autopsy-flatpak/docs/doxygen-user/personas.dox

/*! \page personas_page Personas

[TOC]

\section personas_overview Overview

Autopsy can store and organize account information based on personas, which represent an online identity. A person may have several online identities and therefore several personas. As an example, a single person may have a set of accounts that post online about loving cats and another set of accounts that appear unrelated that post about hating cats.

\section personas_concepts Concepts

Here are some basic concepts about persona:
<ul>
<li>To make a persona, you need to have a name and at least one account.
<li>A persona may have multiple accounts - a phone number, an email, a Facebook account, a Skype account, etc.
<li>Personas span cases and therefore are stored in the \ref central_repo_page "Central Repository".
<li>You can manually create a persona or make one based on a contact book entry, or a call log, or a message.
<li>An account may be part of multiple personas. This can happen if someone uses the same cell phone as a recovery number for accounts on multiple personas.
<li>A persona may have additional metadata associated with it as name/value pairs.
<li>A persona may have one or more aliases.
<li>Autopsy will show you if an account is part of a persona, where applicable.
</ul>

Personas are stored in the Central Repository based on accounts that were found in results. These results are generated by various ingest modules such as the \ref recent_activity_page and \ref android_analyzer_page.

Autopsy provides a dedicated tool, the \ref personas_editor "Personas Editor", to create, view,  edit, and delete personas.

\section personas_editor Personas Editor

The Personas Editor is loaded through the Tools -> Personas menu item.

The left panel in the Personas Editor is a table that lists personas, based on the selected criteria.  The right panel displays the details of the persona currently selected in the left panel. 
 
By default, when the Personas Editor is launched, all the personas in the Central Repository are listed in the table. You may filter this list by checking the "Filter personas by Keyword" checkbox.  Type in either a persona name or an account identifier in the textbox and select the "Name" or "Account" radio button appropriately.  Then click the "Show" button to show only the personas that match the filtering criteria.

\image html Personas/personas_main.png

\subsection personas_create Create Personas

To create a new persona, click the "New Persona" button.  A "Create Persona" dialog box will pop up. The following is a description of each field:

<ul>
<li><b>Name</b>: The name of the persona
<li><b>Created by</b>: Will be automatically filled in with the current user
<li><b>Created on</b>: Will be automatically filled in after saving the persona
<li><b>Comment</b>: A description of the persona
<li><b>Accounts</b>: At least one account belonging to the persona
<li><b>Metadata</b>: (Optional) Name/value pairs of data related to the persona
<li><b>Aliases</b>: (Optional) Any aliases for this persona
<li><b>Cases found in</b>: Will be automatically filled in when editing a persona
</ul>

Each persona needs at least one account associated with it. These accounts must have been previously saved to the \ref central_repo_page "central repository". Clicking "Add" under "Accounts" will bring up another dialog with four fields, all required:

<ul>
<li><b>Identifier</b>: The identifier for the account (phone number, email address, Facebook account id, etc)
<li><b>Type</b>: The type of identifier
<li><b>Confidence</b>: General confidence that this account goes with the given persona
<li><b>Justification</b>: Why this account is being added to the persona
</ul>

\image html Personas/personas_create.png

When finished adding at least one account and filling in the required fields, click on OK to create the persona.  A persona with the specified name will be created and associated with the specified account(s).

\subsection personas_edit Edit Personas

To edit a persona, click the "Edit Persona" button. You'll be able to edit all the data about the persona.

\image html Personas/persona_edit.png

\subsection personas_delete Delete Personas

To delete a persona, select the persona in the table and click on the "Delete Persona" button.   Click "Yes" on confirmation dialog to delete the selected persona.

\subsection personas_account_create Create Account

All personas must be associated with at least one account. Normally these account will be added to the central repository by various ingest modules, but you can also create them manually with the "Create Account" button.

\image html Personas/personas_create_account.png

\section personas_artifact_viewers Persona integration in Content Viewers

Autopsy shows personas associated with accounts, where applicable. When viewing contact, call log and message results, Autopsy shows the personas associated with accounts in these panels. If no persona exists for an account, Autopsy provides a button for the user to create one.
 
As shown below, when viewing a contact result you may see persona data. When one or more personas are found associated with the accounts in the result then the Persona name is shown in the contact content viewer. There will be a "View" button to see the details of the persona.

\image html Personas/personas_contact_found.png

If no matching persona is found, a "Create" button is shown to create a persona for the account(s). This will bring you to the \ref personas_create "Create Personas" panel with the account(s) already added, assuming the accounts exist in the central repository. If the desired account does not appear, close the personas panel and then copy the account to the clipboard either by highlighting the account and hitting control+c or by right clicking on it and selecting copy. Next go to Tools->Personas to open the Personas Editor, and click "Create Account". Paste in the account and select the type, then OK. Now close the editor and click "Create" again. The account should now be auto-populated.

\image html Personas/personas_contact_not_found.png

Personas are integrated similarly in the content viewers for call logs and messages/e-mail.

\image html Personas/personas_calllog.png
<br>
\image html Personas/personas_message.png

\section personas_cvt Persona Integration in the Communications Visualization Tool

Personas are integrated with the \ref communications_page.  When viewing accounts in the Accounts browsers in the Communications Visualization Tool, associated persona information is shown in the tooltip if you hover over the account.

\image html Personas/personas_cvt_hover.png

As in the Autopsy main window, you may also create or view personas when examining contacts, call logs, and messages in the Communications Visualization Tool.

\image html Personas/personas_cvt_accounts.png

*/