Added Personas doc
BIN
docs/doxygen-user/images/persona_edit.png
Normal file
After Width: | Height: | Size: 19 KiB |
BIN
docs/doxygen-user/images/personas_calllog.png
Normal file
After Width: | Height: | Size: 64 KiB |
BIN
docs/doxygen-user/images/personas_contact_found.png
Normal file
After Width: | Height: | Size: 71 KiB |
BIN
docs/doxygen-user/images/personas_contact_not_found.png
Normal file
After Width: | Height: | Size: 9.9 KiB |
BIN
docs/doxygen-user/images/personas_create.png
Normal file
After Width: | Height: | Size: 24 KiB |
BIN
docs/doxygen-user/images/personas_create_account.png
Normal file
After Width: | Height: | Size: 4.5 KiB |
BIN
docs/doxygen-user/images/personas_cvt_accounts.png
Normal file
After Width: | Height: | Size: 57 KiB |
BIN
docs/doxygen-user/images/personas_cvt_hover.png
Normal file
After Width: | Height: | Size: 10 KiB |
BIN
docs/doxygen-user/images/personas_main.png
Normal file
After Width: | Height: | Size: 29 KiB |
BIN
docs/doxygen-user/images/personas_message.png
Normal file
After Width: | Height: | Size: 62 KiB |
@ -71,6 +71,7 @@ The following topics are available here:
|
||||
- \subpage communications_page
|
||||
- \subpage geolocation_page
|
||||
- \subpage discovery_page
|
||||
- \subpage personas_page
|
||||
|
||||
- Reporting
|
||||
- \subpage tagging_page
|
||||
|
107
docs/doxygen-user/personas.dox
Normal file
@ -0,0 +1,107 @@
|
||||
/*! \page personas_page Personas
|
||||
|
||||
\section personas_overview Overview
|
||||
|
||||
Autopsy can store and organize account information based on personas, which represent an online identity. A person may have several online identities and therefore several personas. As an example, a single person may have a set of accounts that post online about loving cats and another set of accounts that appear unrelated that post about hating cats.
|
||||
|
||||
\section personas_concepts Concepts
|
||||
|
||||
Here are some basic concepts about persona:
|
||||
<ul>
|
||||
<li>To make a persona, you need to have a name and at least one account.
|
||||
<li>A persona may have multiple accounts - a phone number, an email, a Facebook account, a Skype account, etc.
|
||||
<li>Personas span cases and therefore are stored in the \ref central_repo_page "Central Repository".
|
||||
<li>You can manually create a persona or make one based on a contact book entry, or a call log, or a message.
|
||||
<li>An account may be part of multiple personas. This can happen if someone uses the same cell phone as a recovery number for accounts on multiple personas.
|
||||
<li>A persona may have additional metadata associated with it as name/value pairs.
|
||||
<li>A persona may have one or more aliases.
|
||||
<li>Autopsy will show you if an account is part of a persona, where applicable.
|
||||
</ul>
|
||||
|
||||
Personas are stored in the Central Repository based on accounts that were found in results. These results are generated by various ingest modules such as the \ref recent_activity_page and \ref android_analyzer_page.
|
||||
|
||||
Autopsy provides a dedicated tool, \ref personas_editor "Personas Editor", to create, view, edit, and delete personas.
|
||||
|
||||
\section personas_editor Personas Editor
|
||||
|
||||
The Personas Editor is loaded through the Tools -> Personas menu item.
|
||||
|
||||
The left panel in the Personas Editor is a table that lists personas, based on the selected criteria. The right panel displays the details of selected persona.
|
||||
|
||||
By default, when the Personas Editor is launched, all the personas in the Central Repository are listed in the table. You may filter this list by checking the "Filter personas by Keyword" checkbox. Type in either a persona name or an account identifier in the textbox and select the "Name" or "Account" radio button appropriately. Then click the "Show" button to show only the personas that match the filtering criteria.
|
||||
|
||||
\image html personas_main.png
|
||||
|
||||
\subsection personas_create Create Personas
|
||||
|
||||
To create a new persona, click the "New Persona" button. A "Create Persona" dialog box will pop up. The following is a description of each field:
|
||||
|
||||
<ul>
|
||||
<li><b>Created by</b>: Will be automatically filled in with the current user
|
||||
<li><b>Created on</b>: Will be automatically filled in after saving the persona
|
||||
<li><b>Comment</b>: A description of the persona
|
||||
<li><b>Name</b>: The name of the persona
|
||||
<li><b>Accounts</b>: At least one account belonging to the persona
|
||||
<li><b>Metadata</b>: (Optional) Name/value pairs of data related to the persona
|
||||
<li><b>Aliases</b>: (Optional) Any aliases for this persona
|
||||
<li><b>Cases found in</b>: Will be automatically filled in when editing a persona
|
||||
</ul>
|
||||
|
||||
Each persona needs at least one account associated with it. These accounts must have been previously saved to the \ref central_repo_page "central repository". Clicking "Add" under "Accounts" will bring up another dialog with four fields, all required:
|
||||
|
||||
<ul>
|
||||
<li><b>Identifier</b>: The identifier for the account (phone number, email address, Facebook account id, etc)
|
||||
<li><b>Type</b>: The type of identifier
|
||||
<li><b>Confidence</b>: General confidence that this account goes with the given persona
|
||||
<li><b>Justification</b>: Why this account is being added to the persona
|
||||
</ul>
|
||||
|
||||
\image html personas_create.png
|
||||
|
||||
When finished adding at least one account and filling in the required fields, click on OK to create the persona. A persona with the specified name will be created and associated with the specified account(s).
|
||||
|
||||
\subsection personas_edit Edit Personas
|
||||
|
||||
To edit a persona, click the "Edit Persona" button. You'll be able to edit all the data about the persona.
|
||||
|
||||
\image html persona_edit.png
|
||||
|
||||
\subsection personas_delete Delete Personas
|
||||
|
||||
To delete a persona, select the persona in the table and click on the "Delete Persona" button. Click "Yes" on confirmation dialog to delete the selected persona.
|
||||
|
||||
\subsection personas_account_create Create Account
|
||||
|
||||
All personas must be associated with at least one account. Normally these account will be added to the central repository by various ingest modules, but you can also create them manually with the "Create Account" button.
|
||||
|
||||
\image html personas_create_account.png
|
||||
|
||||
\section personas_artifact_viewers Persona integration in Content Viewers
|
||||
|
||||
Autopsy shows persona associated with accounts, where applicable. When viewing contact, call log and message results, Autopsy shows the personas associated with accounts in these panels. If no persona exists for an account, Autopsy provides a button for the user to create one.
|
||||
|
||||
As shown below, when viewing a contact result you may see persona data. When one or more personas are found associated with the accounts in the result then the Persona name is shown in the contact content viewer. There will be a "View" button to see the details of the persona.
|
||||
|
||||
\image html personas_contact_found.png
|
||||
|
||||
If no matching persona is found, a "Create" button is shown to create a persona for the account(s). This will bring you to the \ref personas_create "Create Personas" panel with the account(s) already added.
|
||||
|
||||
\image html personas_contact_not_found.png
|
||||
|
||||
Personas are integrated similarly in the content viewers for call logs and messages/e-mail.
|
||||
|
||||
\image html personas_calllog.png
|
||||
<br>
|
||||
\image html personas_message.png
|
||||
|
||||
\section personas_cvt Persona Integration in the Communications Visualization Tool
|
||||
|
||||
Personas are integrated with the \ref communications_page. When viewing accounts in the Accounts browsers in the Communications Visualization Tool, associated persona information is shown in the tooltip if you hover over the account.
|
||||
|
||||
\image html personas_cvt_hover.png
|
||||
|
||||
As in the Autopsy main window, you may also create or view personas when examining contacts, call logs, and messages in the Communications Visualization Tool.
|
||||
|
||||
\image html personas_cvt_accounts.png
|
||||
|
||||
*/
|