Bookmarks and Tagging

Organize and mark evidence using IPED’s powerful bookmark system

IPED’s bookmark system allows investigators to tag and organize evidence throughout the analysis process. Bookmarks provide a flexible way to group related items, track investigation progress, and prepare evidence for reporting.

Bookmark Basics

What are Bookmarks?

Bookmarks (also called tags or labels) are named categories that you assign to evidence items:

Organization

Group related evidence across file system boundaries

Workflow

Track reviewed items and mark items of interest

Collaboration

Share tagged evidence sets with team members

Reporting

Export specific bookmark categories for reports

Bookmark Features

• Multiple Bookmarks: Assign multiple bookmarks to a single item
• Color Coding: Visual identification with custom colors
• Comments: Add notes to bookmark categories
• Keyboard Shortcuts: Fast tagging with hotkeys (0-9, A-Z)
• Persistent: Saved in case database
• Searchable: Filter results by bookmark

Bookmarks are saved in the case state files and persist between IPED sessions.

Bookmark Manager

Access the Bookmark Manager via:

• Ctrl+B keyboard shortcut
• Top menu → Options → Bookmark Manager
• Right-click bookmark tree → Manage Bookmarks

Bookmark Manager Interface

Dataset Selection

Choose which items to bookmark:

• Highlighted: Currently selected items in results table
• Checked: All items marked with checkboxes

Include Duplicates: Optionally include duplicate files (by hash)

Bookmark List

• Displays all existing bookmarks
• Shows assigned keyboard shortcuts
• Color indicators for each bookmark
• Item counts per bookmark

Actions

• New: Create a new bookmark category
• Add: Add selected items to bookmark
• Remove: Remove selected items from bookmark
• Edit: Change bookmark name or color
• Delete: Remove bookmark category entirely

Comments

• Text area for bookmark notes
• Update comments for selected bookmark
• Persistent notes saved with case

Creating Bookmarks

Method 1: Bookmark Manager

1. Open Bookmark Manager

   Press Ctrl+B or click Options → Bookmark Manager

2. Enter Bookmark Name

   Type a descriptive name in the text field (max 256 characters)

3. Add Optional Comment

   Enter notes in the comments field

4. Click New

   Creates the bookmark category with auto-assigned color

5. Select Items to Tag

   Choose “Highlighted” or “Checked” and click Add

Method 2: Keyboard Shortcuts

1. Create Bookmark with Shortcut

   1. Open Bookmark Manager (Ctrl+B)
   2. Select a bookmark from the list
   3. Press desired key (0-9, A-Z, or key combinations)
   4. Shortcut is assigned to that bookmark
2. Use Shortcut to Tag

   With items selected in results table:

   • Press assigned key to add items to bookmark
   • Press Alt+Key to remove items from bookmark

Some keys are reserved:

• Ctrl+A: Select all (not available)
• Ctrl+B: Bookmark Manager (not available)
• Ctrl+C: Copy (not available)
• Space: Check/uncheck items
• R, P, F, D: Selection expansion
• Arrow keys: Navigation

Tagging Items

Selecting Items to Tag

Highlighted Items (Table Selection):

1. Click items in results table to select
2. Hold Ctrl for multi-select
3. Hold Shift for range select
4. Open Bookmark Manager
5. Choose “Highlighted” option

Checked Items (Checkbox):

1. Check boxes next to items in results table
2. Use Space key for quick checking
3. R key to check recursively (all children)
4. Open Bookmark Manager
5. Choose “Checked” option

Use checked items for building large evidence sets across multiple searches. Check items as you review, then bookmark them all at once.

Adding Items to Bookmarks

Via Manager

1. Select bookmark from list
2. Choose Highlighted or Checked
3. Click Add button
4. Items added to bookmark immediately

Via Keyboard

With items selected in table:

• Press assigned shortcut key
• Example: Press 1 for bookmark assigned to key 1
• Items added instantly

Context Menu

Right-click selected items:

• Select Add to Bookmark
• Choose bookmark from submenu
• Items tagged

Removing Items from Bookmarks

Via Manager

1. Select bookmark from list
2. Choose Highlighted or Checked
3. Click Remove button

Via Keyboard

• Press Alt+ShortcutKey
• Example: Alt+1 removes from bookmark 1

Context Menu

Right-click selected items:

• Select Remove from Bookmark
• Choose bookmark

Including Duplicates

When tagging items, optionally include duplicate files:

Automatic Duplicate Detection

Check Add Duplicates in Bookmark Manager:

• Finds all files with same hash as selected items
• Two methods: hash-based search or linear scan
• Optimized algorithm selected automatically
• Progress dialog shows duplicate search status

Use Cases:

• Mark all copies of evidence file
• Track file distribution across devices
• Identify data duplication patterns

Duplicate detection uses MD5/SHA-1/SHA-256 hashes. Empty files are excluded.

Managing Bookmarks

Edit Bookmark Properties

1. Select Bookmark

   Click bookmark in Bookmark Manager list

2. Click Edit

   Opens edit dialog

3. Modify Properties

   • Name: Change bookmark name
   • Color: Select new color from palette
4. Save Changes

   Click OK to apply

Bookmark Colors

Auto-Assignment

Colors automatically assigned when creating bookmarks

Visual Coding

Different colors help distinguish bookmark categories

Customization

Edit to change color or maintain consistent scheme

Bookmark Comments

Add context and notes to bookmark categories:

1. Select bookmark in Bookmark Manager
2. Type notes in comments text area
3. Click Update to save

Comment Uses:

• Investigation notes
• Reason for tagging
• Follow-up actions needed
• Evidence significance

Use comments to document why items were bookmarked for future reference or team collaboration.

Delete Bookmarks

Remove entire bookmark category:

1. Select bookmark in Bookmark Manager
2. Click Delete button
3. Confirm deletion
4. Bookmark removed (items remain in case)

Deleting a bookmark removes the category but does not delete the files themselves.

Bookmarks Tree

View and filter by bookmarks in the navigation panel:

Tree Structure

Bookmarks (Root)
├─ Evidence of Interest (128)
├─ Reviewed Items (1,542)
├─ Suspect Documents (45)
├─ Timeline Events (89)
└─ Exfiltrated Data (23)

• Root node shows total bookmarked items
• Each bookmark shows item count
• Color indicators match bookmark colors
• Expand to see bookmark details

Filtering by Bookmark

1. Click Bookmark Tree Tab

   Select Bookmarks tab in navigation panel

2. Click Bookmark Name

   Results table filters to show only items with that bookmark

3. Clear Filter

   Click root node or use Clear Filters button

Bookmark filters can be combined with other filters (search, category, etc.).

Bookmark Tooltips

Hover over bookmark in tree to see:

• Bookmark name
• Item count
• Assigned keyboard shortcut (if any)
• Comment text (if set)

Keyboard Shortcut Management

Assigning Shortcuts

Keyboard shortcuts enable rapid tagging during analysis:

1. Open Bookmark Manager

   Press Ctrl+B

2. Select Bookmark

   Click bookmark in list (only one)

3. Press Desired Key

   Press any key or combination:

   • Single keys: 0-9, A-Z
   • With Ctrl: Ctrl+0-9, Ctrl+A-Z (except reserved)
   • With Shift: Shift+Key
4. Shortcut Assigned

   Key appears next to bookmark name

Using Shortcuts

Add to Bookmark:

1. Select items in results table
2. Press shortcut key
3. Items added to bookmark

Remove from Bookmark:

1. Select items in results table
2. Press Alt+ShortcutKey
3. Items removed from bookmark

Removing Shortcuts

To unassign a shortcut:

1. Select bookmark in Bookmark Manager
2. Press the currently assigned key again
3. Shortcut removed

Shortcuts are saved with the case and persist between sessions.

Bookmark Workflows

Evidence Review Workflow

1. Create Review Bookmarks

   • “To Review” - Items pending examination
   • “Reviewed” - Completed items
   • “Relevant” - Items of interest
   • “Excluded” - Items ruled out
2. Assign Shortcuts

   • R key: Relevant
   • E key: Excluded
   • 1 key: To Review
3. Review Process

   • Start with filtered result set
   • Examine each item
   • Press R for relevant, E for excluded
   • Track progress via bookmark counts

Case Categories Workflow

1. Create Category Bookmarks

   Based on investigation needs:

   • “Financial Records”
   • “Communications”
   • “Timeline Evidence”
   • “User Activity”
2. Tag During Analysis

   As you find relevant items:

   • Assign appropriate category bookmark
   • Multiple bookmarks per item if needed
   • Add comments for context
3. Generate Reports

   Filter by category bookmark and export

Multi-User Workflow

1. Assign User Bookmarks

   • “Analyst 1 - Assigned”
   • “Analyst 2 - Assigned”
   • “Analyst 1 - Completed”
2. Distribute Work

   • Check items for each analyst
   • Bookmark with assignment bookmark
3. Track Progress

   • Analysts mark items as completed
   • Monitor via bookmark counts

Advanced Bookmark Features

Recursive Checking

Quickly check entire folder hierarchies:

1. Select folder in evidence tree
2. Press R key
3. All descendant files checked
4. Bookmark the checked items

Use recursive checking to bookmark entire user directories or folder structures at once.

Selection Expansion

Expand selection to related items before bookmarking:

Parent Selection (P)

• Select items
• Press P
• Parent containers added to selection
• Bookmark all together

References (F)

• Select item
• Press F
• Referenced items added to selection

Referenced By (D)

• Select item
• Press D
• Items referencing this added

Bookmark Export

Bookmarked items can be exported:

1. Filter by bookmark
2. Options → Export
3. Choose format:
   • HTML Report: Formatted report with thumbnails
   • CSV Report: Tabular data
   • ZIP Archive: Files with metadata

HTML reports include bookmark names and comments for each item.

Bookmark Best Practices

Naming Conventions

• Use clear, descriptive names
• Maintain consistent naming scheme
• Consider prefixes for categories (e.g., “CAT: Documents”)
• Avoid special characters in names

Organization

• Create bookmarks before starting analysis
• Limit to essential categories (10-20 max)
• Use colors consistently
• Document bookmark purpose in comments

Shortcuts

• Assign to frequently used bookmarks
• Use logical key assignments (R for Relevant)
• Document shortcuts for team members
• Avoid conflicts with system shortcuts

Comments

• Add creation date in comments
• Document criteria for tagging
• Note evidence significance
• Track follow-up actions

Workflow

• Check items as you review
• Batch bookmark at logical stopping points
• Use filters to verify bookmark assignments
• Regular backup of case state files

Bookmark Persistence

State Files

Bookmarks are saved in case state files:

• Located in case output directory
• Updated automatically on changes
• Include bookmark assignments and metadata
• Portable with case data

Backup and Recovery

Always backup the entire case directory, including state files, to preserve bookmarks.

State files contain:

• Bookmark names and colors
• Item-to-bookmark assignments
• Keyboard shortcuts
• Comments

Troubleshooting

Bookmark Not Saving

• Check case directory is writable
• Verify disk space available
• Close and reopen IPED
• Check state file integrity

Shortcut Not Working

• Verify no conflict with system shortcuts
• Check focus is on results table
• Confirm shortcut assignment in manager
• Restart IPED if needed

Duplicates Not Found

• Verify hash values exist (computed during processing)
• Check “Include Duplicates” is enabled
• May take time on large cases
• Progress dialog shows status

Missing Bookmarks After Reopen

• Verify state files exist in case directory
• Check file permissions
• Restore from backup if available
• Re-create bookmarks if necessary

API and Scripting

Bookmarks can be accessed via IPED’s API:

IMultiBookmarks bookmarks = ipedCase.getMultiBookmarks();

// Get all bookmarks
Set<String> bookmarkSet = bookmarks.getBookmarkSet();

// Check if item is bookmarked
boolean isBookmarked = bookmarks.isBookmarked(itemId, "Evidence");

// Add item to bookmark
bookmarks.addBookmark(itemId, "Relevant");

// Get items in bookmark
// (filter by bookmark name in query)

See the Web API documentation for remote bookmark management.

Next Steps

Analysis Features

Learn advanced search and filtering techniques

Web API

Access bookmarks remotely via REST API