diff --git a/docs/doxygen-user/data_source_summary.dox b/docs/doxygen-user/data_source_summary.dox index 2b3898d747..f656e5a6ab 100644 --- a/docs/doxygen-user/data_source_summary.dox +++ b/docs/doxygen-user/data_source_summary.dox @@ -4,6 +4,8 @@ \section ds_summary_overview Overview +The Data Source Summary viewer allows you to see an overview of file types, results, and other information for a particular data source. + \section ds_summary_opening Opening the Data Source Summary There are two ways to view the data source summary. The first is to go to Case->Data Source Summary. This will open the summary in a new window. @@ -36,7 +38,9 @@ The User Activity tab shows the most recent results found in the data source. \subsection ds_summary_analysis Analysis +The Analysis tab shows the sets with the most results from the \ref hash_db_page, the \ref keyword_search_page, and the \ref interesting_files_identifier_page. +\image html ds_summary_analysis.png \subsection ds_summary_recent_files Recent Files @@ -46,10 +50,10 @@ The Recent Files tab shows information on the most recent files opened and downl \subsection ds_summary_past_cases Past Cases +The Past Cases tab shows which cases had results or notable files in common with the current data source. This is based on the results in the "Interesting Items" section of the Results section in the \ref tree_viewer_page. The \ref central_repo_page ingest module must have been run with the options to "Flag items previously tagged as notable" and "Flag devices previously seen in other cases" enabled. \image html ds_summary_past_cases.png - Note that because these entries are based on the Interesting Items results created during ingest and not querying the central repository, they will not reflect any matches in cases processed after this case. For example, suppose we create Case A and ingest a data source with Device Z. If we make a new case Case B afterward and ingest a data source that also has Device Z, we would see Case A listed in this tab for Case B, but if we reopened Case A we would not see Case B listed unless ingest was run again. \subsection ds_summary_ingest_history Ingest History diff --git a/docs/doxygen-user/images/DataSourceSummary/ds_summary_analysis.png b/docs/doxygen-user/images/DataSourceSummary/ds_summary_analysis.png new file mode 100644 index 0000000000..15957a0712 Binary files /dev/null and b/docs/doxygen-user/images/DataSourceSummary/ds_summary_analysis.png differ