mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-06 21:00:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

Updated common files doc and volatility doc.

Browse Source 
Updated copyright date.
This commit is contained in:
Ann Priestman 2018-06-22 09:31:09 -04:00
parent 9c55f53dd4
commit d228343014
5 changed files with 7 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
docs/doxygen-user/common_files.dox
View File

@ -16,7 +16,7 @@ You can choose to find any files with multiple copies in the whole case, or spec
You can also choose to restrict the search to only pictures and videos and/or documents.
Once the search is run, the matching files are displayed in the results tab and are grouped by hash.
Once the search is run, the matching files are displayed in the results tab. The results are grouped by how many matching files were found and then grouped by hash.
\image html common_files_results.png

2
docs/doxygen-user/footer.html
View File

@ -1,5 +1,5 @@
<hr/>
<p><i>Copyright &#169; 2012-2016 Basis Technology. Generated on $date<br/>
<p><i>Copyright &#169; 2012-2018 Basis Technology. Generated on $date<br/>
This work is licensed under a
<a rel="license" href="http://creativecommons.org/licenses/by-sa/3.0/us/">Creative Commons Attribution-Share Alike 3.0 United States License</a>.
</i></p>

BIN
docs/doxygen-user/images/common_files_results.png
View File

Binary file not shown.
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 46 KiB

After

Width:  |  Height:  |  Size: 44 KiB

8
docs/doxygen-user/volatility_dsp.dox
View File

@ -2,7 +2,7 @@
\section Overview
The Volatility data source processor runs Volatility on a memory image and saves the individual module results. If the disk image associated with the memory image is also available, it will create Intesting Item artifacts linking the Volatility results to files in the disk image.
The Volatility data source processor runs Volatility on a memory image and saves the individual Volatility module results. If the disk image associated with the memory image is also available, it will create Interesting Item artifacts linking the Volatility results to files in the disk image.
\section Usage
@ -14,15 +14,15 @@ On the next screen, you can select your memory image and then adjust the setting
\image html volatility_dsp_config.png
Next you'll see the ingest module configuration panel. No ingest modules will be run when using the Volatility data source processor, so simply hit the "Next" button. When it finishes, you may have some non-critical errors. These frequently come from the data source processor being unable to find files in the original disk image.
Next you'll see the ingest module configuration panel. No ingest modules will be run when using the Volatility data source processor, so simply hit the "Next" button. When it finishes, you may have some non-critical errors. These frequently come from the data source processor being unable to find files in the original disk image. If you did not add the associated disk image before running the Volatility data source processor on the memory image, there will be a large number of these errors but the Volatility module output will still be available.
\section Results
There are two types of results that come from running the Volatility data source processor: Module Output and Interesting Items. The Module Output section is found under the memory image in the tree.
There are two types of results that come from running the Volatility data source processor: Module Output and Interesting Items (if the disk image was added). The Module Output section is found under the memory image in the tree.
\image html volatility_dsp_module_output.PNG
You can also view the Volatility output under "ModuleOutput/Volatility" in the Autopsy case folder. The Interesting Items link file paths found by Volatility with files in the disk image.
You can also view the Volatility output under "ModuleOutput/Volatility" in the Autopsy case folder. The Interesting Items link file paths found by Volatility with files in the disk image. If a disk image was not added, there will not be any Interesting Items.
\image html volatility_dsp_interesting_items.PNG

2
docs/doxygen/footer.html
View File

@ -1,5 +1,5 @@
<hr/>
<p><i>Copyright &#169; 2012-2016 Basis Technology. Generated on: $date<br/>
<p><i>Copyright &#169; 2012-2018 Basis Technology. Generated on: $date<br/>
This work is licensed under a
<a rel="license" href="http://creativecommons.org/licenses/by-sa/3.0/us/">Creative Commons Attribution-Share Alike 3.0 United States License</a>.
</i></p>