Evidence Locker can be driven largely from the keyboard: jump between the main pages, select rows, messages and files the way you would in a file manager, and step through evidence in the viewer. This page lists every shortcut and the pages it works on.
Shortcuts are shown with the macOS keys first and the Windows and Linux keys second. On a Mac, ⌘ is Command, ⌃ is Control and ⌥ is Option.
Jump between pages
These work anywhere in the app — you don't need to click anything first.
| Go to | macOS | Windows / Linux |
|---|---|---|
| Dashboard | ⌃ ⌘ H | Ctrl Alt H |
| Users | ⌃ ⌘ U | Ctrl Alt U |
| Cases | ⌃ ⌘ C | Ctrl Alt C |
| Workspace (the case you have open) | ⌃ ⌘ W | Ctrl Alt W |
| Team | ⌃ ⌘ T | Ctrl Alt T |
| Links | ⌃ ⌘ L | Ctrl Alt L |
| All Acquisitions | ⌃ ⌘ A | Ctrl Alt A |
| Show or hide the side menu | ⌘ B | Ctrl B |
A shortcut only works for a page your side menu shows you, so it follows your role:
- Users is for admins and owners.
- Workspace works once you have a case open.
- Team and Links aren't available to client users.
- All Acquisitions has no menu item — it's otherwise reached from the Dashboard banner.
- Signing in through a share link turns these shortcuts off.
Hover over an item in the side menu to see its shortcut. The Dashboard uses H (for home) because macOS keeps ⌃⌘D for its Look Up feature.
Select rows in a table
Every table in the app — Cases, Users, workspace and Team folders, the recycle bins, acquisitions, share links, and the tables in the Examiner — selects rows the way a file manager does.
| Action | macOS | Windows / Linux |
|---|---|---|
| Select only this row | Click | Click |
| Add or remove a row | ⌘ + click | Ctrl + click |
| Select a range of rows | Shift + click | Shift + click |
| Add a range to the selection | ⌘ Shift + click | Ctrl Shift + click |
| Select every row on the page | ⌘ A | Ctrl A |
| Clear the selection | Esc | Esc |
| Open a folder, case or conversation | Double-click | Double-click |
| Resize a column | Focus its divider, then ← / → | Focus its divider, then ← / → |
A shift-click selects from the row you clicked last, so you can shift-click again to adjust the range. A row's checkbox adds or removes just that row, like ⌘/Ctrl-click. Select all and Esc act on the table you last clicked in, and select only the rows on the current page. Double-clicking a column divider resets its width.
When you assign users to a case, the user table is a checklist: a click ticks or unticks a user, and Select all and Esc are turned off so one key can't change every assignment.
Select messages and files in the Examiner
The message timelines and file grids of the Slack and Cellebrite reviewers select the same way as tables, and add arrow-key navigation. Click a message or file first to give the list keyboard focus.
| Action | macOS | Windows / Linux |
|---|---|---|
| Select only this item | Click anywhere on it | Click anywhere on it |
| Add or remove an item | ⌘ + click, or its checkbox | Ctrl + click, or its checkbox |
| Select a range | Shift + click | Shift + click |
| Move the selection to the next or previous item | ↓ / ↑ | ↓ / ↑ |
| Move across a row of files | ← / → | ← / → |
| Extend the selection | Shift + arrow | Shift + arrow |
| Move without changing the selection | ⌘ + arrow | Ctrl + arrow |
| Add or remove the highlighted item | Space | Space |
| Open the highlighted item | Enter | Enter |
| Select every item shown | ⌘ A | Ctrl A |
| Clear the selection | Esc | Esc |
The highlighted item has a colored bar on its left edge. Enter opens a file in the viewer; on a message it opens the message's first attachment. Select all selects the messages or files loaded so far — scroll further to load more.
Clicking a link, a button or a file card inside a message keeps the selection as it is, and so does dragging across a message to copy its text.
Where these keys work:
| Reviewer | Lists |
|---|---|
| Slack | A conversation's message timeline, the thread panel, and the Files grid |
| Cellebrite | The Conversation and Attachments tabs of the Chat Messages panel, and the Files grid |
In a Cellebrite conversation, selecting a message also selects the attachments sent with it, and Esc clears every selected message — including ones a search is hiding. In Slack's thread panel, Esc closes the panel.
While you edit a tag
When you choose a tag from Edit a tag in the bar above the messages, the checkboxes become a checklist of that tag. A click or Space ticks or unticks one message, the arrow keys move the highlight without ticking anything, and Select all and Esc are turned off so one key can't retag a whole conversation. Nothing changes until you click Apply.
Search within a conversation
The Search within these messages box at the top of an open conversation steps through its matches.
| Reviewer | Next match | Previous match |
|---|---|---|
| Slack | Enter | Shift Enter |
| Cellebrite | Enter or ↓ | Shift Enter or ↑ |
View files
The full-screen file viewer opens from the Slack and Cellebrite reviewers and from workspace and Team folders.
| Action | macOS | Windows / Linux | Works in |
|---|---|---|---|
| Previous or next file | ← / → | ← / → | Everywhere |
| Show or hide the details panel | I | I | Slack and Cellebrite |
| Apply or remove one of the first nine tags | 1 – 9 | 1 – 9 | Slack and Cellebrite |
| Zoom in | ⌘ = | Ctrl = | PDFs and images |
| Zoom out | ⌘ - | Ctrl - | PDFs and images |
| Reset zoom | ⌘ 0 | Ctrl 0 | PDFs and images |
| Close the viewer | Esc | Esc | Everywhere |
The number keys follow the order of the viewer's Tags menu, which shows each tag's number beside it. Pressing a number on a file that already carries that tag removes it.
When you're typing in a field, using a menu, or controlling an audio or video player, keys go to that control instead of the viewer — click elsewhere in the viewer to get its shortcuts back.
Other keys
- Overview label — when editing an acquisition's Label on the Examiner's Overview page, Esc cancels the edit.
- Manage tags — Enter in the new tag's name creates it.
- Users page — in the card view, Enter or Space on a focused user card opens that user, as a click does.
- Case forms — Enter doesn't submit the case details or contact forms, so a stray keypress can't save a half-filled form — use the form's save button.
Related
- Getting Started — the side menu and what each page holds
- Slack Workspace Analysis — reviewing Slack exports
- Cellebrite Phone Analysis — reviewing phone chats