Researching a File

Code Insight 6.14.2

When a file contains third-party indicators, you can use the Exact or Partial Matches tab to review the evidence and decide which group best explains the existence of this file.

To research (review all evidence) a file, perform the following steps.

To research a file, do the following:

1.

Navigate to the file tree.

Note:You can filter the tree using evidence tags or a custom filter.)

2.

Click on any file in the tree. Files are decorated depending on the types of evidence present in the file. Depending on whether the scanned file is source, archive, or other type of file, the icon preceding it is representative of the file type. The following file notations are available:

Notation	Description
bold	A filename that is in bold contains one or more exact matches.
(!)	A file with a red exclamation mark in front of it contains one or more source matches.
< >	A file with angle brackets in front of it is recognized as a source file based on the file extensions specified in Workspace Settings. Note:All files with exclamation marks also have < >.
Regular weight, no exclamation mark	The absence of bold characters or exclamation marks indicates that the file is neither an exact match nor a source match.
Italics	A file in italics indicates that its status has not yet been received by the server.

3.

Navigate through the Evidence tabs in the file details panel to review the various third- party indicators that were detected in the current file. To view different types of evidence, see Types of Evidence.