cancelledModules = snapshot.getCancelledDataSourceIngestModules();
+ if (!cancelledModules.isEmpty()) {
+ LOGGER.log(Level.WARNING, String.format("Ingest module(s) cancelled for %s", dataSource.getPath()));
+ for (String module : snapshot.getCancelledDataSourceIngestModules()) {
+ LOGGER.log(Level.WARNING, String.format("%s ingest module cancelled for %s", module, dataSource.getPath()));
+ }
+ }
+ LOGGER.log(Level.INFO, "Analysis of data source completed");
+ } else {
+ LOGGER.log(Level.WARNING, "Analysis of data source cancelled");
+ IngestJob.CancellationReason cancellationReason = snapshot.getCancellationReason();
+ if (IngestJob.CancellationReason.NOT_CANCELLED != cancellationReason && IngestJob.CancellationReason.USER_CANCELLED != cancellationReason) {
+ return NbBundle.getMessage(MultiUserTestTool.class, "MultiUserTestTool.ingestCancelled", cancellationReason.getDisplayName());
+ }
+ }
+ }
+ } else if (!ingestJobStartResult.getModuleErrors().isEmpty()) {
+ for (IngestModuleError error : ingestJobStartResult.getModuleErrors()) {
+ LOGGER.log(Level.SEVERE, String.format("%s ingest module startup error for %s", error.getModuleDisplayName(), dataSource.getPath()), error.getThrowable());
+ }
+ LOGGER.log(Level.SEVERE, "Failed to analyze data source due to ingest job startup error");
+ return Bundle.MultiUserTestTool_startupError();
+ } else {
+ LOGGER.log(Level.SEVERE, String.format("Ingest manager ingest job start error for %s", dataSource.getPath()), ingestJobStartResult.getStartupException());
+ return Bundle.MultiUserTestTool_errorStartingIngestJob();
+ }
+ } else {
+ for (String warning : settingsWarnings) {
+ LOGGER.log(Level.SEVERE, "Ingest job settings error for {0}: {1}", new Object[]{dataSource.getPath(), warning});
+ }
+ return Bundle.MultiUserTestTool_ingestSettingsError();
+ }
+ }
+ } finally {
+ IngestManager.getInstance().removeIngestJobEventListener(ingestJobEventListener);
+ }
+ // ingest completed successfully
+ return "";
+ }
+
+ /**
+ * Tests service of interest to verify that it is running.
+ *
+ * @param serviceName Name of the service.
+ *
+ * @return True if the service is running, false otherwise.
+ *
+ * @throws ServicesMonitorException if there is an error querying the
+ * services monitor.
+ */
+ private static boolean isServiceUp(String serviceName) throws ServicesMonitor.ServicesMonitorException {
+ return (ServicesMonitor.getInstance().getServiceStatus(serviceName).equals(ServicesMonitor.ServiceStatus.UP.toString()));
+ }
+
+ /**
+ * A data source processor progress monitor does nothing. There is currently
+ * no mechanism for showing or recording data source processor progress
+ * during an ingest job.
+ */
+ private static class DoNothingDSPProgressMonitor implements DataSourceProcessorProgressMonitor {
+
+ /**
+ * Does nothing.
+ *
+ * @param indeterminate
+ */
+ @Override
+ public void setIndeterminate(final boolean indeterminate) {
+ }
+
+ /**
+ * Does nothing.
+ *
+ * @param progress
+ */
+ @Override
+ public void setProgress(final int progress) {
+ }
+
+ /**
+ * Does nothing.
+ *
+ * @param text
+ */
+ @Override
+ public void setProgressText(final String text) {
+ }
+ }
+
+ /**
+ * An ingest job event listener that allows the job processing task to block
+ * until the analysis of a data source by the data source level and file
+ * level ingest modules is completed.
+ *
+ * Note that the ingest job can spawn "child" ingest jobs (e.g., if an
+ * embedded virtual machine is found), so the job processing task must
+ * remain blocked until ingest is no longer running.
+ */
+ private static class IngestJobEventListener implements PropertyChangeListener {
+
+ /**
+ * Listens for local ingest job completed or cancelled events and
+ * notifies the job processing thread when such an event occurs and
+ * there are no "child" ingest jobs running.
+ *
+ * @param event
+ */
+ @Override
+ public void propertyChange(PropertyChangeEvent event) {
+ if (AutopsyEvent.SourceType.LOCAL == ((AutopsyEvent) event).getSourceType()) {
+ String eventType = event.getPropertyName();
+ if (eventType.equals(IngestManager.IngestJobEvent.COMPLETED.toString()) || eventType.equals(IngestManager.IngestJobEvent.CANCELLED.toString())) {
+ synchronized (INGEST_LOCK) {
+ INGEST_LOCK.notifyAll();
+ }
+ }
+ }
+ }
+ };
+}
diff --git a/docs/doxygen-user/content_viewer.dox b/docs/doxygen-user/content_viewer.dox
index 3a06fa89fa..d7f3420fbc 100644
--- a/docs/doxygen-user/content_viewer.dox
+++ b/docs/doxygen-user/content_viewer.dox
@@ -1,20 +1,20 @@
/*! \page content_viewer_page Content Viewer
-The Content Viewer lives in the lower right-hand side of the Autopsy main screen and shows pictures, video, hex, text, extracted strings, metadata, etc. The Content Viewer is enabled when you select an entry in the \ref ui_results.
+The Content Viewer lives in the lower right-hand side of the Autopsy main screen and shows pictures, video, hex, text, extracted strings, metadata, etc. The Content Viewer is populated when you select an entry in the \ref ui_results.
The Content Viewer is context-aware, meaning different tabs will be enabled depending on the type of content selected and which ingest modules have been run. It will default to what it considers the "most specific" tab. For example, selecting a JPG will cause the Content Viewer to automatically select the "Application" tab and will display the image there. If you instead would like the Content Viewer to stay on the previously selected tab when you change to a different content object, go to the \ref view_options_page panel through Tools->Options->Application Tab and select the "Stay on the same file viewer" option.
\image html content_viewer_options_panel.png
-When a Result type is selected in the Result Viewer (as opposed to a file), most of the tabs will correspond to the file associated with the result and not the result itself. For example, when selecting a Keyword Hit, the "Hex", "Strings", and "File Metadata" tabs will show data from the file where the keyword was found. The descriptions below will generally assume a file has been selected, but most also apply when we have a file associated with a selected result.
+When a result item is selected in the Result Viewer (as opposed to a file), most of the tabs will correspond to the file associated with the result and not the result itself. For example, when selecting a keyword hit, the "Hex", "Strings", and "File Metadata" tabs will show data from the file where the keyword was found. The descriptions below will generally assume a file has been selected, but most also apply when we have a file associated with a selected result.
\section cv_hex Hex
-The Hex Content Viewer is nearly always available and shows you the raw and exact contents of a file. In this content viewer, the data of the file is represented as hexadecimal values grouped in 2 groups of 8 bytes, followed by one group of 16 ASCII characters which are derived from each pair of hex values (each byte). Non-printable ASCII characters and characters that would take more than one character space are typically represented by a dot (".") in the following ASCII field.
+The Hex tab is nearly always available and shows you the raw and exact contents of a file. In this tab, the data of the file is represented as hexadecimal values grouped in 2 groups of 8 bytes, followed by one group of 16 ASCII characters which are derived from each pair of hex values (each byte). Non-printable ASCII characters and characters that would take more than one character space are typically represented by a dot (".") in the following ASCII field.
\image html content_viewer_hex.png
-If desired, you can open the file in an external hex editor. This is configured through the "External Viewer" tab on the options panel. HxD has been tested to work, but alternate hex editors may also be compatible.
+If desired, you can open the file in an external hex editor. This is configured through the "External Viewer" tab on the options panel. HxD has been verified to work with Autopsy, but alternate hex editors may also be compatible.
\image html content_viewer_hex_editor_setup.png
@@ -22,12 +22,30 @@ Note that this process saves the file to disk before launching the hex editor. A
\image html content_viewer_hxd_progress.png
-\section cv_strings Strings
+\section cv_text Text
-The Strings tab shows all text strings found in the file. Different scripts can be chosen from the drop-down menu to display results for non-Latin alphabets.
+The Text tab has three sub tabs for displaying the text contained in the selected item.
+
+\subsection cv_strings Strings
+
+The Strings tab shows all text strings found in the file for the given script selected in the upper right. By default Latin text is used.
+
+\image html content_viewer_strings_latin.png
+
+Different scripts can be chosen from the drop-down menu to display results for non-Latin alphabets.
\image html content_viewer_strings_cyrillic.png
+\subsection cv_indexed_text Indexed Text
+
+The Indexed Text tab shows the text that has been indexed by the \ref keyword_search_page. You can switch the "Text Source" field to "Result Text" to see the text that has been indexed for the results associated with a file.
+
+\image html content_viewer_indexed_text.png
+
+\subsection cv_translation Translation
+
+If you have a translation service enabled, the Translation tab allows you to translate the text. See the \ref machine_translation_page page for more information.
+
\section cv_app Application
For certain file types, the Application tab can display the contents in a user friendly format. The following screenshots show some examples of what the Application tab will display.
@@ -48,11 +66,9 @@ HTML files can be displayed closer to their original form:
\image html content_viewer_html.png
-\section cv_indexed_text Indexed Text
+Registry hive files can be viewed in a format similar to a registry editor.
-The Indexed Text tab shows the text that has been indexed by the Keyword Search module. You can switch the "Text Source" Field to "Result Text" to see which text has been indexed for associated results.
-
-\image html content_viewer_indexed_text.png
+\image html content_viewer_registry.png
\section cv_message Message
@@ -68,7 +84,7 @@ The File Metadata tab displays basic information about the file, such as type, s
\section cv_results Results
-The Results tab is active when selecting entries that are part of the Results tree, such as keyword hits, call logs, and messages. It is also active when looking at a file that has results associated with it. The exact fields displayed depend on the type of entry. The two images below show the Results tab for a call log and a web bookmark.
+The Results tab is active when selecting items with associated results such as keyword hits, call logs, and messages. The exact fields displayed depend on the type of result. The two images below show the Results tab for a call log and a web bookmark.
\image html content_viewer_results_call.png
diff --git a/docs/doxygen-user/images/content_viewer_annotations.png b/docs/doxygen-user/images/content_viewer_annotations.png
index fed1346e5c..671a842099 100644
Binary files a/docs/doxygen-user/images/content_viewer_annotations.png and b/docs/doxygen-user/images/content_viewer_annotations.png differ
diff --git a/docs/doxygen-user/images/content_viewer_app_image.png b/docs/doxygen-user/images/content_viewer_app_image.png
index 8ceff5cb0a..42b57d27c6 100644
Binary files a/docs/doxygen-user/images/content_viewer_app_image.png and b/docs/doxygen-user/images/content_viewer_app_image.png differ
diff --git a/docs/doxygen-user/images/content_viewer_app_plist.png b/docs/doxygen-user/images/content_viewer_app_plist.png
index 13a53d08ea..29da91b7ac 100644
Binary files a/docs/doxygen-user/images/content_viewer_app_plist.png and b/docs/doxygen-user/images/content_viewer_app_plist.png differ
diff --git a/docs/doxygen-user/images/content_viewer_app_sqlite.png b/docs/doxygen-user/images/content_viewer_app_sqlite.png
index bd652913a7..0166cb32e3 100644
Binary files a/docs/doxygen-user/images/content_viewer_app_sqlite.png and b/docs/doxygen-user/images/content_viewer_app_sqlite.png differ
diff --git a/docs/doxygen-user/images/content_viewer_hex.png b/docs/doxygen-user/images/content_viewer_hex.png
index a0d6242651..330c0468a7 100644
Binary files a/docs/doxygen-user/images/content_viewer_hex.png and b/docs/doxygen-user/images/content_viewer_hex.png differ
diff --git a/docs/doxygen-user/images/content_viewer_html.png b/docs/doxygen-user/images/content_viewer_html.png
index 7baae5b4fd..29f2f86ea4 100644
Binary files a/docs/doxygen-user/images/content_viewer_html.png and b/docs/doxygen-user/images/content_viewer_html.png differ
diff --git a/docs/doxygen-user/images/content_viewer_indexed_text.png b/docs/doxygen-user/images/content_viewer_indexed_text.png
index d4e7d32ddf..83c0076eda 100644
Binary files a/docs/doxygen-user/images/content_viewer_indexed_text.png and b/docs/doxygen-user/images/content_viewer_indexed_text.png differ
diff --git a/docs/doxygen-user/images/content_viewer_message.png b/docs/doxygen-user/images/content_viewer_message.png
index 032f1e4e4a..f927289531 100644
Binary files a/docs/doxygen-user/images/content_viewer_message.png and b/docs/doxygen-user/images/content_viewer_message.png differ
diff --git a/docs/doxygen-user/images/content_viewer_metadata.png b/docs/doxygen-user/images/content_viewer_metadata.png
index d9f7922b60..1c25115398 100644
Binary files a/docs/doxygen-user/images/content_viewer_metadata.png and b/docs/doxygen-user/images/content_viewer_metadata.png differ
diff --git a/docs/doxygen-user/images/content_viewer_other_occurrences.png b/docs/doxygen-user/images/content_viewer_other_occurrences.png
index 64010b2886..3bdac5b67b 100644
Binary files a/docs/doxygen-user/images/content_viewer_other_occurrences.png and b/docs/doxygen-user/images/content_viewer_other_occurrences.png differ
diff --git a/docs/doxygen-user/images/content_viewer_registry.png b/docs/doxygen-user/images/content_viewer_registry.png
new file mode 100644
index 0000000000..43149fcb7f
Binary files /dev/null and b/docs/doxygen-user/images/content_viewer_registry.png differ
diff --git a/docs/doxygen-user/images/content_viewer_results_bookmark.png b/docs/doxygen-user/images/content_viewer_results_bookmark.png
index caf2853b5f..6baa7f7383 100644
Binary files a/docs/doxygen-user/images/content_viewer_results_bookmark.png and b/docs/doxygen-user/images/content_viewer_results_bookmark.png differ
diff --git a/docs/doxygen-user/images/content_viewer_results_call.png b/docs/doxygen-user/images/content_viewer_results_call.png
index ed09b4e814..03b79bf1f0 100644
Binary files a/docs/doxygen-user/images/content_viewer_results_call.png and b/docs/doxygen-user/images/content_viewer_results_call.png differ
diff --git a/docs/doxygen-user/images/content_viewer_strings_cyrillic.png b/docs/doxygen-user/images/content_viewer_strings_cyrillic.png
index 1629b74ed7..f70ba0c130 100644
Binary files a/docs/doxygen-user/images/content_viewer_strings_cyrillic.png and b/docs/doxygen-user/images/content_viewer_strings_cyrillic.png differ
diff --git a/docs/doxygen-user/images/content_viewer_strings_latin.png b/docs/doxygen-user/images/content_viewer_strings_latin.png
new file mode 100644
index 0000000000..6968326d65
Binary files /dev/null and b/docs/doxygen-user/images/content_viewer_strings_latin.png differ
diff --git a/docs/doxygen-user/images/directory-tree.PNG b/docs/doxygen-user/images/directory-tree.PNG
deleted file mode 100644
index 5477b17dba..0000000000
Binary files a/docs/doxygen-user/images/directory-tree.PNG and /dev/null differ
diff --git a/docs/doxygen-user/images/mt_config.png b/docs/doxygen-user/images/mt_config.png
new file mode 100644
index 0000000000..e3022aec0d
Binary files /dev/null and b/docs/doxygen-user/images/mt_config.png differ
diff --git a/docs/doxygen-user/images/mt_content_viewer_translated.png b/docs/doxygen-user/images/mt_content_viewer_translated.png
new file mode 100644
index 0000000000..7ba3804415
Binary files /dev/null and b/docs/doxygen-user/images/mt_content_viewer_translated.png differ
diff --git a/docs/doxygen-user/images/mt_content_viewer_untranslated_text.png b/docs/doxygen-user/images/mt_content_viewer_untranslated_text.png
new file mode 100644
index 0000000000..488254a11b
Binary files /dev/null and b/docs/doxygen-user/images/mt_content_viewer_untranslated_text.png differ
diff --git a/docs/doxygen-user/images/mt_file_name_enable.png b/docs/doxygen-user/images/mt_file_name_enable.png
new file mode 100644
index 0000000000..8f2ee50ae0
Binary files /dev/null and b/docs/doxygen-user/images/mt_file_name_enable.png differ
diff --git a/docs/doxygen-user/images/mt_file_name_original.png b/docs/doxygen-user/images/mt_file_name_original.png
new file mode 100644
index 0000000000..93d9aaa449
Binary files /dev/null and b/docs/doxygen-user/images/mt_file_name_original.png differ
diff --git a/docs/doxygen-user/images/mt_file_names_translated.png b/docs/doxygen-user/images/mt_file_names_translated.png
new file mode 100644
index 0000000000..38904efa38
Binary files /dev/null and b/docs/doxygen-user/images/mt_file_names_translated.png differ
diff --git a/docs/doxygen-user/images/portable_case_chunks.png b/docs/doxygen-user/images/portable_case_chunks.png
new file mode 100644
index 0000000000..de21370434
Binary files /dev/null and b/docs/doxygen-user/images/portable_case_chunks.png differ
diff --git a/docs/doxygen-user/images/portable_case_interesting_items.png b/docs/doxygen-user/images/portable_case_interesting_items.png
new file mode 100644
index 0000000000..3a8358c4c6
Binary files /dev/null and b/docs/doxygen-user/images/portable_case_interesting_items.png differ
diff --git a/docs/doxygen-user/images/portable_case_report_panel.png b/docs/doxygen-user/images/portable_case_report_panel.png
index 91b9c0c722..9b46e610c4 100644
Binary files a/docs/doxygen-user/images/portable_case_report_panel.png and b/docs/doxygen-user/images/portable_case_report_panel.png differ
diff --git a/docs/doxygen-user/images/portable_case_unpackage.png b/docs/doxygen-user/images/portable_case_unpackage.png
new file mode 100644
index 0000000000..1d4b20b7ec
Binary files /dev/null and b/docs/doxygen-user/images/portable_case_unpackage.png differ
diff --git a/docs/doxygen-user/images/reports_files_delimiter.png b/docs/doxygen-user/images/reports_files_delimiter.png
new file mode 100644
index 0000000000..6726897cc6
Binary files /dev/null and b/docs/doxygen-user/images/reports_files_delimiter.png differ
diff --git a/docs/doxygen-user/images/result-viewer-example-1.PNG b/docs/doxygen-user/images/result-viewer-example-1.PNG
index fd813be852..409cea78be 100644
Binary files a/docs/doxygen-user/images/result-viewer-example-1.PNG and b/docs/doxygen-user/images/result-viewer-example-1.PNG differ
diff --git a/docs/doxygen-user/images/result-viewer-example-3.PNG b/docs/doxygen-user/images/result-viewer-example-3.PNG
index fbdda31e8a..f9cd06056b 100644
Binary files a/docs/doxygen-user/images/result-viewer-example-3.PNG and b/docs/doxygen-user/images/result-viewer-example-3.PNG differ
diff --git a/docs/doxygen-user/images/result_viewer_csv.PNG b/docs/doxygen-user/images/result_viewer_csv.PNG
new file mode 100644
index 0000000000..c02c182b89
Binary files /dev/null and b/docs/doxygen-user/images/result_viewer_csv.PNG differ
diff --git a/docs/doxygen-user/images/result_viewer_paging.PNG b/docs/doxygen-user/images/result_viewer_paging.PNG
new file mode 100644
index 0000000000..2604b53741
Binary files /dev/null and b/docs/doxygen-user/images/result_viewer_paging.PNG differ
diff --git a/docs/doxygen-user/images/tagging_image_create_tag.png b/docs/doxygen-user/images/tagging_image_create_tag.png
new file mode 100644
index 0000000000..067cc278dd
Binary files /dev/null and b/docs/doxygen-user/images/tagging_image_create_tag.png differ
diff --git a/docs/doxygen-user/images/tagging_image_edit_tag.png b/docs/doxygen-user/images/tagging_image_edit_tag.png
new file mode 100644
index 0000000000..ce9a629526
Binary files /dev/null and b/docs/doxygen-user/images/tagging_image_edit_tag.png differ
diff --git a/docs/doxygen-user/images/tagging_image_menu.png b/docs/doxygen-user/images/tagging_image_menu.png
new file mode 100644
index 0000000000..9ca8f06099
Binary files /dev/null and b/docs/doxygen-user/images/tagging_image_menu.png differ
diff --git a/docs/doxygen-user/images/tagging_image_multiple.png b/docs/doxygen-user/images/tagging_image_multiple.png
new file mode 100644
index 0000000000..d41bba0f9a
Binary files /dev/null and b/docs/doxygen-user/images/tagging_image_multiple.png differ
diff --git a/docs/doxygen-user/images/tagging_image_report.png b/docs/doxygen-user/images/tagging_image_report.png
new file mode 100644
index 0000000000..6a053c9af5
Binary files /dev/null and b/docs/doxygen-user/images/tagging_image_report.png differ
diff --git a/docs/doxygen-user/images/tagging_image_select.png b/docs/doxygen-user/images/tagging_image_select.png
new file mode 100644
index 0000000000..d44e2552aa
Binary files /dev/null and b/docs/doxygen-user/images/tagging_image_select.png differ
diff --git a/docs/doxygen-user/images/thumbnail-result-viewer-tab.PNG b/docs/doxygen-user/images/thumbnail-result-viewer-tab.PNG
index c6f5921690..b53c14dc52 100644
Binary files a/docs/doxygen-user/images/thumbnail-result-viewer-tab.PNG and b/docs/doxygen-user/images/thumbnail-result-viewer-tab.PNG differ
diff --git a/docs/doxygen-user/images/ui-layout-1.PNG b/docs/doxygen-user/images/ui-layout-1.PNG
index 96816f578f..7f9485888d 100644
Binary files a/docs/doxygen-user/images/ui-layout-1.PNG and b/docs/doxygen-user/images/ui-layout-1.PNG differ
diff --git a/docs/doxygen-user/images/view_options_options_panel.png b/docs/doxygen-user/images/view_options_options_panel.png
index 88267355ca..3a917e166e 100644
Binary files a/docs/doxygen-user/images/view_options_options_panel.png and b/docs/doxygen-user/images/view_options_options_panel.png differ
diff --git a/docs/doxygen-user/installSolr.dox b/docs/doxygen-user/installSolr.dox
index e8cc660baa..494e24588d 100644
--- a/docs/doxygen-user/installSolr.dox
+++ b/docs/doxygen-user/installSolr.dox
@@ -4,10 +4,10 @@ A central Solr server is needed to store keyword indexes, and its embedded Zooke
\section install_solr_prereq Prerequisites
You will need:
-- 64-bit version of the Java Runtime Environment (JRE) from http://www.oracle.com/technetwork/java/javase/downloads/jre8-downloads-2133155.html.
-- Download the Apache Solr 4.10.3-0 installation package from https://sourceforge.net/projects/autopsy/files/CollaborativeServices/Solr or Direct Download Link
+- A 64-bit version of the Java Runtime Environment (JRE) from http://www.oracle.com/technetwork/java/javase/downloads/jre8-downloads-2133155.html.
+- The Apache Solr 4.10.3-0 installation package from https://sourceforge.net/projects/autopsy/files/CollaborativeServices/Solr or Direct Download Link
- Access to an installed version of Autopsy so that you can copy files from it.
-- A network-accessible machine to install Solr upon. Note that the Solr process will need to write data out to the main shared storage drive, and needs adequate permissions to write to this location, which may be across a network.
+- A network-accessible machine to install Solr on. Note that the Solr process will need to write data out to the main shared storage drive, and needs adequate permissions to write to this location, which may be across a network.
\section install_solr_install Installation
@@ -29,7 +29,7 @@ The following steps will configure Solr to run using an account that will have a
\subsection install_solr_config Solr Configuration
1. Stop the _solrJetty_ service by pressing _Start_, typing _services.msc_, pressing _Enter_, and locating the _solrJetty_ Windows service. Select the service and press _Stop the service_. If the service is already stopped and there is no _Stop the service_ available, this is okay.
-2. Edit the "C:\Bitnami\solr-4.10.3-0\apache-solr\scripts\serviceinstall.bat" script. You need administrator permission to change this file. The easiest way around this is to save a copy on the Desktop, edit the Desktop version, and copy the new one back over the top of the old. Windows will ask for permission to overwrite the old file; allow it. You should make the following changes to this file:
+2. Edit the "C:\Bitnami\solr-4.10.3-0\apache-solr\scripts\serviceinstall.bat" script. You need administrator rights to change this file. The easiest way around this is to save a copy on the Desktop, edit the Desktop version, and copy the new one back over the top of the old. Windows will ask for permission to overwrite the old file; allow it. You should make the following changes to this file:
- Add the following options in the line that begins with "C:\Bitnami\solr-4.10.3-0/apache-solr\scripts\prunsrv.exe" :
diff --git a/docs/doxygen-user/machine_translation.dox b/docs/doxygen-user/machine_translation.dox
new file mode 100644
index 0000000000..ee3fbd07da
--- /dev/null
+++ b/docs/doxygen-user/machine_translation.dox
@@ -0,0 +1,37 @@
+/*! \page machine_translation_page Machine Translation
+
+You can configure a machine translation service to use with Autopsy. If one is configured, you will be able to translate text in the \ref content_viewer_page and file names in the \ref result_viewer_page and \ref tree_viewer_page.
+
+\section mt_config Configuration
+
+To set up a machine translation service, go to Options->Tools and then select the Machine Translation tab. Select the service you want to use from the drop down menu at the top.
+
+\image html mt_config.png
+
+Each service will require slightly different configuration steps. After setting everything up, you can run a quick check that the service is set up correctly using the "Test" button.
+
+\section mt_file_names Translating File Names
+
+You can use machine translation to automatically translate file and folder names, such as the ones seen below:
+
+\image html mt_file_name_original.png
+
+To enable file name translation, go to the \ref view_options_page and check the box under "Translate Text".
+
+\image html mt_file_name_enable.png
+
+Once enabled, the translated versions of the file and folder names will be shown in the \ref tree_viewer_page and in the first column of the \ref result_viewer_page. The original name will be displayed in the new "Original Name" column.
+
+\image html mt_file_names_translated.png
+
+\section mt_content_viewer Translating File Content
+
+After you set up a machine translation service, the Translation tab under the Text tab in the Content Viewer will be active. The Translation tab allows you to use your service to translate the beginning of a file. For example, you might see the following in the default Indexed Text tab:
+
+\image html mt_content_viewer_untranslated_text.png
+
+Switching to the Translation tab will display the results of running the text through the machine translation service.
+
+\image html mt_content_viewer_translated.png
+
+*/
\ No newline at end of file
diff --git a/docs/doxygen-user/main.dox b/docs/doxygen-user/main.dox
index e148279aa6..3a4c6d96fc 100644
--- a/docs/doxygen-user/main.dox
+++ b/docs/doxygen-user/main.dox
@@ -49,6 +49,7 @@ The following topics are available here:
- \subpage common_properties_page
- \subpage search_all_cases_page
- \subpage logs_and_output_page
+ - \subpage machine_translation_page
- Reporting
- \subpage tagging_page
- \subpage reporting_page
diff --git a/docs/doxygen-user/portable_case.dox b/docs/doxygen-user/portable_case.dox
index 4f4e809ae8..b476206a38 100644
--- a/docs/doxygen-user/portable_case.dox
+++ b/docs/doxygen-user/portable_case.dox
@@ -9,7 +9,7 @@ The general use case is as follows:
- Alice is analyzing one or more data sources using Autopsy. She tags files and results that are of particular interest.
- Alice wants to share her findings with Bob but is unable to send him the original data sources because he shouldn't see them or the originals are too big.
-
- Alice creates a portable case which will contain only her tagged files and results, plus any files associated with those results, and sends it to Bob.
+
- Alice creates a portable case which will contain only her tagged files and results, plus any files associated with those results, and sends it to Bob. She could also choose to include \ref interesting_files_identifier_page "interesting files" or results.
- Bob can open the portable case in Autopsy and view all files and results Alice tagged, and run any of the normal Autopsy features.
@@ -21,25 +21,38 @@ The portable version could like this:
\image html portable_case_portable_version.png
-Alice only tagged eight files and results, so most of the original content is no longer in the case. Some of the data sources had no tagged items so they're not included at all. The file structure of any tagged files is preserved - you can see that the tagged image in the screenshot is still in the same location, but the non-tagged files are gone. Note that although the original images (such as "image1.vhd") appear in the tree, their contents are not included in the portable case.
+Alice only tagged eight files and results and her case had no interesting items, so most of the original content is no longer in the case. Some of the data sources had no tagged items so they're not included at all. The file structure of any tagged files is preserved - you can see that the tagged image in the screenshot is still in the same location, but the non-tagged files are gone. Note that although the original images (such as "image1.vhd") appear in the tree, their contents are not included in the portable case.
\section portable_case_creation Creating a Portable Case
-First you'll want to make sure that all the files and results you want included in the portable case are tagged - see the \ref tagging_page page for more details.
-You can see what tags you've added in the \ref tree_viewer_page.
+A portable case can contain tagged files and results and data from the Interesting Items section of the \ref tree_viewer_page. You'll be able to choose which of the Interesting Item sets you want to include in the portable case.
+
+\image html portable_case_interesting_items.png
+
+You can tag any additional files you want to include in the portable case. See the \ref tagging_page page for details on how to create tags. You can see what tags you've added in the \ref tree_viewer_page.
\image html portable_case_tags.png
-Portable cases are created through the \ref reporting_page feature. The Generate Report dialog will display a list of all tags that are in use in the current case and you can choose which ones you would like to include. At the bottom you can select the output folder for the new case. By default it will be placed in the "Reports" folder in the current case.
+Portable cases are created through the \ref reporting_page feature. The Generate Report dialog will display a list of all tags and interesting file sets that are in use in the current case and you can choose which ones you would like to include. At the bottom you can choose to optionally package the case. Choosing to package the case without chunking will simply compress the portable case in a single archive that can be extracted with common compression programs. If you choose split the packaged case into multiple files, you will need to use the "Unpackage Portable Case" option before loading it. This will be discussed in the next section.
+
+The portable case will be placed in the "Reports" folder in the current case.
\image html portable_case_report_panel.png
-Here you can see the new portable case. It will be named with the original case name plus "(Portable)". The portable case is initially missing many of the normal Autopsy folders - these will be created the first time a user opens it. The portable case folder can be zipped and sent to a different user.
+Here you can see an unpackaged portable case. It will be named with the original case name plus "(Portable)". The portable case is initially missing many of the normal Autopsy folders - these will be created the first time a user opens it.
\image html portable_case_folder.png
+If you packaged the portable case but did not choose to split it into chunks, you'll have a single .zip file. If you chose to split the packaged case, you'll have one or more files starting with extension .zip.001.
+
+\image html portable_case_chunks.png
+
\section portable_case_usage Using a Portable Case
+If your portable case was packaged, you'll first need to unpackage it. Open the "Case" menu and then select "Unpackage Portable Case". This will bring up a dialog where you can browse to your packaged case and select where to extract it to. Once unpackaged you can open it normally.
+
+\image html portable_case_unpackage.png
+
Portable cases generally behave like any other Autopsy case. You can run ingest, do keyword searches, use the timeline viewer, etc. One point to note is that while the original data source names appear in the case, the data sources themselves were not copied into the portable case.
\image html portable_case_empty_image.png
diff --git a/docs/doxygen-user/reporting.dox b/docs/doxygen-user/reporting.dox
index 63c1917036..c1065983e7 100644
--- a/docs/doxygen-user/reporting.dox
+++ b/docs/doxygen-user/reporting.dox
@@ -64,13 +64,17 @@ show up as Hashset Hits.
\subsection report_case_uco CASE-UCO
-This module creates an JSON output file in CASE-UCO format from a single data source.
+This module creates a JSON output file in CASE-UCO format for a single data source.
\image html reports_case.png
\subsection report_files Files - Text
-This report module allows you create a tab delimited text file from all files in the current case. You can select which fields should be exported.
+This report module allows you create a tab or comma delimited text file report of all of the files in the current case. Start by selecting which delimiter you would like to use.
+
+\image html reports_files_delimiter.png
+
+You can then select which fields should be reported.
\image html reports_files_config.png
@@ -84,7 +88,7 @@ This report module generates a KML file from any GPS data in the case. This file
\subsection report_portable_case Portable Case
-This report module generates a new Autopsy case from any tagged files and results. See the \ref portable_case_page page for additional information.
+This report module generates a new Autopsy case that includes tagged and/or interesting items. See the \ref portable_case_page page for additional information.
\subsection report_stix STIX
diff --git a/docs/doxygen-user/result_viewer.dox b/docs/doxygen-user/result_viewer.dox
index 1c813d9f81..b5b349682b 100644
--- a/docs/doxygen-user/result_viewer.dox
+++ b/docs/doxygen-user/result_viewer.dox
@@ -1,37 +1,61 @@
/*! \page result_viewer_page Result Viewer
-The Result Viewer is located on the top right of the Autopsy screen. It shows lists of files and their corresponding attributes such as time, path, size, checksum, etc.
+The Result Viewer is located on the top right of the Autopsy screen and shows the the contents of what was selected in the \ref tree_viewer_page.
-
+\section result_viewer_table Table Viewers
+
+The main table viewer in the "Listing" tab displays the contents of the current selection as a table with selected details (properties) of each item. For files, some examples of the properties that this viewer shows are: name, time (modified, changed, accessed, and created), size, flags (directory and meta), mode, user ID, group ID, metadata address, attribute address, and type (directory and meta). For other data types, the columns will be different. Click the "Table" tab to select this view.
+
+The following shows the main table viewer when a folder is selected in the Data Source section of the \ref tree_viewer_page.
\image html result-viewer-example-1.PNG
-
-By default, the first three columns after the file name in the results viewer are named "S", "C" and "O".
+As mentioned above, a table viewer is context-aware which means it will show applicable columns for the data type selected. The following shows the data in the "Web Bookmarks" node in the \ref tree_viewer_page.
+
+\image html result-viewer-example-3.PNG
+
+\subsection result_viewer_sco SCO Columns
+By default, the first three columns after the file name in a table viewer are named "S", "C" and "O".
\image html view_options_sco.png
-These columns display the following:
+These columns display the following information:
-- (S)core column - indicates whether the item is interesting or notable
+
- (S)core column - indicates whether the item is interesting or notable.
- - Displays a red icon if the file is a match for a notable hash set or has been tagged with a notable tag
-
- Displays a yellow icon if the file has an interesting item match or has been tagged with a non-notable tag
+
- Displays a red icon if the file is a match for a notable hashset or has been tagged with a notable tag.
+
- Displays a yellow icon if the file has an interesting item match or has been tagged with a non-notable tag.
- - (C)omment column - indicates whether the item has a comment in the Central Repository or has a comment associated with a tag
+
- (C)omment column - indicates whether the item has a comment in the Central Repository or has a comment associated with a tag.
- (O)ther occurrences column - indicates how many data sources in the Central Repository contain this item. The count will include the selected item.
To display more information about why an icon has appeared, you can hover over it. The Comment and Other occurrences columns query the Central Repository. If this seems to be having a performance impact, it can be disabled through the \ref view_options_page. This will remove the Other occurrences column entirely and the Comment column will be based only on tags.
-You can also switch it to Thumbnail view to see thumbnails of the content in the selected folder.
+\subsection export_csv Exporting to CSV
-
-\image html result-viewer-example-2.PNG
-
+You can export the contents of a table viewer to a CSV file in two ways. The "Save table as CSV" button in the upper left will save the entire contents of the table viewer to a CSV file. You can also select rows in the table viewer and then right-click and select "Export selected rows to CSV" to save only a subset of the rows:
-The Result Viewer is context-aware, meaning it will show applicable columns for the data type selected.
-
-\image html result-viewer-example-3.PNG
-
+\image html result_viewer_csv.PNG
+
+\subsection right_click_functions Right Click Functions
+Table viewers in the Results Viewer have certain right-click functions built-in into them that can be accessed when a row of a particular type is selected (a file, a directory, or a result).
+Here are some examples that you may see:
+\li Open File in External Viewer: Opens the selected file in an "external" application as defined by the local OS or through the External Viewer tab that you can navigate to by selecting the Options menu item from the Tools menu. For example, HTML files may be opened by Chrome or Firefox or some other browser, depending on what the local system is configured to use.
+\li View in New Window: Opens the selected item in a new content viewer (instead of in the default location in the lower right area of the main window).
+\li Extract: Makes a local copy of the selected file or directory for further analysis.
+
+
+\section thumbnail_result_viewer Thumbnail Viewers
+Thumbnail viewers display items selected in the \ref tree_viewer_page as a table of thumbnail images in adjustable sizes. This viewer only supports "picture" files (it currently only supports the JPG, GIF, and PNG formats). Click on the Thumbnail tab in the Listing tab to select this view. Note that for a large number of images in a directory selected in the Data Sources area of the \ref tree_viewer_page, or for a selection in the Views area of the \ref tree_viewer_page that contains a large number of images, it might take a while to populate the thumbnail viewer for the first time, i.e., before the thumbnails are cached.
+
+\image html thumbnail-result-viewer-tab.PNG
+
+\section result_viewer_paging Paging
+
+A table viewer can perform slowly when displaying a large numbers of rows. To address this, when there are over a certain numer of rows (10,000 by default), the results will be split into pages. The paging controls at the top right of the table view allow you to browse the different pages.
+
+\image html result_viewer_paging.PNG
+
+You can adust the page sizes through \ref view_options_page or turn paging off entirely.
*/
diff --git a/docs/doxygen-user/tagging.dox b/docs/doxygen-user/tagging.dox
index 107dd7700a..b6cba720ae 100644
--- a/docs/doxygen-user/tagging.dox
+++ b/docs/doxygen-user/tagging.dox
@@ -1,6 +1,6 @@
/*! \page tagging_page Tagging
-Tagging (or Bookmarking) allows you to create a reference to a file or object and easily find it later. Tagging is also used by the \ref central_repo_page "central repository" to mark items as notable.
+Tagging (or Bookmarking) allows you to create a reference to a file or object and easily find it later or include it in a \ref reporting_page "report". For images, you can select a portion of the image to tag. Tagging is also used by the \ref central_repo_page "central repository" to mark items as notable.
\section tagging_items Tagging items
@@ -41,6 +41,40 @@ Tagged results are shown in the "Results" portion of the tree under "Tags". Tagg
\image html tagging-4.PNG
+\section image_tagging Image tagging
+
+When you have an image selected in the \ref result_viewer_page, you'll see a "Tags Menu" option in the upper right of the "Application" \ref content_viewer_page "Content Viewer". This allows you to tag only a selected area of the image.
+
+\image html tagging_image_menu.png
+
+\subsection image_tagging_creation Creating and editing an image tag
+
+To start, select the "Create" option on the tags menu. Then left-click and hold to draw a box around part of the image. When you release the mouse, you'll be able to choose which tag name to use.
+
+\image html tagging_image_select.png
+
+You can add a new tag name using the "New Tag" button.
+
+\image html tagging_image_create_tag.png
+
+Once you choose the tag name you'll see a red outline in the image around the section you chose. If you need to edit the tag, right click on the red border to select it. From here you can drag the edges to resize the box, or delete it by selecting "Delete" from the tags menu.
+
+\image html tagging_image_edit_tag.png
+
+You can create multiple tags in the same image.
+
+\image html tagging_image_multiple.png
+
+If you want to temporarily hide the tag outlines, select "Hide" from the tags menu. You can then select "Show" to see them again. The outlines will also reappear if you switch to a different item in the Result Viewer and come back.
+
+\subsection image_tagging_report Exporting and reporting on image tags
+
+If you want to save the image with the tag outline, select "Export" from the tags menu. The result will always be a PNG file. Note that using the "Extract File(s)" option from the right-click menu in the Result Viewer will export the original image.
+
+You'll also be able to see the image tags in an \ref report_html "HTML report".
+
+\image html tagging_image_report.png
+
\section managing_tags Managing tags
The list of tags can be edited through the Tags tab on the Options menu.
diff --git a/docs/doxygen-user/tree_viewer.dox b/docs/doxygen-user/tree_viewer.dox
index 9e309476d0..b163018f4f 100644
--- a/docs/doxygen-user/tree_viewer.dox
+++ b/docs/doxygen-user/tree_viewer.dox
@@ -1,8 +1,47 @@
/*! \page tree_viewer_page Tree Viewer
-The Tree Viewer shows the discovered folders by the data sources they come from, as well as a list of files in the folders. It is located on the left side of the Autopsy screen. The "Group by Data Source" option on the top left moves all views, results, and tags under their corresponding data source.
+The tree on the left-hand side of the main window is where you can browse the files in the data sources in the case and find saved results from automated analyis (ingest). The tree has five main areas:
+- Data Sources: This shows the directory tree hierarchy of the data sources. You can navigate to a specific file or directory here. Each data source added to the case is represented as a distinct sub tree. If you add a data source multiple times, it shows up multiple times.
+- Views: Specific types of files from the data sources are shown here, aggregated by type or other properties. Files here can come from more than one data source.
+- Results: This is where you can see the results from both the automated analysis (ingest) running in the background and your search results.
+- Tags: This is where files and results that have been \ref tagging_page "tagged" are shown.
+- Reports: Reports that you have generated, or that ingest modules have created, show up here.
-Each folder in the tree on the left shows how many items are contained within it in parentheses after the directory name. See the picture below.
+You can also use the "Group by data source" option available through the \ref view_options_page to move the Views, Results, and Tags tree nodes under their corresponding data sources. This can be helpful on very large cases to reduce the size of each sub tree. For example:
+
+\image html ui_layout_group_tree.PNG
+
+\section ui_tree_ds Data Sources
+
+The Data Sources area shows each data source that has been added to the case, in order added (top one is first).
+Right clicking on the various nodes in the Data Sources area of the tree will allow you to get more options for each data source and its contents.
+
+Unallocated space is the chunks of a file system that are currently not being used for anything. Unallocated space can hold deleted files and other interesting artifacts. In an image data source, unallocated space is stored in blocks with distinct locations in the file system. However, because of the way carving tools work, it is better to feed these tools a single, large unallocated space file. Autopsy provides access to both methods of looking at unallocated space.
+\li Individual blocks in a volume For each volume, there is a "virtual" folder named "$Unalloc". This folder contains all the individual unallocated blocks in contiguous runs (unallocated space files) as the image is storing them. You can right click and extract any unallocated space file the same way you can extract any other type of file in the Data Sources area.
+\li Single files Right click on a volume and select "Extract Unallocated Space as Single File" to concatenate all of the unallocated space files in the volume into a single, continuous file. (If desired, you can right click on an image, and select "Extract Unallocated Space to Single Files" which will do the same thing, but once for each volume in the image).
+
+An example of the single file extraction option is shown below.
+\image html extracting-unallocated-space.PNG
+
+\section ui_tree_views Views
+
+Views filter all the files in the case by some property of the file.
+- File Types Sorts files by file extension or by MIME type, and shows them in the appropriate group. For example, files with .mp3 and .wav extensions end up in the "Audio" group.
+- Deleted Files Displays files that have been deleted, but the names have been recovered.
+- File Size Sorts files based on size.
+
+
+\section ui_tree_results Results
+- Extracted Content: Many ingest modules will place results here; EXIF metadata, GPS locations, or Web history for example.
+- Keyword Hits: Keyword search hits show up here.
+- Hashset Hits: Hashset hits show up here.
+- E-Mail Messages: Email messages show up here.
+- Interesting Items: Things deemed interesting show up here.
+- Accounts: Credit card accounts show up here.
+- Tags: Any item you tag shows up here so you can find it again easily.
+
+\section ui_tree_reports Reports
+
+Reports can be added by \subpage ingest_page or created using the \subpage reporting_page tool.
-\image html directory-tree.PNG
*/
diff --git a/docs/doxygen-user/uilayout.dox b/docs/doxygen-user/uilayout.dox
index c0906dd0cc..0f39386afe 100644
--- a/docs/doxygen-user/uilayout.dox
+++ b/docs/doxygen-user/uilayout.dox
@@ -5,115 +5,37 @@
\section ui_overview Overview
The major areas in the Autopsy User Interface (UI) are:
-- \ref ui_tree, shown outlined in green below
-- \ref ui_results, shown outlined in blue below
-- \ref ui_content, shown outlined in red below
-- \ref ui_keyword, shown outlined in yellow below
-- \ref ui_status, shown in solid purple below
+- \ref ui_tree, shown in green on the left side
+- \ref ui_results, shown in blue on the upper right side
+- \ref ui_content, shown in red on the lower right side
+- \ref ui_keyword, shown in magenta in the upper right corner
+- \ref ui_status, shown in purple in the lower right corner
You can customize how data is shown in the UI through the \ref view_options_page panel.
\image html ui-layout-1.PNG
-
-
-
\section ui_tree Tree Viewer
-\subpage tree_viewer_page "More..."
-
+The Tree Viewer on the left-hand side is the top level of the UI. Selecting items in the Tree Viewer will cause their contents to be displayed in the Result Viewer to the right. You can browse the files in the image, find saved results generated by the \ref ingest_page "ingest modules", and see the results from \ref tagging_page and \ref reporting_page. See the \subpage tree_viewer_page page for additional information.
-The tree on the left-hand side is where you can browse the files in the image and find saved results from automated procedures (ingest). The tree has five main areas:
-- Data Sources: This shows the directory tree hierarchy of the file systems in the images. You can navigate to a specific file or directory here. Each data source added is represented as a drive. If you add a data source multiple times, it shows up multiple times.
-- Views: Specific types of files from the data sources are shown here, aggregated by type or other properties. Files here can come from more than one data source. Look here for files of a specific type or property.
-- Results: Where you can see the results from the background ingest tasks and you can see your previous search results. Go here to see what was found by the ingest modules and to find your previous search results.
-- Tags: Where files and results that have been \ref tagging_page "tagged" are shown
-- Reports: References to reports that you have generated or that ingest modules have created show up here
-
-You can also use the "Group by data source" option available through the \ref view_options_page to move the views, results, and tags subtrees under their corresponding data sources. This can be helpful on very large cases to reduce the size of each node.
-
-\image html ui_layout_group_tree.PNG
-
-\subsection ui_tree_ds Data Sources
-
-The Data Sources section shows each data source that has been added to the case, in order added (top one is first).
-Right clicking on the various nodes in the Data Sources section of the tree will allow you to get more options for each data source and its contents.
-
-Unallocated space is chunks of the file system that is currently not being used for anything. Unallocated space can store deleted files and other interesting artifacts. On the actual image, Unallocated space is stored in blocks with distinct locations on the system. However, because of the way various carving tools work, it is more ideal to feed them a single, large unallocated file. Autopsy provides access to both methods of looking at unallocated space.
-\li Individual blocks in a volume There is a folder named "Unalloc". This folder contains all the individual unallocated blocks as the image is storing them. You can right click and extract them the same way you can extract any other type of file in the Directory Tree.
-\li Single files Right click on a volume and select "Extract Unallocated Space as Single File" to concatenate all the unallocated files in the volume into a single, continuous file. (If desired, you can right click on an image, and select "Extract Unallocated Space to Single Files" which will do the same thing, but once for each volume in the image).
-
-An example of the single file extraction option is shown below.
-\image html extracting-unallocated-space.PNG
-
-\subsection ui_tree_views Views
-
-Views filter all the files in the case by some external property of the file, not by any internal analysis of the file.
-- File Type Sorts files by file extension or MIME type, and shows them in the appropriate group. For example, .mp3 and .wav both end up in the "Audio" group.
-- Recent Files Displays files that are accessed within the last seven days the user had the device.
-- Deleted Files Displays files that have been deleted but the names have been recovered.
-- File Size Sorts files based upon size. This can give you an idea where to look for files you are interested in.
-
-
-\subsection ui_tree_results Results
-- Extracted Content: Many ingest modules will place results here; EXIF data, GPS locations, or Web History for example
-- Keyword Hits: Keyword search hits show up here
-- Hashset Hits: Hashset hits show up here
-- E-Mail Messages: Email messages show up here
-- Interesting Items: Things deemed interesting show up here
-- Accounts: Credit card accounts show up here
-- Tags: Any item you tag shows up here so you can find it again easily
-
-\subsection ui_tree_reports Reports
-
-Reports can be added by \subpage ingest_page or created using the \subpage reporting_page tool.
-
-
-
-
\section ui_results Result Viewer
-\subpage result_viewer_page "More..."
-
-
-The Result Viewer windows are in the upper right area of the interface and display the results from selecting something in the tree. You will have the option to display the results in a variety of formats.
-
-\subsection right_click_functions Right Click Functions
-Viewers in Result Viewers have certain right-click functions built-in into them that can be accessed when a node a certain type is selected (a file, directory or a result).
-Here are some examples that you may see:
-\li Open File in External Viewer: Opens the selected file in an "external" application as defined by the local OS or through the External Viewer tab on the Options menu. For example, HTML files may be opened by IE or Firefox, depending on what the local system is configured to use.
-\li View in New Window: Opens the content in a new internal Content Viewer (instead of in the default location in the lower right).
-\li Extract: Make a local copy of the file or directory for further analysis.
-\li Search for files with the same MD5 Hash: Searches the entire file-system for any files with the same MD5 Hash as the one selected.
-
-\subsection thumbnail_result_viewer Thumbnail Result Viewers
-Thumbnail Results Viewer displays the data catalog as a table of thumbnail images in adjustable sizes. This viewer only supports picture files (Currently, only supports JPG, GIF, and PNG formats). Click the Thumbnail tab to select this view. Note that for a large number of images in a directory selected in the Data Explorer, or for a View selected that contains a large number of images, it might take a while to populate this view for the first time before the images are cached.
-
-Example\n
-Below is an example of "Thumbnail Results Viewer" window:
-\image html thumbnail-result-viewer-tab.PNG
-
-\subsection table_result_viewer Table Result Viewers
-Table Results Viewer (Directory Listing) displays the data catalog as a table with some details (properties) of each file. The properties that it shows are: name, time (modified, changed, accessed, and created), size, flags (directory and meta), mode, user ID, group ID, metadata address, attribute address, and type (directory and meta). Click the Table Viewer tab to select this view.
-
-The Results Viewer can be also activated for saved results and it can show a high level results grouped, or a results at a file level, depending on which node on the Directory Tree is selected to populate the Table Results Viewer.
-
-Example\n
-Below is an example of a "Table Results Viewer" window:
-\image html table-result-viewer-tab.PNG
+The Result Viewer windows are in the upper right area of the interface and display the results from selecting something in the Tree Viewer. The columns displayed will depend on what was selected in the Tree Viewer - files will show things like path, size, and creation date while a contact would show its name, phone number, and email. Selecting an item in the Result Viewer will show details about the item in the Content Viewer below. See the \ref result_viewer_page for additional information.
\section ui_content Content Viewer
-The \ref content_viewer_page area is in the lower right area of the interface. This area is used to view a specific file in a variety of formats. There are different tabs for different viewers. Not all tabs support all file types, so only some of them will be enabled. To display data in this area, a file must be selected from the Result Viewer window.
+The Content Viewer area is in the lower right area of the interface. This area is used to view a specific file in a variety of formats. There are different tabs for different viewers. Not all tabs support all file types, so only some of them will be enabled. To display data in this area, a file must be selected from the Result Viewer window.
-The Content Viewer area is part of a plug-in framework. You can install modules that will add more viewer types. For additional information on the built-in content viewers, see the \ref content_viewer_page page.
+The Content Viewer area is part of a plug-in framework, meaning you can install modules that will add more viewer types.
+For additional information see the \ref content_viewer_page page.
\section ui_keyword Keyword Search
-Keyword Search allows the user to search for keywords in the data source. It is covered in more detail here: \subpage keyword_search_page
+The Keyword Search feature allows the user to search for keywords in one or more data sources contained in the current case. It is covered in more detail here: \ref keyword_search_page
\section ui_status Status Area
-The Status area will show progress bars while ingest is occuring. This visually indicates to the user what portion of the processing is already complete. The user can click on the progress bars to see further detail or to cancel ingest jobs.
+The Status area will show progress bars while ingest is occurring. This visually indicates what portion of the processing is already complete. You can click on the progress bars to see further detail or to cancel ingest jobs.
*/
diff --git a/docs/doxygen-user/view_options.dox b/docs/doxygen-user/view_options.dox
index 67cb5853d4..4516a035ef 100644
--- a/docs/doxygen-user/view_options.dox
+++ b/docs/doxygen-user/view_options.dox
@@ -39,6 +39,10 @@ This option allows you to hide tags from other users in the Tagging section of t
By default, the first three columns in the result viewer after the file name in the results viewer are named "S", "C" and "O". These are described in more detail on the \ref result_viewer_page page. The Comment and Other occurrences columns query the Central Repository. If this seems to be having a performance impact, it can be disabled using the checkbox. This will remove the Other occurrences column entirely and the Comment column will be based only on tags.
+\subsection view_options_paging Paging
+
+By default, only 10,000 results will be show in the Result Viewer. You can change that threshold here. Setting it to zero will disable paging.
+
\subsection view_options_content_viewer Content viewer selection
By default, the \ref content_viewer_page attempts to select the most relevant tab to display when choosing a node. If you would like to change this behavior to instead stay on the same content viewer when changing nodes, switch to the "Stay on the same file viewer" option.
@@ -53,7 +57,7 @@ Timestamps can be viewed in either local time or in a time zone selected in the
\subsection view_options_translate Translate text
-If you have a custom translation module installed, this option will add a column to the \ref result_viewer_page to show the translated name of files and folders.
+If you have a \ref machine_translation_page module installed, this option will add a column to the \ref result_viewer_page to show the translated name of files and folders.
\section view_options_case Current Case Settings