/*! \page design_page General Design 

\section design_overview Overview
This section outlines Autopsy design from the typical analysis work flow perspective.
This page is organized based on these phases:
- A Case is created.
- Images are added to the case and ingest modules are run.
- Results are manually reviewed and searched.
- Reports are generated.

\section design_case Creating a Case

The first step in Autopsy work flow is creating a case. This is done in the org.sleuthkit.autopsy.casemodule package (package \ref casemodule_overview).  This module contains the wizards needed and deals with how to store the information.  You should not need to do much modifications in this package.  But, you will want to use the org.sleuthkit.autopsy.casemodule.Case object to access all data related to this case.


\section design_image Adding an Image

After case is created, one or more disk images can be added to the case.  There is a wizard to guide that process
and it is located in the org.sleuthkit.autopsy.casemodule package.  Refer to the package section \ref casemodule_add_image for more details on the wizard. 

	
After image has been added to the case, the user can select one or more ingest modules to be executed on the image.
Ingest modules focus on a specific type of analysis task and run in the background.  The results from the ingest module can be found in the results tree and in the ingest inbox.  

The org.sleuthkit.autopsy.ingest package provides the basic infrastructure for the ingest module management.    See the \ref ingestmodue_contents page for more details.  

A list of standard modules that come with Autopsy can be found in:
- org.sleuthkit.autopsy.keywordsearch
- org.sleuthkit.autopsy.recentactivity
- org.sleuthkit.autopsy.hashdatabase
- org.sleuthkit.autopsy.thunderbirdparser

See \ref ingestmodule_making for more details on making an ingest module.


\section design_view Viewing Results

The UI has three main areas.  The tree on the left-hand side, the result viewers in the upper right, and the content viewers in the lower right.  Data passes between these areas by encapsulating them in Node objects (see org.openide.nodes.Node).  Nodes use property sheets to encapsulate data (blackboard attributes) and are modeled in a parent-child hierarchy with other nodes.
The hierarchy is used to visually represent the data and to trigger child node updates when the parent node is selected.
Node child factories are invoked by the Netbeans framework at the time of parent node selection to populate and refresh the child node view.

The tree on the left hand-side shows the analysis results.  Its contents are populated from the central database.   See the org.sleuthkit.autopsy.directorytree module for more details. 

The area in the upper right is the result viewer area.  When a node is selected from the tree, the data is sent to this area.  It is a framework with modules that display the data in different layouts.  The org.sleuthkit.autopsy.corecomponentsinterfaces package has the interface to make one of these modules.  

When an item is selected from the result viewer area, it is passed to the bottom right content viewers.  It too is a framework with many modules that know how to show information about a specific file in different ways.  The org.sleuthkit.autopsy.corecomponentsinterfaces package has the interface to make one of these modules.  See XXX on building new content viewers.


<!-- @@@ MOVE THIS SOMEWHERE ELSE -- the directory tree package maybe??

The component is by default registered with the ingest manager as an ingest event listener.
The viewer first loads all the viewer-supported data currently in the blackboard when Autopsy starts.  
During the ingest process the viewer receives events from ingest services
(relayed by ingest manager) and it selectively refreshes parts of the tree providing real-time updates to the user.
When ingest is completed, the viewer responds to the final ingest data event generated by the ingest manager, 
and performs a final refresh of all viewer-supported data in the blackboard.


User normally initiates result navigation in the directory tree.  

Node content support capabilities are registered in the node's Lookup.
Multiple content viewers (such as strings, hex, extracted text, media) can support the node content.
If multiple content viewers are supported, a preferred (default) content viewer is chosen.

For more information refer to org.sleuthkit.autopsy.corecomponents, org.sleuthkit.autopsy.corecomponentsinterfaces
and  

-->

\section design_report Report generation

When ingest is complete, the user can generate reports.  There is a reporting framework to enable many different formats.  Autopsy currently comes with generic html, xml and Excel reports.  See the org.sleuthkit.autopsy.report package for details on the framework and
\ref report_making for details on building a new report module. 


<!--Each reporting submodule implements org.sleuthkit.autopsy.report.ReportModule interface and registers itself in layer.xml

Reporting submodule typically interacts with 3 components:
- org.sleuthkit.autopsy.report.ReportConfiguration - to read current reporting configuration set by the user,
- Blackboard API in org.sleuthkit.datamodel.SleuthkitCase class - to traverse and read blackboard artifacts and attributes,
- an API (possibly external/thirdparty API) to convert blackboard artifacts data structures to the desired reporting format.

Please refer to report.dox and org.sleuthkit.autopsy.report package API documentation for more details on how to implement a custom reporting submodule.
-->


*/