original
EXIF Display
EXIF Display
- Camera make and model
- GPS coordinates (if available)
- Capture date and settings
- Overlay on image or separate panel
Supported Formats
- Common: JPEG, PNG, GIF, BMP, TIFF, WebP
- RAW: CR2, NEF, ARW, DNG, RAF, ORF
- Advanced: PSD, SVG, ICO, HEIC
Gallery View
Grid-based thumbnail view for browsing multiple images:Gallery Features
- Display Options
- Filters
- Selection
- Actions
- Adjustable thumbnail size (± buttons)
- Multi-column grid layout
- Video frame thumbnails
- Lazy loading for performance
Toggle between Table and Gallery views using tabs at the top of the results panel.
Video Viewer
Built-in video playback with frame extraction:Video Controls
- Play/Pause: Standard playback controls
- Seek: Jump to specific timestamp
- Frame-by-Frame: Step through video frame by frame
- Speed Control: Adjust playback speed
- Volume: Audio level control
Frame Extraction
- Automatic thumbnail generation
- Multiple frames extracted per video
- View frames in gallery mode
- Export specific frames
Supported Formats
- MP4, AVI, MOV, MKV, WMV, FLV
- MPEG-1, MPEG-2, MPEG-4
- H.264, H.265 codecs
Video frames are extracted during processing and cached for quick access.
HTML Viewer
Web content viewer with link extraction:Features
Rendering
Rendering
- Display HTML emails
- Render web pages
- JavaScript execution (sandboxed)
- CSS styling support
Link Viewer
Link Viewer
- Extract all links from HTML
- List URLs in separate panel
- Click links to filter or open
- Export link list
Attachment Handling
Attachment Handling
- Display embedded images
- List attached files
- Preview attachments
- Extract attachments
Email Display
Email Display
- Headers (From, To, Subject, Date)
- Body with formatting
- Inline images
- Attachment list
Security
- External content blocked by default
- Sandboxed execution environment
- No automatic script execution
- Safe preview of potentially malicious emails
Document Viewers
PDF Viewer
Integrated PDF rendering:- Multi-page Navigation: Previous/next page, jump to page
- Zoom Controls: Fit width, fit page, custom zoom
- Search: Find text within PDF
- Annotations: View PDF annotations and comments
- Text Selection: Copy text from PDF
Office Document Viewer
View Microsoft Office and LibreOffice files: Supported Formats:- Word (DOC, DOCX)
- Excel (XLS, XLSX)
- PowerPoint (PPT, PPTX)
- LibreOffice (ODT, ODS, ODP)
- Native rendering with LibreOffice
- Preserve formatting and layout
- Multi-page/sheet support
- Extract embedded objects
Audio Viewer
Audio file playback with transcription support:Audio Controls
- Play/pause/stop controls
- Seek bar with timestamp
- Volume control
- Waveform visualization (if available)
Transcription Display
If audio transcription was enabled during processing:- View text transcript
- Timestamp synchronization
- Click transcript to jump to audio position
- Search within transcript
- Export transcript text
Supported Formats
- MP3, WAV, OGG, FLAC, AAC
- M4A, WMA, AIFF
Referenced File Viewer
Special viewer for handling file references and links:- Display shortcuts and symbolic links
- Show reference metadata
- Link to referenced item in case
- Navigate to referenced file
Viewer Tips and Shortcuts
- Keyboard Shortcuts
- Performance
- Workflow
- Ctrl+F: Search in viewer
- Ctrl+↑/↓: Previous/next hit
- Ctrl+Q: Toggle blur filter
- Ctrl+W: Toggle grayscale
- Space: Check/uncheck item
- Arrow Keys: Navigate items
Multi-Viewer Tab
The MultiViewer automatically selects the best viewer:Automatic Viewer Selection
IPED detects file type and chooses appropriate viewer:Manual Viewer Selection
Force a specific viewer:- Right-click the file
- View As → Choose viewer
- Override automatic detection
Related Items Tables
Additional viewers for related evidence:Subitems Table
View items extracted from the selected file:- Attachments from emails
- Archived files from ZIP/RAR
- Embedded objects from documents
- Carved files from containers
Parent Table
View container files:- ZIP archive containing file
- Email containing attachment
- Disk image containing file
- Folder hierarchy
Duplicates Table
All files with identical hash:- Same content, different paths
- Useful for tracking file copies
- Data exfiltration analysis
References Tables
Referenced Items:- Files that this item references (links, shortcuts)
- Items that reference this file (backlinks)
Next Steps
Bookmarks
Tag important evidence found during viewing
Bookmarks
Tag and organize evidence