Merge pull request #2208 from karlmortensen/docs

Update documentation
This commit is contained in:
Richard Cordovano 2016-06-03 12:44:50 -04:00
commit a1e2406124
35 changed files with 32 additions and 10 deletions

View File

@ -18,7 +18,7 @@ The module should be able to extract the following:
NOTE: These database formats vary by version of OS and different vendors can place the databases in different places. Autopsy may not support all versions and vendors. NOTE: These database formats vary by version of OS and different vendors can place the databases in different places. Autopsy may not support all versions and vendors.
NOTE: This module is not exhaustive with its support for Android. It was created as a starting point for others to contribute plug-ins for 3rd party apps. See the <a href="http://sleuthkit.org/autopsy/docs/api-docs/4.0/mod_mobile_page.html">Developer docs</a> for information on writing modules. NOTE: This module is not exhaustive with its support for Android. It was created as a starting point for others to contribute plug-ins for 3rd party apps. See the <a href="http://sleuthkit.org/autopsy/docs/api-docs/4.1/mod_mobile_page.html">Developer docs</a> for information on writing modules.
Configuration Configuration

View File

@ -10,7 +10,7 @@ Each case has its own directory that is named based on the case name. The direct
There are several ways to create a new case: There are several ways to create a new case:
- The opening splash screen has a button to create a new case. - The opening splash screen has a button to create a new case.
- The "File", "Create New Case" menu item - The "Case", "Create New Case" menu item
The New Case wizard dialog will open and you will need to enter the case name and base directory. A directory for the case will be created inside of the "base directory". If the directory already exists, you will need to either delete the existing directory or choose a different combination of names. The New Case wizard dialog will open and you will need to enter the case name and base directory. A directory for the case will be created inside of the "base directory". If the directory already exists, you will need to either delete the existing directory or choose a different combination of names.
@ -26,7 +26,7 @@ After you create the case, you will be prompted to add a data source, as describ
To open a case, either: To open a case, either:
- Choose "Open Existing Case" or "Open Recent Case" from the opening splash screen. - Choose "Open Existing Case" or "Open Recent Case" from the opening splash screen.
- Choose the "File", "Open Case" menu item or "File", "Open Recent Case" - Choose the "Case", "Open Case" menu item or "Case", "Open Recent Case"
Navigate to the case directory and select the ".aut" file. Navigate to the case directory and select the ".aut" file.

View File

@ -15,7 +15,7 @@ Autopsy supports three types of data sources:
You can add a data source in several ways: You can add a data source in several ways:
- After you create a case, it automatically prompts you to add a data source. - After you create a case, it automatically prompts you to add a data source.
- There is a toolbar item to add a Data Source when a case is open. - There is a toolbar item to add a Data Source when a case is open.
- The "File", "Add Data Source" menu item when a case is open. - The "Case", "Add Data Source" menu item when a case is open.
The data source must remain accessible for the duration of the analysis because the case contains a reference to the data source. It does <b>not</b> copy the data source into the case folder. The data source must remain accessible for the duration of the analysis because the case contains a reference to the data source. It does <b>not</b> copy the data source into the case folder.
@ -79,6 +79,9 @@ You can add files or folders that are on your local computer (or on a shared dri
Some things to note when doing this: Some things to note when doing this:
- Autopsy ignores the time stamps on files that it adds this way because they could be the timestamps when they were copied onto your examination device. - Autopsy ignores the time stamps on files that it adds this way because they could be the timestamps when they were copied onto your examination device.
- If you have a USB-attached device that you are analyzing and you choose to add the device's contents using this method, then note that it will not look at unallocated space or deleted files. Autopsy will only be able to see the allocated files. You should add the device as a "Logical Drive" to analyze the unallocated space. - If you have a USB-attached device that you are analyzing and you choose to add the device's contents using this method, then note that it will not look at unallocated space or deleted files. Autopsy will only be able to see the allocated files. You should add the device as a "Logical Drive" to analyze the unallocated space.
- You can modify the name of the Logical File Set from the default LogicalFileSet# by clicking the "Change" button as shown in the screenshot below:
\image html change_logical_file_set_display_name.PNG
To add logical files: To add logical files:
-# Choose "Logical Files" from the pull down. -# Choose "Logical Files" from the pull down.

View File

@ -1,5 +1,5 @@
<hr/> <hr/>
<p><i>Copyright &#169; 2012-2015 Basis Technology. Generated on $date<br/> <p><i>Copyright &#169; 2012-2016 Basis Technology. Generated on $date<br/>
This work is licensed under a This work is licensed under a
<a rel="license" href="http://creativecommons.org/licenses/by-sa/3.0/us/">Creative Commons Attribution-Share Alike 3.0 United States License</a>. <a rel="license" href="http://creativecommons.org/licenses/by-sa/3.0/us/">Creative Commons Attribution-Share Alike 3.0 United States License</a>.
</i></p> </i></p>

Binary file not shown.

After

Width:  |  Height:  |  Size: 27 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 1.3 MiB

After

Width:  |  Height:  |  Size: 1.1 MiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 65 KiB

After

Width:  |  Height:  |  Size: 68 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 47 KiB

After

Width:  |  Height:  |  Size: 46 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 59 KiB

After

Width:  |  Height:  |  Size: 69 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 80 KiB

After

Width:  |  Height:  |  Size: 82 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 52 KiB

After

Width:  |  Height:  |  Size: 46 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 29 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 69 KiB

After

Width:  |  Height:  |  Size: 63 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 47 KiB

After

Width:  |  Height:  |  Size: 56 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 52 KiB

After

Width:  |  Height:  |  Size: 65 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 48 KiB

After

Width:  |  Height:  |  Size: 57 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 109 KiB

After

Width:  |  Height:  |  Size: 123 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 52 KiB

After

Width:  |  Height:  |  Size: 39 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 33 KiB

After

Width:  |  Height:  |  Size: 54 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 11 KiB

After

Width:  |  Height:  |  Size: 16 KiB

BIN
docs/doxygen-user/images/nsrl_import_process.PNG Normal file → Executable file

Binary file not shown.

Before

Width:  |  Height:  |  Size: 63 KiB

After

Width:  |  Height:  |  Size: 76 KiB

BIN
docs/doxygen-user/images/nsrl_imported.PNG Normal file → Executable file

Binary file not shown.

Before

Width:  |  Height:  |  Size: 52 KiB

After

Width:  |  Height:  |  Size: 68 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 32 KiB

After

Width:  |  Height:  |  Size: 32 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 21 KiB

After

Width:  |  Height:  |  Size: 23 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 8.2 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 13 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 79 KiB

After

Width:  |  Height:  |  Size: 85 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 191 KiB

After

Width:  |  Height:  |  Size: 192 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 64 KiB

After

Width:  |  Height:  |  Size: 63 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 464 KiB

After

Width:  |  Height:  |  Size: 539 KiB

View File

@ -52,4 +52,9 @@ Ingest modules run in the background. An ingest module can provide you results
All of the official Autopsy modules send results to the blackboard, but if you install third-party apps, then they may choose any approach -- including a pop-up window each time they find something. All of the official Autopsy modules send results to the blackboard, but if you install third-party apps, then they may choose any approach -- including a pop-up window each time they find something.
\section ingest_monitoring Viewing Ongoing Ingest Activity
While Ingest is running, one can use the "Ingest Progress Snapshot" tool to see what activity is going on at the moment. Click on "Help", "Get Ingest Progress Snapshot" to view the dialog shown in the screenshot below.
\image html ingest_progress_snapshot.PNG
To refresh the view, use the "Refresh" button.
*/ */

View File

@ -75,8 +75,8 @@ The log file should end up looking like this (modified lines are highlighted in
<br><br> <br><br>
\image html log4j.PNG \image html log4j.PNG
<br><br> <br><br>
5. From an Autopsy installation, copy the folder <i>"C:\Program Files\Autopsy-4.0\autopsy\solr\solr\configsets"</i> to <i>"C:\Bitnami\solr-4.10.3-0\apache-solr\solr"</i>. 5. From an Autopsy installation, copy the folder <i>"C:\Program Files\Autopsy-4.1\autopsy\solr\solr\configsets"</i> to <i>"C:\Bitnami\solr-4.10.3-0\apache-solr\solr"</i>.
6. From an Autopsy installation, copy the folder <i>"C:\Program Files\Autopsy-4.0\autopsy\solr\solr\lib"</i> to <i>"C:\Bitnami\solr-4.10.3-0\apache-solr\solr"</i>. 6. From an Autopsy installation, copy the folder <i>"C:\Program Files\Autopsy-4.1\autopsy\solr\solr\lib"</i> to <i>"C:\Bitnami\solr-4.10.3-0\apache-solr\solr"</i>.
7. Start a Windows command prompt as administrator by pressing _Start_, typing _command_, right clicking on _Command Prompt_, and clicking on _Run as administrator_. Then run the following command to install the _solrJetty_ service: 7. Start a Windows command prompt as administrator by pressing _Start_, typing _command_, right clicking on _Command Prompt_, and clicking on _Run as administrator_. Then run the following command to install the _solrJetty_ service:
<br><br> <br><br>
<i>cmd /c C:\\Bitnami\\solr-4.10.3-0\\apache-solr\\scripts\\serviceinstall.bat INSTALL</i> <i>cmd /c C:\\Bitnami\\solr-4.10.3-0\\apache-solr\\scripts\\serviceinstall.bat INSTALL</i>

View File

@ -0,0 +1,13 @@
/*! \page logs_and_output_page Logs, Output, and Progress
There are several shortcuts for getting to the output folder, log folder, and progress shapshot shown below.
<br><br>
To open the Case output folder, use "Tools", "Open Output Folder" as shown below:
\image html open_output_folder.PNG
<br><br>
To open the Case log folder, use "Help", "Open Log Folder" as shown below:
\image html open_log_folder.PNG
<br><br>
While Ingest is running, one can use the "Ingest Progress Snapshot" tool to see what activity is going on at the moment. Click on "Help", "Get Ingest Progress Snapshot" to view the dialog shown in the screenshot below.
\image html ingest_progress_snapshot.PNG
To refresh the view, use the "Refresh" button.
*/

View File

@ -41,6 +41,7 @@ The following topics are available here:
- \subpage file_search_page - \subpage file_search_page
- \subpage timeline_page - \subpage timeline_page
- \subpage stix_page - \subpage stix_page
- \subpage logs_and_output_page
- Reporting - Reporting
- \subpage tagging_page - \subpage tagging_page
- \subpage reporting_page - \subpage reporting_page

View File

@ -5,10 +5,10 @@
Data sources are added to a <strong>case</strong>. A case can have a single data source or it can have multiple data sources. Currently, a single report is generated for an entire case, so if you need to report on individual data sources, then you should use one data source per case. If there are many drives/phones/other data sources for one investigation, then your case should have multiple data sources. Data sources are added to a <strong>case</strong>. A case can have a single data source or it can have multiple data sources. Currently, a single report is generated for an entire case, so if you need to report on individual data sources, then you should use one data source per case. If there are many drives/phones/other data sources for one investigation, then your case should have multiple data sources.
\subsection s2 Creating a Case \subsection s2 Creating a Case
To create a case, use either the "Create New Case" option on the Welcome screen or from the "File" menu. This will start the <strong>New Case Wizard</strong>. You will need to supply it with the name of the case and a directory to store the case results into. You can optionally provide case numbers and reviewer names. To create a case, use either the "Create New Case" option on the Welcome screen or from the "Case" menu. This will start the <strong>New Case Wizard</strong>. You will need to supply it with the name of the case and a directory to store the case results into. You can optionally provide case numbers and reviewer names.
\subsection s3 Adding a Data Source \subsection s3 Adding a Data Source
The next step is to add an input data source to the case. The <strong>Add Data Source Wizard</strong> will start automatically after the case is created or you can manually start it from the &quot;File&quot; menu or toolbar. You will need to choose the type of input data source to add (image, local disk, or logical files and folders). Next, supply it with the location of the source to add. The next step is to add an input data source to the case. The <strong>Add Data Source Wizard</strong> will start automatically after the case is created or you can manually start it from the &quot;Case&quot; menu or toolbar. You will need to choose the type of input data source to add (image, local disk, or logical files and folders). Next, supply it with the location of the source to add.
- For a disk image, browse to the first file in the set (Autopsy will find the rest of the files). Autopsy currently supports E01 and raw (dd) files. - For a disk image, browse to the first file in the set (Autopsy will find the rest of the files). Autopsy currently supports E01 and raw (dd) files.
@ -114,7 +114,7 @@ You can select an image or video from the upper right and view the video or imag
A final report can be generated that will include all analysis results. A final report can be generated that will include all analysis results.
Use the &quot;Generate Report&quot; button to create this. Use the &quot;Generate Report&quot; button to create this.
It will create an HTML or XLS report in the Reports folder of the case folder. It will create an HTML or XLS report in the Reports folder of the case folder.
If you forgot the location of your case folder, you can determine it using the &quot;Case Properties&quot; option in the &quot;File&quot; menu. If you forgot the location of your case folder, you can determine it using the &quot;Case Properties&quot; option in the &quot;Case&quot; menu.
There is also an option to export report files to a separate folder outside of the case folder. There is also an option to export report files to a separate folder outside of the case folder.
*/ */