diff --git a/Core/src/org/sleuthkit/autopsy/ingest/docs/ingest-about.html b/Core/src/org/sleuthkit/autopsy/ingest/docs/ingest-about.html index be9cf61877..b92dba229e 100644 --- a/Core/src/org/sleuthkit/autopsy/ingest/docs/ingest-about.html +++ b/Core/src/org/sleuthkit/autopsy/ingest/docs/ingest-about.html @@ -11,8 +11,10 @@ and extraction of a certain type of information. The analysis can be a lengthy process, especially for large images and when a number of types of analysis needs to be performed. - Ingest is a technique of automating these tasks. It is also similar to triage. Autopsy allows to run these lengthy analysis tasks in the background, + Ingest is a technique of automating these tasks. Autopsy allows to run these lengthy analysis tasks in the background, while the user can browse the application interface and review the ingest results as their appear. + Ingest is similar to triage. + Autopsy attempts to process files inside the ingested image in such order so that the more interesting files (user-related files) are processed files.
The ingest process begins after the basic file system information has been added to the database. @@ -21,27 +23,56 @@ and even for very large images to be processed there can be initial results available minutes, sometimes seconds after the analysis has started.
-You can start image ingest in two ways. When you add an image with the Add Image wizard, you will be shown the list of ingest modules and you can choose which you want to run and you can do some basic configuration of the modules. You can also launch the Ingest Manager run ingest by right clicking on an image in the explorer tree and choosing "Restart Image Ingest".
-The results from the ingest module can typically be found in the Results area of the explorer tree. However, some modules may choose to write results to a local file or to some other location and not make them available in the UI.
+You can start image ingest in two ways. When you add an image with the Add Image wizard, you will be shown the list of ingest modules and you can choose which you want to run. + You can also launch the Ingest Manager run ingest by right clicking on an image in the explorer tree and choosing "Restart Image Ingest".
+ ++ Once ingest is started, you can review the currently running ingest tasks in the task bar on the bottom-right corner of the main window. + The ingest tasks can be canceled by the user if so desired. Note, that sometimes the cancellation process make take several seconds or more to complete cleanly, depending on what the ingest module was currently doing. +
+ ++ The ingest message inbox will provide notifications when the particular ingest modules start and finish running. + There may also be error notifications, and result notifications sent by specific ingest modules. +
+ + + +The results from the ingest modules can typically be found in the Results area of the explorer tree. + However, some modules may choose to write results to a local file or to some other location and not make them available in the UI.
- An ingest module is responsible for extracting data from and searching images. Different modules will do different things. Examples include: + An ingest module is responsible for extracting data from and searching images. + Different modules will do different things. Examples include: +
- -
Ingest modules can be created by third-party-developers and can be added independently of Autopsy.
+ Before launching ingest, you should go over the modules configuration by selecting every module + in the list and review the current ingest module settings. + Some modules need to be configured at least the first time Autopsy is used to have default configuration populated + , otherwise they won't perform any analysis. + Changing the modules configuration will potentially affect number of results found, it might also affect the total time required for ingest to run and how fast the results are reported in real-time. + +
+ Ingest modules can be created by third-party-developers and can be added independently of Autopsy. + This can be done through Autopsy's plugin manager. This is accessible through the "Tools" > "Plugins" menu. Currently, the best way to add an ingest module is by navigating to the module's NBM file after choosing "Add Plugin..." in the "Downloaded" tab of the plugin manager. + Autopsy will require a restart after any modules are installed in order to properly load and display them. +