merge from release

Core/src/org/sleuthkit/autopsy/discovery/search/DiscoveryEventUtils.java

@@ -135,6 +135,9 @@ public final class DiscoveryEventUtils {
 
         /**
          * Construct a new PopulateDomainTabsEvent.
+         *
+         * @param domain The domain this event is for, or empty if no domain is
+         *               selected.
          */
         public PopulateDomainTabsEvent(String domain) {
             this.domain = domain;
@@ -236,6 +239,7 @@ public final class DiscoveryEventUtils {
 
         private final List<BlackboardArtifact> listOfArtifacts = new ArrayList<>();
         private final BlackboardArtifact.ARTIFACT_TYPE artifactType;
+        private final boolean grabFocus;
 
         /**
          * Construct a new ArtifactSearchResultEvent with a list of specified
@@ -243,12 +247,15 @@ public final class DiscoveryEventUtils {
          *
          * @param artifactType    The type of results in the list.
          * @param listOfArtifacts The list of results retrieved.
+         * @param shouldGrabFocus True if the list of artifacts should have
+         *                        focus, false otherwise.
          */
-        public ArtifactSearchResultEvent(BlackboardArtifact.ARTIFACT_TYPE artifactType, List<BlackboardArtifact> listOfArtifacts) {
+        public ArtifactSearchResultEvent(BlackboardArtifact.ARTIFACT_TYPE artifactType, List<BlackboardArtifact> listOfArtifacts, boolean shouldGrabFocus) {
             if (listOfArtifacts != null) {
                 this.listOfArtifacts.addAll(listOfArtifacts);
             }
             this.artifactType = artifactType;
+            this.grabFocus = shouldGrabFocus;
         }
 
         /**
@@ -268,6 +275,17 @@ public final class DiscoveryEventUtils {
         public BlackboardArtifact.ARTIFACT_TYPE getArtifactType() {
             return artifactType;
         }
+
+        /**
+         * Get whether or not the artifacts list should grab focus.
+         *
+         * @return True if the list of artifacts should have focus, false
+         *         otherwise.
+         */
+        public boolean shouldGrabFocus() {
+            return grabFocus;
+        }
+
     }
 
     /**
@@ -278,18 +296,22 @@ public final class DiscoveryEventUtils {
 
         private final List<MiniTimelineResult> results = new ArrayList<>();
         private final String domain;
+        private final boolean grabFocus;
 
         /**
          * Construct a new MiniTimelineResultEvent.
          *
-         * @param results The list of MiniTimelineResults contained in this
-         *                event.
-         * @param domain  The domain the results are for.
+         * @param results         The list of MiniTimelineResults contained in
+         *                        this event.
+         * @param domain          The domain the results are for.
+         * @param shouldGrabFocus True if the list of dates should have focus,
+         *                        false otherwise.
          */
-        public MiniTimelineResultEvent(List<MiniTimelineResult> results, String domain) {
+        public MiniTimelineResultEvent(List<MiniTimelineResult> results, String domain, boolean shouldGrabFocus) {
             if (results != null) {
                 this.results.addAll(results);
             }
+            this.grabFocus = shouldGrabFocus;
             this.domain = domain;
         }
 
@@ -310,6 +332,15 @@ public final class DiscoveryEventUtils {
         public String getDomain() {
             return domain;
         }
+
+        /**
+         * Get whether or not the dates list should grab focus.
+         *
+         * @return True if the list of dates should have focus, false otherwise.
+         */
+        public boolean shouldGrabFocus() {
+            return grabFocus;
+        }
     }
 
     /**

Core/src/org/sleuthkit/autopsy/discovery/ui/ArtifactsListPanel.java

@@ -82,6 +82,14 @@ final class ArtifactsListPanel extends AbstractArtifactListPanel {
         artifactsTable.getSelectionModel().addListSelectionListener(listener);
     }
 
+    /**
+     * Assign the focus to this panel's list.
+     */
+    @ThreadConfined(type = ThreadConfined.ThreadType.AWT)
+    void focusList() {
+        artifactsTable.grabFocus();
+    }
+
     @Override
     void removeSelectionListener(ListSelectionListener listener) {
         artifactsTable.getSelectionModel().removeListSelectionListener(listener);

Core/src/org/sleuthkit/autopsy/discovery/ui/ArtifactsWorker.java

@@ -41,16 +41,21 @@ class ArtifactsWorker extends SwingWorker<List<BlackboardArtifact>, Void> {
     private final BlackboardArtifact.ARTIFACT_TYPE artifactType;
     private final static Logger logger = Logger.getLogger(ArtifactsWorker.class.getName());
     private final String domain;
+    private final boolean grabFocus;
 
     /**
      * Construct a new ArtifactsWorker.
      *
-     * @param artifactType The type of artifact being retrieved.
-     * @param domain       The domain the artifacts should have as an attribute.
+     * @param artifactType    The type of artifact being retrieved.
+     * @param domain          The domain the artifacts should have as an
+     *                        attribute.
+     * @param shouldGrabFocus True if the list of artifacts should have focus,
+     *                        false otherwise.
      */
-    ArtifactsWorker(BlackboardArtifact.ARTIFACT_TYPE artifactType, String domain) {
+    ArtifactsWorker(BlackboardArtifact.ARTIFACT_TYPE artifactType, String domain, boolean shouldGrabFocus) {
         this.artifactType = artifactType;
         this.domain = domain;
+        this.grabFocus = shouldGrabFocus;
     }
 
     @Override
@@ -61,7 +66,7 @@ class ArtifactsWorker extends SwingWorker<List<BlackboardArtifact>, Void> {
                 return domainSearch.getArtifacts(new DomainSearchArtifactsRequest(Case.getCurrentCase().getSleuthkitCase(), domain, artifactType));
             } catch (DiscoveryException ex) {
                 if (ex.getCause() instanceof InterruptedException) {
-                      this.cancel(true);
+                    this.cancel(true);
                     //ignore the exception as it was cancelled while the cache was performing its get and we support cancellation
                 } else {
                     throw ex;
@@ -77,7 +82,7 @@ class ArtifactsWorker extends SwingWorker<List<BlackboardArtifact>, Void> {
         if (!isCancelled()) {
             try {
                 listOfArtifacts.addAll(get());
-                DiscoveryEventUtils.getDiscoveryEventBus().post(new DiscoveryEventUtils.ArtifactSearchResultEvent(artifactType, listOfArtifacts));
+                DiscoveryEventUtils.getDiscoveryEventBus().post(new DiscoveryEventUtils.ArtifactSearchResultEvent(artifactType, listOfArtifacts, grabFocus));
             } catch (InterruptedException | ExecutionException ex) {
                 logger.log(Level.SEVERE, "Exception while trying to get list of artifacts for Domain details for artifact type: "
                         + artifactType.getDisplayName() + " and domain: " + domain, ex);

Core/src/org/sleuthkit/autopsy/discovery/ui/DomainArtifactsTabPanel.java

@@ -95,6 +95,14 @@ final class DomainArtifactsTabPanel extends JPanel {
         }
     }
 
+    /**
+     * Assign the focus to this panel's list.
+     */
+    @ThreadConfined(type = ThreadConfined.ThreadType.AWT)
+    void focusList() {
+        listPanel.focusList();
+    }
+
     /**
      * Get the status of the panel which indicates if it is populated.
      *
@@ -144,6 +152,9 @@ final class DomainArtifactsTabPanel extends JPanel {
                 listPanel.selectFirst();
                 removeAll();
                 add(mainSplitPane);
+                if (artifactresultEvent.shouldGrabFocus()) {
+                    focusList();
+                }
                 revalidate();
                 repaint();
                 try {

Core/src/org/sleuthkit/autopsy/discovery/ui/DomainDetailsPanel.java

@@ -81,9 +81,9 @@ final class DomainDetailsPanel extends JPanel {
                         selectedTabName = newTabTitle;
                         Component selectedComponent = jTabbedPane1.getSelectedComponent();
                         if (selectedComponent instanceof DomainArtifactsTabPanel) {
-                            runDomainWorker((DomainArtifactsTabPanel) selectedComponent);
+                            runDomainWorker((DomainArtifactsTabPanel) selectedComponent, true);
                         } else if (selectedComponent instanceof MiniTimelinePanel) {
-                            runMiniTimelineWorker((MiniTimelinePanel) selectedComponent);
+                            runMiniTimelineWorker((MiniTimelinePanel) selectedComponent, true);
                         }
                     }
                 }
@@ -122,17 +122,24 @@ final class DomainDetailsPanel extends JPanel {
     /**
      * Run the worker which retrieves the list of artifacts for the domain to
      * populate the details area.
+     *
+     * @param domainArtifactsTabPanel The DomainArtifactsTabPanel which has been
+     *                                selected.
+     * @param shouldGrabFocus         True if the list of artifacts should have
+     *                                focus, false otherwise.
      */
     @ThreadConfined(type = ThreadConfined.ThreadType.AWT)
-    private void runDomainWorker(DomainArtifactsTabPanel domainArtifactsTabPanel) {
+    private void runDomainWorker(DomainArtifactsTabPanel domainArtifactsTabPanel, boolean shouldGrabFocus) {
         if (singleArtifactDomainWorker != null && !singleArtifactDomainWorker.isDone()) {
             singleArtifactDomainWorker.cancel(true);
         }
         if (domainArtifactsTabPanel.getStatus() == DomainArtifactsTabPanel.ArtifactRetrievalStatus.UNPOPULATED) {
             DiscoveryEventUtils.getDiscoveryEventBus().register(domainArtifactsTabPanel);
             domainArtifactsTabPanel.setStatus(DomainArtifactsTabPanel.ArtifactRetrievalStatus.POPULATING);
-            singleArtifactDomainWorker = new ArtifactsWorker(domainArtifactsTabPanel.getArtifactType(), domain);
+            singleArtifactDomainWorker = new ArtifactsWorker(domainArtifactsTabPanel.getArtifactType(), domain, shouldGrabFocus);
             singleArtifactDomainWorker.execute();
+        } else if (domainArtifactsTabPanel.getStatus() == DomainArtifactsTabPanel.ArtifactRetrievalStatus.POPULATED) {
+            domainArtifactsTabPanel.focusList();
         }
 
     }
@@ -140,11 +147,17 @@ final class DomainDetailsPanel extends JPanel {
     /**
      * Run the worker which retrieves the list of MiniTimelineResults for the
      * mini timeline view to populate.
+     *
+     * @param miniTimelinePanel The MiniTimelinePanel which has been selected.
+     * @param shouldGrabFocus   True if the list of dates should have focus,
+     *                          false otherwise.
      */
-    private void runMiniTimelineWorker(MiniTimelinePanel miniTimelinePanel) {
+    private void runMiniTimelineWorker(MiniTimelinePanel miniTimelinePanel, boolean shouldGrabFocus) {
         if (miniTimelinePanel.getStatus() == DomainArtifactsTabPanel.ArtifactRetrievalStatus.UNPOPULATED) {
             miniTimelinePanel.setStatus(DomainArtifactsTabPanel.ArtifactRetrievalStatus.POPULATING, domain);
-            new MiniTimelineWorker(domain).execute();
+            new MiniTimelineWorker(domain, shouldGrabFocus).execute();
+        } else if (miniTimelinePanel.getStatus() == DomainArtifactsTabPanel.ArtifactRetrievalStatus.POPULATED) {
+            miniTimelinePanel.focusList();
         }
     }
 
@@ -162,12 +175,13 @@ final class DomainDetailsPanel extends JPanel {
                 //send fade out event
                 DiscoveryEventUtils.getDiscoveryEventBus().post(new DiscoveryEventUtils.DetailsVisibleEvent(false));
             } else {
+                resetTabsStatus();
                 domain = populateEvent.getDomain();
                 Component selectedComponent = jTabbedPane1.getSelectedComponent();
                 if (selectedComponent instanceof DomainArtifactsTabPanel) {
-                    runDomainWorker((DomainArtifactsTabPanel) selectedComponent);
+                    runDomainWorker((DomainArtifactsTabPanel) selectedComponent, false);
                 } else if (selectedComponent instanceof MiniTimelinePanel) {
-                    runMiniTimelineWorker((MiniTimelinePanel) selectedComponent);
+                    runMiniTimelineWorker((MiniTimelinePanel) selectedComponent, false);
                 }
                 //send fade in event
                 DiscoveryEventUtils.getDiscoveryEventBus().post(new DiscoveryEventUtils.DetailsVisibleEvent(true));

Core/src/org/sleuthkit/autopsy/discovery/ui/MiniTimelineDateListPanel.java

@@ -64,6 +64,14 @@ class MiniTimelineDateListPanel extends JPanel {
         jTable1.getSelectionModel().addListSelectionListener(listener);
     }
 
+    /**
+     * Assign the focus to this panel's list.
+     */
+    @ThreadConfined(type = ThreadConfined.ThreadType.AWT)
+    void focusList() {
+        jTable1.grabFocus();
+    }
+
     /**
      * Remove a listener from the table of dates.
      *

Core/src/org/sleuthkit/autopsy/discovery/ui/MiniTimelinePanel.java

@@ -101,11 +101,19 @@ final class MiniTimelinePanel extends javax.swing.JPanel {
         return status;
     }
 
+    /**
+     * Assign the focus to this panel's list.
+     */
+    @ThreadConfined(type = ThreadConfined.ThreadType.AWT)
+    void focusList() {
+        dateListPanel.focusList();
+    }
+
     /**
      * Manually set the status of the panel.
      *
      * @param status The ArtifactRetrievalStatus of the panel
-     * @param domain  The domain the panel is currently reflecting.
+     * @param domain The domain the panel is currently reflecting.
      */
     @ThreadConfined(type = ThreadConfined.ThreadType.AWT)
     void setStatus(DomainArtifactsTabPanel.ArtifactRetrievalStatus status, String domain) {
@@ -143,6 +151,9 @@ final class MiniTimelinePanel extends javax.swing.JPanel {
                 dateListPanel.addSelectionListener(dateListener);
                 artifactListPanel.addSelectionListener(artifactListener);
                 dateListPanel.selectFirst();
+                if (miniTimelineResultEvent.shouldGrabFocus()) {
+                    focusList();
+                }
                 removeAll();
                 add(mainSplitPane);
                 revalidate();

Core/src/org/sleuthkit/autopsy/discovery/ui/MiniTimelineWorker.java

@@ -33,21 +33,26 @@ import org.sleuthkit.autopsy.discovery.search.DiscoveryException;
 import org.sleuthkit.autopsy.discovery.search.DomainSearch;
 
 /**
- * SwingWorker to retrieve a list of artifacts for a specified type and domain.
+ * SwingWorker to retrieve a list of artifacts organized by date for the
+ * miniTimelinePanel for a specific domain.
  */
 class MiniTimelineWorker extends SwingWorker<Void, Void> {
 
     private final static Logger logger = Logger.getLogger(MiniTimelineWorker.class.getName());
     private final String domain;
+    private final boolean grabFocus;
 
     /**
-     * Construct a new ArtifactsWorker.
+     * Construct a new MiniTimelineWorker.
      *
-     * @param artifactType The type of artifact being retrieved.
-     * @param domain       The domain the artifacts should have as an attribute.
+     * @param domain          The domain the artifacts should have as an
+     *                        attribute.
+     * @param shouldGrabFocus True if the list of artifacts should have focus,
+     *                        false otherwise.
      */
-    MiniTimelineWorker(String domain) {
+    MiniTimelineWorker(String domain, boolean shouldGrabFocus) {
         this.domain = domain;
+        this.grabFocus = shouldGrabFocus;
     }
 
     @Override
@@ -57,7 +62,7 @@ class MiniTimelineWorker extends SwingWorker<Void, Void> {
             DomainSearch domainSearch = new DomainSearch();
             try {
                 results.addAll(domainSearch.getAllArtifactsForDomain(Case.getCurrentCase().getSleuthkitCase(), domain));
-                DiscoveryEventUtils.getDiscoveryEventBus().post(new DiscoveryEventUtils.MiniTimelineResultEvent(results, domain));
+                DiscoveryEventUtils.getDiscoveryEventBus().post(new DiscoveryEventUtils.MiniTimelineResultEvent(results, domain, grabFocus));
             } catch (DiscoveryException ex) {
                 if (ex.getCause() instanceof InterruptedException) {
                     this.cancel(true);

Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/ALeappAnalyzerIngestModule.java

@@ -97,7 +97,7 @@ public class ALeappAnalyzerIngestModule implements DataSourceIngestModule {
         }
 
         try {
-            aLeappFileProcessor = new LeappFileProcessor(XMLFILE);
+            aLeappFileProcessor = new LeappFileProcessor(XMLFILE, ALeappAnalyzerModuleFactory.getModuleName());
         } catch (IOException | IngestModuleException | NoCurrentCaseException ex) {
             throw new IngestModuleException(Bundle.ALeappAnalyzerIngestModule_error_ileapp_file_processor_init(), ex);
         }

Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/ILeappAnalyzerIngestModule.java

@@ -97,7 +97,7 @@ public class ILeappAnalyzerIngestModule implements DataSourceIngestModule {
         }
 
         try {
-            iLeappFileProcessor = new LeappFileProcessor(XMLFILE);
+            iLeappFileProcessor = new LeappFileProcessor(XMLFILE, ILeappAnalyzerModuleFactory.getModuleName());
         } catch (IOException | IngestModuleException | NoCurrentCaseException ex) {
             throw new IngestModuleException(Bundle.ILeappAnalyzerIngestModule_error_ileapp_file_processor_init(), ex);
         }

Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/LeappFileProcessor.java

@@ -126,9 +126,8 @@ public final class LeappFileProcessor {
     }
 
     private static final Logger logger = Logger.getLogger(LeappFileProcessor.class.getName());
-    private static final String MODULE_NAME = ILeappAnalyzerModuleFactory.getModuleName();
-
     private final String xmlFile; //NON-NLS
+    private final String moduleName;
 
     private final Map<String, String> tsvFiles;
     private final Map<String, BlackboardArtifact.Type> tsvFileArtifacts;
@@ -137,12 +136,13 @@ public final class LeappFileProcessor {
 
     Blackboard blkBoard;
 
-    public LeappFileProcessor(String xmlFile) throws IOException, IngestModuleException, NoCurrentCaseException {
+    public LeappFileProcessor(String xmlFile, String moduleName) throws IOException, IngestModuleException, NoCurrentCaseException {
         this.tsvFiles = new HashMap<>();
         this.tsvFileArtifacts = new HashMap<>();
         this.tsvFileArtifactComments = new HashMap<>();
         this.tsvFileAttributes = new HashMap<>();
         this.xmlFile = xmlFile;
+        this.moduleName = moduleName;
 
         blkBoard = Case.getCurrentCaseThrows().getSleuthkitCase().getBlackboard();
 
@@ -366,7 +366,7 @@ public final class LeappFileProcessor {
         }
 
         if (tsvFileArtifactComments.containsKey(fileName)) {
-            attrsToRet.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_COMMENT, MODULE_NAME, tsvFileArtifactComments.get(fileName)));
+            attrsToRet.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_COMMENT, moduleName, tsvFileArtifactComments.get(fileName)));
         }
 
         return attrsToRet;
@@ -400,22 +400,22 @@ public final class LeappFileProcessor {
             case JSON:
             case STRING:
                 return parseAttrValue(value, attrType, fileName, false, false,
-                        (v) -> new BlackboardAttribute(attrType, MODULE_NAME, v));
+                        (v) -> new BlackboardAttribute(attrType, moduleName, v));
             case INTEGER:
                 return parseAttrValue(value.trim(), attrType, fileName, true, false,
-                        (v) -> new BlackboardAttribute(attrType, MODULE_NAME, (int) Double.valueOf(v).intValue()));
+                        (v) -> new BlackboardAttribute(attrType, moduleName, (int) Double.valueOf(v).intValue()));
             case LONG:
                 return parseAttrValue(value.trim(), attrType, fileName, true, false,
-                        (v) -> new BlackboardAttribute(attrType, MODULE_NAME, (long) Double.valueOf(v).longValue()));
+                        (v) -> new BlackboardAttribute(attrType, moduleName, (long) Double.valueOf(v).longValue()));
             case DOUBLE:
                 return parseAttrValue(value.trim(), attrType, fileName, true, false,
-                        (v) -> new BlackboardAttribute(attrType, MODULE_NAME, (double) Double.valueOf(v)));
+                        (v) -> new BlackboardAttribute(attrType, moduleName, (double) Double.valueOf(v)));
             case BYTE:
                 return parseAttrValue(value.trim(), attrType, fileName, true, false,
-                        (v) -> new BlackboardAttribute(attrType, MODULE_NAME, new byte[]{Byte.valueOf(v)}));
+                        (v) -> new BlackboardAttribute(attrType, moduleName, new byte[]{Byte.valueOf(v)}));
             case DATETIME:
                 return parseAttrValue(value.trim(), attrType, fileName, true, true,
-                        (v) -> new BlackboardAttribute(attrType, MODULE_NAME, TIMESTAMP_FORMAT.parse(v).getTime() / 1000));
+                        (v) -> new BlackboardAttribute(attrType, moduleName, TIMESTAMP_FORMAT.parse(v).getTime() / 1000));
             default:
                 // Log this and continue on with processing
                 logger.log(Level.WARNING, String.format("Attribute Type %s for file %s not defined.", attrType, fileName)); //NON-NLS                   
@@ -647,7 +647,7 @@ public final class LeappFileProcessor {
         }
 
         try {
-            Case.getCurrentCase().getSleuthkitCase().getBlackboard().postArtifacts(artifacts, MODULE_NAME);
+            Case.getCurrentCase().getSleuthkitCase().getBlackboard().postArtifacts(artifacts, moduleName);
         } catch (Blackboard.BlackboardException ex) {
             logger.log(Level.SEVERE, Bundle.LeappFileProcessor_postartifacts_error(), ex); //NON-NLS
         }

Experimental/src/org/sleuthkit/autopsy/experimental/autoingest/ManifestFileParser.java

@@ -28,6 +28,7 @@ import java.util.function.Predicate;
 import javax.xml.parsers.DocumentBuilder;
 import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.parsers.ParserConfigurationException;
+import org.sleuthkit.autopsy.core.UserPreferences;
 import org.w3c.dom.Document;
 import org.w3c.dom.Element;
 import org.w3c.tidy.Tidy;
@@ -74,7 +75,7 @@ public interface ManifestFileParser {
     static Path makeTidyManifestFile(Path filePath) throws IOException {
         File tempFile = null;
         try{
-            tempFile = File.createTempFile("mani", "tdy", filePath.getParent().toFile());
+            tempFile = File.createTempFile("mani", "tdy", new File(System.getProperty("java.io.tmpdir")));
 
             try (FileInputStream br = new FileInputStream(filePath.toFile()); FileOutputStream out = new FileOutputStream(tempFile);) {
                 Tidy tidy = new Tidy();

docs/doxygen-user/file_discovery.dox

@@ -124,6 +124,18 @@ When there are multiple path options in the filter, they will be applied as foll
 
 This allows you to, for example, make rules to include both the "My Documents" and the "My Pictures" folders.
 
+\subsubsection file_disc_prev_notable_filter Previously Notable Filter
+
+The previously notable filter is for domain searches only and is used to restrict results to only those domains that have previously been marked as "Notable" in the \ref central_repo_page.
+
+\image html FileDiscovery/fd_notableFilter.png
+
+\subsubsection file_disc_known_account_filter Known Account Type Filter
+
+The previously notable filter is for domain searches only and is used to restrict results to only those domains that have a known account type.
+
+\image html FileDiscovery/fd_knownAccountFilter.png
+
 \subsubsection file_disc_result_filter Result Type Filter
 
 The result type filter is for domain searches only and can be used to restrict which types of web results the domains can come from.
@@ -158,7 +170,7 @@ The last grouping and sorting option is choosing how to sort the results within
 
 \subsection file_disc_results_overview Overview
 
-Once you select your options and click "Search", you'll see a new window with the list of groups on the left side. Selecting one of these groups will display the results from that group on the right side. For image, video, and document searches, selecting a result will cause a panel to rise showing more details about each instance of that result. You can manually raise and lower this panel using the large arrows on the right side of the divider. This panel is disabled for domain searches.
+Once you select your options and click "Search", you'll see a new window with the list of groups on the left side. Selecting one of these groups will display the results from that group on the right side. Selecting a result will cause a panel to rise showing more details about each instance of that result. You can manually raise and lower this panel using the large arrows on the right side of the divider.
 
 If your results are images, you'll see thumbnails for each image in the top area of the right panel.
 
@@ -182,6 +194,10 @@ For image, video, and document searches, when you select a result from the top o
 
 The bottom section of the panel is identical to the standard \ref content_viewer_page and displays data corresponding to the file instance selected in the middle of the panel.
 
+For domain searches, when you select a domain in the top of the right panel you'll see a details area that is a variation on the \ref content_viewer_page. The first tab on details panel displays a simple timeline - selecting a date will show all the results from that date in the center of the panel, with details for the selected result on the right. The other tabs (Web Bookmarks, Web Cookies, etc.) display results of the selected type with a list of results on the left and more details on the right. You can right-click on results to use most of options available in the normal \ref result_viewer_page.
+
+\image html FileDiscovery/fd_domainDetails.png
+
 \subsection file_disc_dedupe De-duplication
 
 This section only applies to image, video and document searches.