Update data_source_integrity.dox

This commit is contained in:
Richard Cordovano 2018-12-14 13:59:47 -05:00 committed by GitHub
parent c26136aee1
commit d155fd9a38
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23

View File

@ -17,18 +17,18 @@ You can do this in the Add Data Source wizard where you select your disk image.
You can enter any combination of hashes to be verified.
In either mode, you'll next need to configure the ingest module.
You'll next need to configure the ingest module.
\image html data_source_integrity_ingest_settings.png
Note that this is simply enabling one or both modes, not choosing which one to run (compute vs. verify). That is determined solely by whether the data source
Note that this is simply enabling one or both behaviors, not choosing which one to run (compute vs. verify). That is determined solely by whether the data source
has associated hashes. Unchecking both boxes but leaving the module enabled will lead to an ingest module startup error
\section data_source_integrity_results Viewing results
\subsection data_source_integrity_verification Hash verification mode
\subsection data_source_integrity_verification Hash verification
In verification mode, if the check succeeds you'll see an inbox message confirming it. If you open the message you'll see the stored and computed hash values.
When verifying, if the check succeeds you'll see an inbox message confirming it. If you open the message you'll see the stored and computed hash values.
\image html data_source_integrity_pass1.png
<br>
@ -42,7 +42,7 @@ The inbox messages will disappear after the case is closed, so the module also a
\image html data_source_integrity_failed_artifact.png
\subsection data_source_integrity_computation Hash computation mode
\subsection data_source_integrity_computation Hash computation
To view the calculated hashes, select "Data Sources" in the tree, select your data source in the result viewer, and then open the "File Metadata" tab. If you're in "Group by data source" mode (see \ref view_options_page), select "Data Source Files" under the data source you want to examine.