@@ -30,4 +30,18 @@ To open a case, either:
|
||||
|
||||
Navigate to the case directory and select the ".aut" file.
|
||||
|
||||
\section case_properties Viewing Case Properties
|
||||
You can view the case properties by going to the "Case" menu and clicking "Case Properties". This will open a screen similar to one of the two following screenshots:
|
||||
<br><br>
|
||||
\image html single-user-case-properties.PNG
|
||||
<br><br>
|
||||
\image html multi-user-case-properties.PNG
|
||||
<br><br>
|
||||
|
||||
You can use the "Ingest History" tab to view which data sources had which modules run upon them, and when, as shown in the screenshot below.
|
||||
<br><br>
|
||||
\image html case-properties-history-tab.PNG
|
||||
<br><br>
|
||||
|
||||
|
||||
*/
|
||||
|
||||
BIN
docs/doxygen-user/images/case-properties-history-tab.PNG
Executable file
|
After Width: | Height: | Size: 32 KiB |
|
Before Width: | Height: | Size: 48 KiB After Width: | Height: | Size: 47 KiB |
|
Before Width: | Height: | Size: 51 KiB After Width: | Height: | Size: 49 KiB |
BIN
docs/doxygen-user/images/ingest-already-run.PNG
Executable file
|
After Width: | Height: | Size: 27 KiB |
BIN
docs/doxygen-user/images/ingest-history.PNG
Executable file
|
After Width: | Height: | Size: 27 KiB |
|
Before Width: | Height: | Size: 48 KiB After Width: | Height: | Size: 48 KiB |
|
Before Width: | Height: | Size: 39 KiB After Width: | Height: | Size: 41 KiB |
|
Before Width: | Height: | Size: 16 KiB After Width: | Height: | Size: 14 KiB |
BIN
docs/doxygen-user/images/multi-user-case-properties.PNG
Executable file
|
After Width: | Height: | Size: 20 KiB |
BIN
docs/doxygen-user/images/previous-version-already-run.PNG
Executable file
|
After Width: | Height: | Size: 40 KiB |
|
Before Width: | Height: | Size: 40 KiB After Width: | Height: | Size: 47 KiB |
BIN
docs/doxygen-user/images/single-user-case-properties.PNG
Executable file
|
After Width: | Height: | Size: 22 KiB |
@@ -39,10 +39,25 @@ There may also be an "Advanced" button that is enabled in the lower corner. Pre
|
||||
|
||||
As an example, the hash lookup module will allow you to enable or disable hash databases in the "run time" options panel, but requires you to go to the "Advanced" dialog to add or remove hash databases from the Autopsy configuration.
|
||||
|
||||
<br><br>
|
||||
\section ingest_already_run Notification of Ingest Already Run
|
||||
If an ingest module has already been run for a particular data source, you will see a triangular yellow icon with an exclaimation point next to the module in the "Run Ingest Modules" dialog, as shown in the screenshot below.
|
||||
<br><br>
|
||||
\image html ingest-already-run.PNG
|
||||
<br><br>
|
||||
If an older version of an ingest module has been run for a particular data source, you will see a round blue icon with an "i" next to the module in the "Run Ingest Modules" dialog, as shown in the screenshot below.
|
||||
<br><br>
|
||||
\image html previous-version-already-run.PNG
|
||||
<br><br>
|
||||
|
||||
Clicking "View Ingest History" will show you the ingest history in tabular form, allowing you to see which modules were run on which data sources and when, as shown in the screenshot below.
|
||||
<br><br>
|
||||
\image html ingest-history.PNG
|
||||
<br><br>
|
||||
|
||||
\section ingest_results Viewing Ingest Module Results
|
||||
|
||||
Ingest modules run in the background. An ingest module can provide you results in a variety of ways, but we recommend specific methods:
|
||||
Ingest modules run in the background. An ingest module can provide you results in a variety of ways, but we recommend specific methods:
|
||||
|
||||
-# If they post results to the Blackboard, then you will find them in the "Results" area of the tree in the main interface.
|
||||
-# They can send a message to the Ingest Inbox so that you get a message each time something really important is found.
|
||||
|
||||
@@ -6,12 +6,12 @@ There are two types of modules:
|
||||
- Modules written in Java that are shipped in NBM (NetBeans Module) files.
|
||||
- Modules written in Python that are shipped as a folder in a ZIP file.
|
||||
|
||||
\section module_install_nbm Installing NetBeans Module
|
||||
\section module_install_nbm Installing NetBeans Modules
|
||||
If you have an NBM file, then it may contain one or more Autopsy modules. To install it, use the plugin manager at "Tools", "Plugins".
|
||||
|
||||
Choose the "Downloaded" tab and then choose "Add Plugins". Browse to the NBM file. It may require you to restart Autopsy.
|
||||
|
||||
\section module_install_python Installing Python Module
|
||||
\section module_install_python Installing Python Modules
|
||||
If you have a ZIP file with a Python module in it, then unzip the file and you should get a folder. Open the Python module library folder using "Tools", "Python Plugins". Copy the module folder into there and Autopsy should identify and use it next time it loads modules.
|
||||
|
||||
*/
|
||||
|
||||
@@ -7,6 +7,6 @@ If you find that you need to debug some of the C/C++ code from The Sleuth Kit (T
|
||||
-# Build the Autopsy suite so that it copies the new JAR file with the debug dlls.
|
||||
-# Set your breakpoints in the TSK source.
|
||||
-# Run Autopsy in the debugger.
|
||||
-# In VC++, do Debug->Attach to process... If you don't see this menu item, set Tools->Settings->Expert Settings. There is also a Tools->Attach to process..(Ctrl+Alt+P). Attach to nbexex64,exe (netbeasn64.exe is the IDE).
|
||||
-# In VC++, do Debug->Attach to process... If you don't see this menu item, set Tools->Settings->Expert Settings. There is also a Tools->Attach to process..(Ctrl+Alt+P). Attach to nbexec64.exe (netbeans64.exe is the IDE).
|
||||
|
||||
*/
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
<hr/>
|
||||
<p><i>Copyright © 2012-2015 Basis Technology. Generated on: $date<br/>
|
||||
<p><i>Copyright © 2012-2016 Basis Technology. Generated on: $date<br/>
|
||||
This work is licensed under a
|
||||
<a rel="license" href="http://creativecommons.org/licenses/by-sa/3.0/us/">Creative Commons Attribution-Share Alike 3.0 United States License</a>.
|
||||
</i></p>
|
||||
|
||||
@@ -45,7 +45,7 @@ If you only want to analyze files, then you want to get the AbstractFile object
|
||||
\code
|
||||
AbstractFile file = node.getLookup().lookup(AbstractFile.class);
|
||||
\endcode
|
||||
If file is null, then it means that the node isn't for a AbstractFile (perhaps its of a full volume).
|
||||
If file is null, then it means that the node isn't for an AbstractFile (perhaps its of a full volume).
|
||||
Once you have the AbstractFile object, you can get the file's name, content, and metadata.
|
||||
|
||||
If you want to get whatever is passed in, then you can use the more generic lookup:
|
||||
|
||||
@@ -195,7 +195,7 @@ For further reference regarding ContainerOperators, please see
|
||||
|
||||
|
||||
When an element has been selected, the individual components may be manipulated with ContainerOperators.
|
||||
To select a button, use the code below, where cont is one of the ContainerOperators from above, text is the text displayed on the button, and index is the button's order if there are multiple with the same name (i.e. if there are three buttons labeled <EFBFBD>preview<EFBFBD>, the first's index is 0, then 1, then 2).
|
||||
To select a button, use the code below, where cont is one of the ContainerOperators from above, text is the text displayed on the button, and index is the button's order if there are multiple with the same name (i.e. if there are three buttons labeled "Preview", the first's index is 0, then 1, then 2).
|
||||
|
||||
JbuttonOperator jbo = new JbuttonOperator(ContainerOperator cont, String text, int index);
|
||||
|
||||
|
||||