Add a file to triage#

Drop a file onto the prompt, pick one with the file picker, or send one over from Spotlight, then watch the default pipeline work through it.

You can put a file into File Triage in three ways. This page covers each way and what happens after you add the file.

Drop a file onto the prompt#

Drag any file from your file manager onto the centre prompt. The file joins the queue, becomes the active file, and the default analysis pipeline runs.

You can drop more than one file at once. Each file joins the queue, and File Triage selects the first one.

Use the Choose File button#

Click the Choose File button in the centre prompt. The native file picker opens. Select one file to run the same flow as a drop.

The picker takes one file at a time. To add more files, select them one at a time, or drag a multi-selection from your file manager.

Open from Spotlight#

You can also open a file from Spotlight with the Open with action. File Triage loads the file in this tab as if you had dropped it.

Note When you open a file through Spotlight, that file is recorded as a recent file. It then surfaces in Spotlight under recent items.

The default pipeline steps#

The file goes through the default pipeline.

  1. GraphDagger hashes the file (MD5, SHA-1, SHA-256, SSDEEP, IMPHASH for PE, TLSH).
  2. GraphDagger reads the signature from the first 64 bytes and matches it against known magic bytes.
  3. GraphDagger computes byte statistics, entropy, and the entropy bucket label.
  4. GraphDagger extracts ASCII and Unicode strings.
  5. A format-specific parser runs if the magic bytes match a known format. GraphDagger recognises PE, ELF, Mach-O, PDF, OOXML, RTF, OLE, MSI, ZIP, 7z, TAR, CAB, ISO, RFC 5322 email, and embedded VBA.
  6. Carving runs over the bytes to flag embedded files, entropy regions, and polyglots.

YARA scanning and OCR are not part of this default pipeline. You start them from the YARA and OCR tabs.

Archives expand into the queue#

If the file is a recognised archive, every entry inside it joins the queue underneath it. Select any entry to analyse it on its own. See The queue for how File Triage shows the hierarchy.