About the Data Explorer

The Data Explorer view in Autopsy is the directory tree node structure seen on the left hand side.

The data explorer contains the following data:

• Image file-system with its directory structure that can be navigated,
• Saved results of image and file analysis, such as results produced by the ingest process,
• Built-in views and filters on the file-system and saved results.

The data explorer provides different methods for finding relevant data, such as:

• All files of a specific type
• Different extracted content types (web bookmarks, web history, installed programs, devices, etc.)
• Hash database hits
• Keyword hits
• File bookmarks

The Data Explorer will publish all relevant data to the Result Viewer when specific nodes are clicked. In general, if you are looking for an 'analysis technique', then this is where you should look.