mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-06 21:00:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add os accounts and installed programs to CR doc

Browse Source
This commit is contained in:
apriestman 2021-07-13 14:40:03 -04:00
parent b2157e5d90
commit 859f88a708
2 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
docs/doxygen-user/central_repo.dox
View File

@ -111,7 +111,11 @@ Descriptions of the property types:
- <b>ICCID Number</b> - <b>ICCID Number</b>
- ICCID properties are currently only created by custom Autopsy modules. - ICCID properties are currently only created by custom Autopsy modules.
- <b>Credit Card</b> - <b>Credit Card</b>
- Credid Card properties are created by the \ref keyword_search_page. - Credit Card properties are created by the \ref keyword_search_page.
- <b>OS Account</b>
- OS account properties are created by the disk image data source processor and the \ref recent_activity_page.
- <b>Installed Programs</b>
- Installed program properties are created primarily by the \ref recent_activity_page.
- <b> App-specific Accounts (Facebook, Twitter, etc)</b> - <b> App-specific Accounts (Facebook, Twitter, etc)</b>
- These properties primarily come from the \ref android_analyzer_page. - These properties primarily come from the \ref android_analyzer_page.
@ -148,7 +152,7 @@ There are three settings for the Central Repository ingest module:
<ul> <ul>
<li><b>Save items to the Central Repository</b> - This should only be unselected in the rare case that you don't want to add any properties from the current data source to the central repository, but still want to flag past occurrences. <li><b>Save items to the Central Repository</b> - This should only be unselected in the rare case that you don't want to add any properties from the current data source to the central repository, but still want to flag past occurrences.
<li><b>Flag items previously tagged as notable</b> - Enabling this causes Interesting Item/File artifacts to be created when properties matching those previously flagged are found. See the next section \ref cr_tagging for details. <li><b>Flag items previously tagged as notable</b> - Enabling this causes Interesting Item/File artifacts to be created when properties matching those previously flagged are found. See the next section \ref cr_tagging for details.
<li><b>Flag previously seen devices</b> - When this is enabled, an Interesting Item artifact will be created if any device-related property (USB, MAC Address, IMSI, IMEI, ICCID) is found that is already in the central repository, regardless of whether they have been flagged. <li><b>Flag previously seen devices and users</b> - When this is enabled, an Interesting Item artifact will be created if any device-related property (USB, MAC Address, IMSI, IMEI, ICCID) or an OS account is found that is already in the central repository, regardless of whether they have been flagged.
</li> </li>
\subsection cr_tagging Tagging Files and Artifacts \subsection cr_tagging Tagging Files and Artifacts

BIN
docs/doxygen-user/images/central_repo_ingest_settings.png
View File

Binary file not shown.
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 26 KiB

After

Width:  |  Height:  |  Size: 37 KiB