diff --git a/docs/doxygen-user/Doxyfile b/docs/doxygen-user/Doxyfile
old mode 100644
new mode 100755
index f5c015f7f364b2e36c9b2ea0b77b3f36db1eb6f0..de047fcc0f3504cf9bfae8c19a8756d846a0c0c7
--- a/docs/doxygen-user/Doxyfile
+++ b/docs/doxygen-user/Doxyfile
@@ -38,7 +38,7 @@ PROJECT_NAME = "Autopsy User Documentation"
# could be handy for archiving the generated documentation or if some version
# control system is used.
-PROJECT_NUMBER = 3.1
+PROJECT_NUMBER = 3.1.2
# Using the PROJECT_BRIEF tag one can provide an optional one line description
# for a project that appears at the top of each page and should give viewer a
@@ -1372,7 +1372,7 @@ DISABLE_INDEX = NO
# The default value is: NO.
# This tag requires that the tag GENERATE_HTML is set to YES.
-GENERATE_TREEVIEW = YES
+GENERATE_TREEVIEW = NO
# The ENUM_VALUES_PER_LINE tag can be used to set the number of enum values that
# doxygen will group on one line in the generated HTML documentation.
@@ -1486,7 +1486,7 @@ MATHJAX_CODEFILE =
# The default value is: YES.
# This tag requires that the tag GENERATE_HTML is set to YES.
-SEARCHENGINE = YES
+SEARCHENGINE = NO
# When the SERVER_BASED_SEARCH tag is enabled the search engine will be
# implemented using a web server instead of a web client using Javascript. There
@@ -2040,14 +2040,14 @@ ALLEXTERNALS = NO
# listed.
# The default value is: YES.
-EXTERNAL_GROUPS = YES
+EXTERNAL_GROUPS = NO
# If the EXTERNAL_PAGES tag is set to YES, all external pages will be listed in
# the related pages index. If set to NO, only the current project's pages will
# be listed.
# The default value is: YES.
-EXTERNAL_PAGES = YES
+EXTERNAL_PAGES = NO
# The PERL_PATH should be the absolute path and name of the perl script
# interpreter (i.e. the result of 'which perl').
@@ -2117,7 +2117,7 @@ DOT_NUM_THREADS = 0
# The default value is: Helvetica.
# This tag requires that the tag HAVE_DOT is set to YES.
-DOT_FONTNAME = FreeSans
+DOT_FONTNAME =
# The DOT_FONTSIZE tag can be used to set the size (in points) of the font of
# dot graphs.
diff --git a/docs/doxygen-user/EXIF_parser_page.dox b/docs/doxygen-user/EXIF_parser_page.dox
new file mode 100755
index 0000000000000000000000000000000000000000..7837d9c2c2042b676d4827ccf61c58eec6e5f3df
--- /dev/null
+++ b/docs/doxygen-user/EXIF_parser_page.dox
@@ -0,0 +1,29 @@
+/*! \page EXIF_parser_page EXIF Parser Module
+
+What Does It Do
+========
+
+The EXIF Parser module extracts EXIF (Exchangeable Image File Format) information from ingested pictures. This information can contain geolocation data for the picture, time, date, camera model and settings (exposure values, resolution, etc) and other information. The discovered attributes are added to the BlackBoard.
+
+This can tell you where and when a picture was taken, and give clues to the camera that took it.
+
+Configuration
+=======
+
+There is no configuration required.
+
+Using the Module
+======
+Select the checkbox in the Ingest Modules settings screen to enable the EXIF Parser.
+
+Ingest Settings
+------
+There are no runtime ingest settings required.
+
+Seeing Results
+------
+Results are shown in the Results tree.
+
+\image html EXIF-tree.PNG
+
+*/
diff --git a/docs/doxygen-user/README.txt b/docs/doxygen-user/README.txt
old mode 100644
new mode 100755
diff --git a/docs/doxygen-user/android_analyzer.dox b/docs/doxygen-user/android_analyzer.dox
new file mode 100755
index 0000000000000000000000000000000000000000..f73cfb93d4342dfdbe532245a4035e066caf94dc
--- /dev/null
+++ b/docs/doxygen-user/android_analyzer.dox
@@ -0,0 +1,47 @@
+/*! \page android_analyzer_page Android Analyzer Module
+
+What Does It Do
+========
+
+The Android Analyzer module allows you to analyze SQLite and other files from an Android device. It works on Physical dumps from most Android devices (note that we do not provide an acquisition method). Autopsy will not support older Android devices that do not have a volume system. These devices will often have a single physical image file for them and there is no information in the image that describes the layout of the file systems. Autopsy will therefore not be able to detect what it is.
+
+
+The module should be able to extract the following:
+
+- Text messages / SMS / MMS
+- Call Logs
+- Contacts
+- Tango Messages
+- Words with Friends Messages
+- GPS from the browser and Google Maps
+- GPS from cache.wifi and cache.cell files
+
+NOTE: These database formats vary by version of OS and different vendors can place the databaes in different places. Autopsy may not support all versions and vendors.
+
+NOTE: This module is not exhaustive with its support for Android. It was created as a starting point for others to contribute plug-ins for 3rd party apps. See the Developer docs (http://sleuthkit.org/autopsy/docs/api-docs/3.1/mod_mobile_page.html) for information on writing modules.
+
+
+Configuration
+=======
+
+There is no configuration required.
+
+Using the Module
+======
+
+Simply add your physical images or file system dumps as data sources and enable the Android Analyzer module.
+
+Ingest Settings
+------
+There are no runtime ingest settings required.
+
+Seeing Results
+------
+The results show up in the tree under "Results", "Extracted Content".
+
+\image html android_analyzer_output.PNG
+
+*/
+
+
+*/
diff --git a/docs/doxygen-user/archive_extractor.dox b/docs/doxygen-user/archive_extractor.dox
new file mode 100755
index 0000000000000000000000000000000000000000..ac20daa753534ac3e78cd9eeba92acc5e21fbf59
--- /dev/null
+++ b/docs/doxygen-user/archive_extractor.dox
@@ -0,0 +1,34 @@
+/*! \page archive_extractor_page Archive Extractor Module
+
+What Does It Do
+========
+
+The Archive Extractor module opens ZIP, RAR, and other archive formats and sends the files from those archive files back through the ingest pipeline for analysis.
+
+Why would you use it?
+This module expands archive files to enable Autopsy to analyze all files on the system. It enables keyword search and hash lookup to analyze files inside of archives
+
+Configuration
+=======
+
+There is no configuration required.
+
+Using the Module
+======
+Select the checkbox in the Ingest Modules settings screen to enable the Archive Extractor.
+
+Ingest Settings
+------
+There are no runtime ingest settings required.
+
+Seeing Results
+------
+Each file extracted shows up in the data source tree view as a child of the archive containing it,
+
+\image html zipped_children_1.PNG
+<br>
+<br>
+and as an archive under "Views", "File Types", "Archives".
+\image html zipped_children_2.PNG
+
+*/
diff --git a/docs/doxygen-user/case_management.dox b/docs/doxygen-user/case_management.dox
old mode 100644
new mode 100755
index bf933e460adc15c500974cb6570679616996817f..0a8371822eab81442cdfd9181e326a60ef09606f
--- a/docs/doxygen-user/case_management.dox
+++ b/docs/doxygen-user/case_management.dox
@@ -2,13 +2,15 @@
You need to create a case before you can analyze data in Autopsy. A case can contain one or more data sources (disk images, disk devices, logical files). The data sources can be from multiple drives in a single computer or from multiple computers. It's up to you.
-Each case has its own directory that is named based on the case name. The directory will contain configuration files, a database, reports, and other files that modules generates. The main Autopsy case configuration file has a .aut extension.
+Each case has its own directory that is named based on the case name. The directory will contain configuration files, a database, reports, and other files that modules generates. The main Autopsy case configuration file has an ".aut" extension.
\section case_create Creating a Case
+\image html splashscreen.PNG
+
There are several ways to create a new case:
-- The opening window has a button to create a new case.
-- The "File" -> "New Case..." menu item
+- The opening splash screen has a button to create a new case.
+- The "File", "New Case..." menu item
The "New Case" wizard dialog will open and you will need to enter the case name and base directory. A directory for the case will be created inside of the "base directory". If the directory already exists, you will need to either delete the existing directory or choose a different combination of names.
@@ -21,8 +23,8 @@ After you create the case, you will be prompted to add a data source, as describ
\section case_open Opening a Case
To open a case, either:
-- Choose "Open Case" or "Open Recent Case" from the opening window.
-- The "File" -> "Open Case" menu item or "File" -> "Open Recent Case"
+- Choose "Open Case" or "Open Recent Case" from the opening splash screen.
+- The "File", "Open Case" menu item or "File", "Open Recent Case"
Navigate to the case directory and select the ".aut" file.
diff --git a/docs/doxygen-user/content_viewer.dox b/docs/doxygen-user/content_viewer.dox
new file mode 100755
index 0000000000000000000000000000000000000000..27de79f7c47cda2e7f3fbd380e2fa2bd3c4552c5
--- /dev/null
+++ b/docs/doxygen-user/content_viewer.dox
@@ -0,0 +1,23 @@
+/*! \page content_viewer_page Content Viewer
+
+The Content Viewer lives in the lower right-hand side of the Autopsy main screen and show pictures, video, hex, text, extracted strings, metadata, etc. They are enabled when you select a file in the file list above it.
+
+The Content Viewer is context-aware, meaning it will present different views of the content based on the type of file selected. For example, a .JPG would show up as a picture, a text file would show up as text, and a .bin file would show up as hex output.
+
+The screenshots below show some examples of content viewers in action.
+<br>
+\image html content-viewer-1.PNG
+<br>
+<br>
+\image html content-viewer-2.PNG
+<br>
+<br>
+\image html content-viewer-3.PNG
+<br>
+<br>
+\image html content-viewer-4.PNG
+<br>
+<br>
+\image html content-viewer-5.PNG
+<br>
+*/
diff --git a/docs/doxygen-user/content_viewers.dox b/docs/doxygen-user/content_viewers.dox
deleted file mode 100644
index c3e0ff86af4596b5d43a7f04999b41aaad302e82..0000000000000000000000000000000000000000
--- a/docs/doxygen-user/content_viewers.dox
+++ /dev/null
@@ -1,61 +0,0 @@
-/*! \page content_viewers Content Viewers
-
-The Content Viewer area is in the lower right area of the interface. This area is used to view a specific file in a variety of formats. There are different tabs for different viewers. Not all tabs support all file types, so only some of them will be enabled. To display data in this area, a file must be selected from the Result Viewer window.
-
-The Content Viewer area is part of a plug-in framework. You can install modules that will add more viewer types. This section describes the viewers that come by default with Autopsy.
-
-Here's an example of a "Content Viewer" window:
-\image html content-viewer-window-example.PNG
-
-<b>Default Viewers</b>
-Currently, there are 5 main tabs on "Content Viewer" window:
-\li \ref result_content_viewers
-\li \ref hex_content_viewer
-\li \ref string_content_viewer
-\li \ref media_content_viewer
-\li \ref text_content_viewer
-
-\section result_content_viewers Result Content Viewer
-Result Content Viewer shows the artifacts (saved results) associated with the item selected in the Result Viewer.
-<b>Example</b>
-Below is an example of "Result Content Viewer" window:
-\image html result-viewer-example.PNG
-
-\section hex_content_viewer Hex Content Viewer
-Hex Content Viewer shows you the raw and exact contents of a file. In this Hex Content Viewer, the data of the file is represented as hexadecimal values grouped in 2 groups of 8 bytes, followed by one group of 16 ASCII characters which are derived from each pair of hex values (each byte). Non-printable ASCII characters and characters that would take more than one character space are typically represented by a dot (".") in the following ASCII field.
-
-<b>Example</b> \n
-Below is an example of "Hex Content Viewer" window:
-\image html hex-content-viewer-tab.PNG
-
-\section media_content_viewer Media Content Viewer
-
-The Media Content Viewer will show a picture or video file. Video files can be played and paused. The size of the picture or video will be reduced to fit into the screen. If you want more complex analysis of the media, then you must export the file.
-
-If you select an non-picture file or an unsupported picture format on the "Result Viewers", this tab will be disabled.
-
-<b>Example</b> \n
-Here's one of the example of the "Media Content Viewer":
-\image html picture-content-viewer-tab.PNG
-
-\section string_content_viewer String Content Viewer
-
-Strings Content Viewer scans (potentially binary) data of the file / folder and searches it for data that could be text. When appropriate data is found, the String Content Viewer shows data strings extracted from binary, decoded, and interpreted as UTF8/16 for the selected script/language.
-
-Note that this is different from the Text Content Viewer, which displays the text for a file that is stored in the keyword search index. The results may be the same or they could be different, depending how the data were interpreted by the indexer.
-
-<b>Example</b> \n
-Below is an example of "String Content Viewer" window:
-\image html string-content-viewer-tab.PNG
-
-\section text_content_viewer Text Content Viewer
-
-Text Content Viewer uses the keyword search index that may have been populated during Image Ingest. If a file has text stored in the index, then this tab will be enabled and it will be displayed to the user if a file or a result associated with a file is selected.
-
-This tab may have more text on it than the "String View", which relies on searching the file for text-looking data. Some files, like PDF, will not have text-looking data at the byte-level, but the keyword indexing process knows how to interpret a PDF file and produce text. For the files the indexer knows about, there may be the METADATA section at the end of the displayed extracted text. If an indexed document contains any metadata (such as creation date, author, etc), it will be displayed there. Note that, unlike the "String View", the Text View does not have its built-in settings for the script/language to use for extracted strings. This is because the script/language is used at indexing time, and that setting is associated with the Keyword Search indexer, not the viewer.
-
-If this tab is not enabled, then either the file has no text or you did not enable Keyword Search as an ingest module. Note that this viewer is also used to display highlighted keyword hits when operated in the "Search Matches" mode, selected on the right-hand side of the viewer's toolbar.
-
-\image html text-view.PNG
-
-*/
\ No newline at end of file
diff --git a/docs/doxygen-user/data_sources.dox b/docs/doxygen-user/data_sources.dox
old mode 100644
new mode 100755
index 5dc8e8e0edbac7c7eb4fcd49ec9919ffd7a9d78a..68105a46fdea11264e2e02bea530421c61fec341
--- a/docs/doxygen-user/data_sources.dox
+++ b/docs/doxygen-user/data_sources.dox
@@ -1,7 +1,7 @@
/*! \page ds_page Data Sources
-Data source is the term that we use in Autopsy to refer to disk images, logical files, etc. This is the data that you want to add in to analyze. You must have a case open before you can add a data source.
+A data source the thing you want to analyze. It can be a disk image, some logical files, a local drive, etc. You must open a case prior to adding a data source to Autopsy.
Autopsy supports three types of data sources:
- Disk Image: A file (or set of files) that is a byte-for-byte copy of a hard drive or media card. (see \ref ds_img)
@@ -15,14 +15,10 @@ Autopsy supports three types of data sources:
You can add a data source in several ways:
- After you create a case, it automatically prompts you to add a data source.
- There is a toolbar item to add a Data Source when a case is open.
-- The "File" -> "Add Data Source" menu item when a case is open.
+- The "File", "Add Data Source" menu item when a case is open.
The data source must remain accessible for the duration of the analysis because the case contains only a reference to the data source. It does not copy the data source into the case folder.
-
-
-\section ds_process Data Source Adding Process
-
Regardless of the type of data source, there are some common steps in the process:
1) You will be prompted to specify the data source to add (details are provided below)
@@ -41,7 +37,7 @@ Regardless of the type of data source, there are some common steps in the proces
5) After the ingest modules have been configured and the basic examination of the data source is complete, the ingest modules will begin to analyze the file contents.
-
+You cannot remove a data source from a case.
\section ds_img Adding a Disk Image
@@ -89,8 +85,4 @@ To add logical files:
All of the files that you added in the panel will be grouped together into a single data source, called "LogicalFileSet" in the main UI.
-\section ds_rem Removing a Data Source
-
-You cannot currently remove an data source from a case.
-
*/
\ No newline at end of file
diff --git a/docs/doxygen-user/directory_tree.dox b/docs/doxygen-user/directory_tree.dox
deleted file mode 100644
index 1f0bbe7af38a9c018bcd2e2749ee6690b09d11ff..0000000000000000000000000000000000000000
--- a/docs/doxygen-user/directory_tree.dox
+++ /dev/null
@@ -1,44 +0,0 @@
-/*! \page directory_tree Directory Tree
-
-\section about_data_explorer About Data Explorer (Directory Tree)
-The data explorer tree is a very important area of the interface. This is where you will start many of your analysis approaches and find saved results from automated procedures (ingest). The tree has three main areas:
-\li <b>Images:</b> \n Where you can find the directory tree hierarchy of the file systems in the images. Go here to navigate to a specific file or directory.
-\li <b>Views:</b> \n Where you can view all of the files in the images, but organized by file type or dates instead of directories. Go here if you are looking for files of a given type or that were recently used.
-\li <b>Results:</b> \n Where you can see the results from the background ingest tasks and you can see your previous search results. Go here to see what was found by the ingest modules and to find your previous search results.
-\li <b>Bookmarks:</b> \n Where you can view all file and results that have been bookmarked for easy access.
-
-Below is an example of an Data Explorer Tree window:
-image html explorer-tree.PNG
-
-\section image_details_window Image Detail Window
-
-The Image Details window shows you basic information about a disk image. You can access it by right-clicking on an image in the tree and choosing "Image Details".
-
-\image html show-image-details.PNG
-
-An example is shown here:
-
-\image html image-detail-window.PNG
-
-\section volume_details_window Volume Detail Window
-
-The Volume Details window shows you information about a volume. It shows information such as the starting sector, length, and description. You can view the information by right clicking on a volume in the tree and choosing "Volume Details".
-
-\image html show-volume-details.PNG
-An example is shown here:
-
-\image html volume-detail-window.PNG
-
-\section extracting_unallocated_space Extracting Unallocated Space
-
-Unallocated space are chunks of the file system that is currently not being used for anything. Unallocated space can store deleted files and other interesting artifacts. On the actual image, Unallocated space is stored in blocks with distinct locations on the system. However, because of the way various carving tools work, it is more ideal to feed them a single, large unallocated file. Autopsy provides access to both methods of looking at unallocated space.
-\li Individual Blocks Underneath a volume, there is a folder named Unalloc. This folder contains all the individual unallocated blocks as the image is storing them. You can right click and extract them the same way you can extract any other type of file in the Directory Tree.
-\li Single Files There are two ways to extract unallocated space as a single file. Right clicking on a volume and selecting "Extract Unallocated Space as Single File" will concatenate all the unallocated files into a single, continuous file for the volume. The second way is to right click on an image, and select "Extract Unallocated Space to Single Files". This option will extract one single file for each volume in the image. Progress on extraction is sent to the progress bar in the bottom right. Progress is based on number of files concatenated. These files are stored in the Export folder under the case directory. Files are named according to ImageName-Unalloc-ImageObjectID-VolumeID.dat This naming scheme ensures that no duplicate file names will occur even if an there are two images with the same name in a case.
-
-Below is where to find the single file extraction option
-
-\image html extracting-unallocated-space.PNG
-
-
-
-*/
\ No newline at end of file
diff --git a/docs/doxygen-user/e01_verifier.dox b/docs/doxygen-user/e01_verifier.dox
new file mode 100755
index 0000000000000000000000000000000000000000..7c1f6100e6068af61ef44368a781bb9a018619f9
--- /dev/null
+++ b/docs/doxygen-user/e01_verifier.dox
@@ -0,0 +1,31 @@
+/*! \page e01_verifier_page E01 Verifier Module
+
+What Does It Do
+========
+
+The E01 Verifier module computes a checksum on E01 files and compares with the E01 file's internal checksum to ensure they match.
+This can detect if the E01 module is corrupted.
+
+
+Configuration
+=======
+
+There is no configuration required.
+
+
+Using the Module
+======
+Select the checkbox in the Ingest Modules list to use this module.
+
+Ingest Settings
+------
+There are no runtime ingest settings required.
+
+Seeing Results
+------
+
+You only see results from this module if the E01 is corrupted. A failure to load is shown below.
+
+\image html e01-verifier.png
+
+*/
diff --git a/docs/doxygen-user/email_parser.dox b/docs/doxygen-user/email_parser.dox
new file mode 100755
index 0000000000000000000000000000000000000000..550ad2b67a5e6d7b9674ec1455fdca542efe0f8c
--- /dev/null
+++ b/docs/doxygen-user/email_parser.dox
@@ -0,0 +1,30 @@
+/*! \page email_parser_page Email Parser Module
+
+What Does It Do
+========
+
+The Email Parser module identifies Thunderbird MBOX files and PST format files based on file signatures, extracting the e-mails from them, adding the results to the Blackboard. This module skips known files and creates a Blackboard artifact for each message. It adds email attachments as derived files.
+
+This allows the user to identify email-based communications from the system being analyzed.
+
+Configuration
+=======
+
+There is no configuration required.
+
+
+Using the Module
+======
+Explore the "Results", "E-Mail Messages" portion of the tree to review the results of this module.
+
+Ingest Settings
+------
+There are no runtime ingest settings required.
+
+Seeing Results
+------
+The results of this show up in the "Results", "E-Mail Messages" portion of the tree.
+
+\image html email_results.PNG
+
+*/
diff --git a/docs/doxygen-user/extension_mismatch.dox b/docs/doxygen-user/extension_mismatch.dox
new file mode 100755
index 0000000000000000000000000000000000000000..e3839c45c76394ccbd8f43953f48e28bb5654b2c
--- /dev/null
+++ b/docs/doxygen-user/extension_mismatch.dox
@@ -0,0 +1,35 @@
+/*! \page extension_mismatch_detector_page Extension Mismatch Detector Module
+
+What Does It Do
+========
+
+Extension Mismatch Detector module uses the results from the File Type Identification and flags files that have an extension not traditionally associated with the file's detected type. Ignores 'known' (NSRL) files. You can customize the MIME types and file extensions per MIME type in Tools, Options, File Extension Mismatch.
+
+This detects files that someone may be trying to hide.
+
+Configuration
+=======
+One can add and remove MIME types in the "Tools", "Options", "File Extension Mismatch" dialog box, as well as add and remove extensions to particular MIME types.
+<br>
+\image html extension-mismatch-detected-configuration.PNG
+<br>
+
+Using the Module
+======
+Note that you can get a lot of false positives with this module. You can add your own rules to Autopsy to reduce unwanted hits.
+
+Ingest Settings
+------
+
+In the ingest settings, the user can choose if the module should skip files without extensions and skip text files. Both of these options are enabled by default.
+
+\image html extension-mismatch-detected-ingest-settings.PNG
+
+
+Seeing Results
+------
+Results are shown ini the Results tree under "Extension Mismatch Detected".
+
+\image html extension-mismatch-detected.PNG
+
+*/
diff --git a/docs/doxygen-user/file_search.dox b/docs/doxygen-user/file_search.dox
old mode 100644
new mode 100755
index 91bf0d1c326aa9514fbef9d9a0c517872ee787d3..e297c0424d0c2aca9e853efdf89e36e419f010b1
--- a/docs/doxygen-user/file_search.dox
+++ b/docs/doxygen-user/file_search.dox
@@ -1,31 +1,19 @@
-/*! \page file_search File Search
+/*! \page file_search_page File Search
\section about_file_search About File Search
-File Search tool can be accessed either from the Tools menu or by right-clicking on image node in the Data Explorer / Directory Tree. By using File Search, you can specify, filter, and show the directories and files that you want to see from the images in the current opened case. The File Search results will be populated in a brand new Table Result viewer on the right-hand side.
+The File Search tool can be accessed either from the Tools menu or by right-clicking on a data source node in the Data Explorer / Directory Tree. By using File Search, you can specify, filter, and show the directories and files that you want to see from the images in the current opened case. The File Search results will be populated in a brand new Table Result viewer on the right-hand side.
Currently, Autopsy only supports 4 categories in File Search: Name, Size, Date, and Known Status based search.
-<b>Note: Currently File Search doesn't support regular expression, however the Keyword Search feature of Autopsy does also look in file names and it does support regular expressions, which can complimentary to the File Search.</b>
-<b>How to Open File Search:</b>\n
-To see how to open File Search, click \ref how_to_open_file_search "here".\n
-<b>Note: The File Search Window is opened and closed automatically. If there's a case opened and there is at least one image inside that case, File Search Window can't be closed.</b>
-
-<b>How to Use File Search:</b> \n
-To see how to use File Search, click \ref how_to_use_file_search "here".
-
-<b>Example</b>
-Here's an example of a File Search window:
-
-\image html file-search-top-component.PNG
+Note: Currently File Search doesn't support regular expressions. The Keyword Search feature of Autopsy does support regular expressions and can be used for to search for files and/or directories by name.
\section how_to_open_file_search How To Open File Search
How to Open File Search
To open the File Search, you can do one of the following thing:
-Right click an image and choose "Open File Search by Attributes".
+Right click a data source and choose "Open File Search by Attributes".
\image html open-file-search-component-1.PNG
-Select the "Tools" > "File Search by Attributes".
+Select the "Tools", "File Search by Attributes".
\image html open-file-search-component-2.PNG
-<b>Note: The File Search Window is opened and closed automatically. If there's a case opened and there is at least one image inside that case, File Search Window can't be closed.</b>
\section how_to_use_file_search How To Use File Search
diff --git a/docs/doxygen-user/filetype.dox b/docs/doxygen-user/filetype.dox
new file mode 100755
index 0000000000000000000000000000000000000000..e581dcb81d488bd5ccf64d49a5441694b6abe214
--- /dev/null
+++ b/docs/doxygen-user/filetype.dox
@@ -0,0 +1,41 @@
+/*! \page file_type_identification_page File Type Identification Module
+
+What Does It Do
+========
+
+The File Type ID module identifies files based on their internal signatures and does not rely on file extensions. Autopsy uses the <a href="http://tika.apache.org/">Tika</a> library to do its primary file ID detection and that can be customized with user-defined rules.
+
+You should enable this module because many other modules depend on its results to determine if they should analyze a file. Some examples include:
+
+- \subpage extension_mismatch_detector_page
+- \subpage keyword_search_page
+
+
+Configuration
+=======
+
+You do not need to configure anything with this module unless you want to define your own types. To define your own types, go to "Tools", "Options", "File Type Id" panel.
+
+From there, you can define rules based on the offset of the signature and if the signature is a byte sequence of an ASCII string.
+
+\image html filetype.png
+
+Using the Module
+======
+
+Ingest Settings
+------
+There are no run-time settings for this module when you run it on
+a data source. All user-defined and Tika rules are always applied.
+
+
+Seeing Results
+------
+
+This module does not have obvious impacts in the user interface, though it is used by many othe modules.
+
+To see the file type of an individual file, view the "Results" tab in the lower right when you navigate to the file. You should see a page in there that mentions the file type.
+
+The Views area of the tree does not take the results of this module into account. That part of the tree relies on extension. We will be upating it in the future to rely on extension when there is no output from this module for the file.
+
+*/
diff --git a/docs/doxygen-user/footer.html b/docs/doxygen-user/footer.html
old mode 100644
new mode 100755
index 4029c565969d9a42b4f83433cbe46067e22c2774..fa43708523ae74de79d613e2952efbfacb406600
--- a/docs/doxygen-user/footer.html
+++ b/docs/doxygen-user/footer.html
@@ -1,5 +1,5 @@
<hr/>
-<p><i>Copyright © 2012-2015 Basis Technology <br/>
+<p><i>Copyright © 2012-2015 Basis Technology. Generated on $date<br/>
This work is licensed under a
<a rel="license" href="http://creativecommons.org/licenses/by-sa/3.0/us/">Creative Commons Attribution-Share Alike 3.0 United States License</a>.
</i></p>
diff --git a/docs/doxygen-user/hashdb_lookup.dox b/docs/doxygen-user/hashdb_lookup.dox
old mode 100644
new mode 100755
index f966b253e32119a8870ef249e1cd5e08ec12edfc..2b41c48ae319b2f35222b52110f7ec9e4c6b9fdf
--- a/docs/doxygen-user/hashdb_lookup.dox
+++ b/docs/doxygen-user/hashdb_lookup.dox
@@ -1,11 +1,13 @@
/*! \page hash_db_page Hash Database Lookup Module
-Autopsy has an ingest module that calculates hash values and looks up the hash values in a database to determine if the file is known bad, known (in general), or unknown. This page outlines that module and its configuration.
+What Does It Do
+========
-
-\section hash_db_config Configuring the module
+The Hash Database Lookup Module calculates MD5 hash values for files and looks up hash values in a database to determine if the file is known bad, known (in general), or unknown.
+Configuration
+=======
The Hash Database Management window is where you can set and update your hash database information. Hash databases are used to identify files that are 'known'.
\li Known good files are those that can be safely ignored. This set of files frequently includes standard OS and application files. Ignoring such uninteresting to the investigator files, can greatly reduce image analysis time.
\li Known bad (also called notable) files are those that should raise awareness. This set will vary depending on the type of investigation, but common examples include contraband images and malware.
@@ -17,17 +19,39 @@ Autopsy allows for multiple known bad hash databases to be set. Autopsy supports
\li NSRL: The format of the NSRL database.
\li HashKeeper: Hashset file conforming to the HashKeeper standard.
-<b>NIST_NSRL:</b>
-Autopsy can use the <A HREF="http://www.nsrl.nist.gov">NIST NSRL</A> to detect 'known files'. Note that the NSRL contains hashes of 'known files' that may be good or bad depending on your perspective and investigation type. For example, the existence of a piece of financial software may be interesting to your investigation and that software could be in the NSRL. Therefore, Autopsy treats files that are found in the NSRL as simply 'known' and does not specify good or bad. Ingest modules have the option of ignoring files that were found in the NSRL.
-To use the NSRL, you must concatenate all of the NSRLFile.txt files together. You can use 'cat' on a Unix system or from within Cygwin to do this.
\section adding_hashsets Adding Hashsets
Autopsy needs an index of the hashset to actualy use a hash database. It can create the index if you import only the hashset. When you select the database from within this window, it will tell you if the index needs to be created. Autopsy uses the hash database management system from The Sleuth Kit. You can manually create an index using the 'hfind' command line tool or you can use Autopsy. If you attempt proceed without indexing a database, Autopsy will offer to automatically produce an index for you.
You can also specify only the index file and not use the full hashset - the index file is sufficient to identify known files. This can save space. To do this, specify the .idx file from the Hash Database Management window.
+
\section using_hashsets Using Hashsets
-There is an \ref ingest "ingest module" that will hash the files and look them up in the hashsets. It will flag files that were in the notable hashset and those results will be shown in the Results tree of the \ref directory_tree "Data Explorer".
+There is an \ref ingest_page "ingest module" that will hash the files and look them up in the hashsets. It will flag files that were in the notable hashset and those results will be shown in the Results tree of the \ref tree_viewer_page.
Other ingest modules are able to use the known status of a file to decide if they should ignore the file or process it.
You can also see the results in the \ref how_to_open_file_search "File Search" window. There is an option to choose the 'known status'. From here, you can do a search to see all 'known bad' files. From here, you can also choose to ignore all 'known' files that were found in the NSRL. You can also see the status of the file in a column when the file is listed.
\image html hash-database-configuration.PNG
+<b>NIST NSRL:</b>
+Autopsy can use the <A HREF="http://www.nsrl.nist.gov">NIST NSRL</A> to detect 'known files'. Note that the NSRL contains hashes of 'known files' that may be good or bad depending on your perspective and investigation type. For example, the existence of a piece of financial software may be interesting to your investigation and that software could be in the NSRL. Therefore, Autopsy treats files that are found in the NSRL as simply 'known' and does not specify good or bad. Ingest modules have the option of ignoring files that were found in the NSRL.
+To use the NSRL, you must concatenate all of the NSRLFile.txt files together. You can use 'cat' on a Unix system or from within Cygwin to do this.
+
+
+
+Using the Module
+======
+
+Ingest Settings
+------
+When hashsets are configured, the user can select the hashsets to use during the ingest process.
+
+\image html hash-lookup.png
+
+
+
+Seeing Results
+------
+
+Results show up in the tree as "Hashset Hits", grouped by the name of the hash set.
+
+\image html hashset-hits.png
+
*/
diff --git a/docs/doxygen-user/image_viewer.dox b/docs/doxygen-user/image_viewer.dox
old mode 100644
new mode 100755
index 6bd319160dcb1663b165724f2bd81c4ccf32e6bc..d12d47aaf974f65659baf2964f5c6a789091819f
--- a/docs/doxygen-user/image_viewer.dox
+++ b/docs/doxygen-user/image_viewer.dox
@@ -1,4 +1,4 @@
-/*! \page image_viewer Image and Video Viewer
+/*! \page image_viewer_page Image and Video Viewer
Overview
========
This document outlines the use of the new Image Analyzer feature of Autopsy. This feature was funded by DHS S&T to help provide free and open source digital forensics tools to law enforcement.
@@ -8,12 +8,11 @@ The new image analyzer feature has been designed specifically with child-exploit
- Allows examiner to start viewing images immediately upon adding them to the case. As images are hashed, they are updated in the interface. You do not need to wait until the entire image is ingested.
This document assumes basic familiarity with Autopsy.
-
Quick Start
===========
-1. The Image Analysis tool can be configured to collect data about images/videos as ingest runs or all at once after ingest. To change this setting go to Tools->Options->Image /Video Analyzer. This setting is saved per case, but can not be changed during ingest.
+1. The Image Analysis tool can be configured to collect data about images/videos as ingest runs or all at once after ingest. To change this setting go to "Tools", "Options", "Image /Video Analyzer". This setting is saved per case, but can not be changed during ingest.
2. Create a case as normal and add a disk image (or folder of files) as a data source. Ensure that you have the hash lookup module enabled with NSRL and known bad hashsets, the EXIF module enabled, and the File Type module enabled.
-3. Click Tools->Analyze Images/Videos in the menu. This will open the Autopsy Image/Video Analysis tool in a new window.
+3. Click "Tools", "Analyze Images/Videos" in the menu. This will open the Autopsy Image/Video Analysis tool in a new window.
4. Groups of images will be presented as they are analyzed by the background ingest modules. You can later resort and regroup, but it is required to keep it grouped by folder while ingest is still ongoing.
5. As each group is reviewed, the next highest priority group is presented, according to a sorting criteria (the default is the density of hash set hits).
6. Images that were hits from hashsets, will have a dashed border around them.
diff --git a/docs/doxygen-user/images/EXIF-tree.PNG b/docs/doxygen-user/images/EXIF-tree.PNG
new file mode 100755
index 0000000000000000000000000000000000000000..6fdc2efcd447e48c4effd2ac8ba51133fdc0572b
Binary files /dev/null and b/docs/doxygen-user/images/EXIF-tree.PNG differ
diff --git a/docs/doxygen-user/images/add-data-source.PNG b/docs/doxygen-user/images/add-data-source.PNG
old mode 100644
new mode 100755
diff --git a/docs/doxygen-user/images/android_analyzer_output.PNG b/docs/doxygen-user/images/android_analyzer_output.PNG
new file mode 100755
index 0000000000000000000000000000000000000000..91606a187bfc713b5dffa35639dcfcf1ac555b3f
Binary files /dev/null and b/docs/doxygen-user/images/android_analyzer_output.PNG differ
diff --git a/docs/doxygen-user/images/case-newcase.png b/docs/doxygen-user/images/case-newcase.png
old mode 100644
new mode 100755
index f86132d9a8c03b86d7432ecde31a9da1381dd259..5d580db79701f3c44cea6583a4db93fa8c2bc0dc
Binary files a/docs/doxygen-user/images/case-newcase.png and b/docs/doxygen-user/images/case-newcase.png differ
diff --git a/docs/doxygen-user/images/content-viewer-1.PNG b/docs/doxygen-user/images/content-viewer-1.PNG
new file mode 100755
index 0000000000000000000000000000000000000000..6e83fd8ee836080bbadf22fd403b2079f0635dfa
Binary files /dev/null and b/docs/doxygen-user/images/content-viewer-1.PNG differ
diff --git a/docs/doxygen-user/images/content-viewer-2.PNG b/docs/doxygen-user/images/content-viewer-2.PNG
new file mode 100755
index 0000000000000000000000000000000000000000..ef8c50494f3e3900b92c7eb002869713cf4fbf47
Binary files /dev/null and b/docs/doxygen-user/images/content-viewer-2.PNG differ
diff --git a/docs/doxygen-user/images/content-viewer-3.PNG b/docs/doxygen-user/images/content-viewer-3.PNG
new file mode 100755
index 0000000000000000000000000000000000000000..4be1388616941ac66f94c2b840511f4a1bb52166
Binary files /dev/null and b/docs/doxygen-user/images/content-viewer-3.PNG differ
diff --git a/docs/doxygen-user/images/content-viewer-4.PNG b/docs/doxygen-user/images/content-viewer-4.PNG
new file mode 100755
index 0000000000000000000000000000000000000000..43519f5c27558b885aa8306292d31d9869a20d74
Binary files /dev/null and b/docs/doxygen-user/images/content-viewer-4.PNG differ
diff --git a/docs/doxygen-user/images/content-viewer-5.PNG b/docs/doxygen-user/images/content-viewer-5.PNG
new file mode 100755
index 0000000000000000000000000000000000000000..186b2d466c321631563e41f94ce6f0d2d7b327fc
Binary files /dev/null and b/docs/doxygen-user/images/content-viewer-5.PNG differ
diff --git a/docs/doxygen-user/images/content-viewer-window-example.PNG b/docs/doxygen-user/images/content-viewer-window-example.PNG
deleted file mode 100644
index ba2b0832206d088df80c920d7028bf3b857d6f1e..0000000000000000000000000000000000000000
Binary files a/docs/doxygen-user/images/content-viewer-window-example.PNG and /dev/null differ
diff --git a/docs/doxygen-user/images/data-source-progress-bar.PNG b/docs/doxygen-user/images/data-source-progress-bar.PNG
old mode 100644
new mode 100755
index 59afc70a20657a195fd9d3fd7a6934afd1567eea..d5a443d011300e54bf23682400d3c79e5ac038f7
Binary files a/docs/doxygen-user/images/data-source-progress-bar.PNG and b/docs/doxygen-user/images/data-source-progress-bar.PNG differ
diff --git a/docs/doxygen-user/images/directory-tree.PNG b/docs/doxygen-user/images/directory-tree.PNG
new file mode 100755
index 0000000000000000000000000000000000000000..0d7f4bd50dea3dcf29f036b2ec28e94798b49de9
Binary files /dev/null and b/docs/doxygen-user/images/directory-tree.PNG differ
diff --git a/docs/doxygen-user/images/e01-verifier.PNG b/docs/doxygen-user/images/e01-verifier.PNG
new file mode 100755
index 0000000000000000000000000000000000000000..3f5d3c3faa38abf10f42c7aa6c464458cd93526f
Binary files /dev/null and b/docs/doxygen-user/images/e01-verifier.PNG differ
diff --git a/docs/doxygen-user/images/email_results.PNG b/docs/doxygen-user/images/email_results.PNG
new file mode 100755
index 0000000000000000000000000000000000000000..1e7f7447460bbbce1a2ffccc71642fa645ab1128
Binary files /dev/null and b/docs/doxygen-user/images/email_results.PNG differ
diff --git a/docs/doxygen-user/images/example-of-file-sarch.PNG b/docs/doxygen-user/images/example-of-file-sarch.PNG
old mode 100644
new mode 100755
diff --git a/docs/doxygen-user/images/explorer-tree.PNG b/docs/doxygen-user/images/explorer-tree.PNG
old mode 100644
new mode 100755
diff --git a/docs/doxygen-user/images/extension-mismatch-detected-configuration.PNG b/docs/doxygen-user/images/extension-mismatch-detected-configuration.PNG
new file mode 100755
index 0000000000000000000000000000000000000000..d93257a5d5806b4c6228ddf9b552fd5951ad20d9
Binary files /dev/null and b/docs/doxygen-user/images/extension-mismatch-detected-configuration.PNG differ
diff --git a/docs/doxygen-user/images/extension-mismatch-detected-ingest-settings.PNG b/docs/doxygen-user/images/extension-mismatch-detected-ingest-settings.PNG
new file mode 100755
index 0000000000000000000000000000000000000000..3a40a5c3404b2967147ca0d1e40074093681cc8c
Binary files /dev/null and b/docs/doxygen-user/images/extension-mismatch-detected-ingest-settings.PNG differ
diff --git a/docs/doxygen-user/images/extension-mismatch-detected.PNG b/docs/doxygen-user/images/extension-mismatch-detected.PNG
new file mode 100755
index 0000000000000000000000000000000000000000..7b4085ce9acad9bbea8a74fbd13a86c202787c6f
Binary files /dev/null and b/docs/doxygen-user/images/extension-mismatch-detected.PNG differ
diff --git a/docs/doxygen-user/images/extracted_content.PNG b/docs/doxygen-user/images/extracted_content.PNG
new file mode 100755
index 0000000000000000000000000000000000000000..b8696a93e7700f98e62755768e9bcf1eb493f57a
Binary files /dev/null and b/docs/doxygen-user/images/extracted_content.PNG differ
diff --git a/docs/doxygen-user/images/extracting-unallocated-space.PNG b/docs/doxygen-user/images/extracting-unallocated-space.PNG
old mode 100644
new mode 100755
diff --git a/docs/doxygen-user/images/file-search-top-component.PNG b/docs/doxygen-user/images/file-search-top-component.PNG
old mode 100644
new mode 100755
diff --git a/docs/doxygen-user/images/filetype.PNG b/docs/doxygen-user/images/filetype.PNG
new file mode 100755
index 0000000000000000000000000000000000000000..d14cc5470aa35e9d3b353df7e50990e78d6fe0b6
Binary files /dev/null and b/docs/doxygen-user/images/filetype.PNG differ
diff --git a/docs/doxygen-user/images/generate-report-1.PNG b/docs/doxygen-user/images/generate-report-1.PNG
new file mode 100755
index 0000000000000000000000000000000000000000..d2114ca3cfebde250c6c4dcd55cd319a817d0ee8
Binary files /dev/null and b/docs/doxygen-user/images/generate-report-1.PNG differ
diff --git a/docs/doxygen-user/images/generate-report-2.PNG b/docs/doxygen-user/images/generate-report-2.PNG
new file mode 100755
index 0000000000000000000000000000000000000000..3ca822fb27394b8b3b25c34c957771a73a505ee9
Binary files /dev/null and b/docs/doxygen-user/images/generate-report-2.PNG differ
diff --git a/docs/doxygen-user/images/generate-report-3.PNG b/docs/doxygen-user/images/generate-report-3.PNG
new file mode 100755
index 0000000000000000000000000000000000000000..6f764c9c8953c5c92cb74d6e00eb060e56f63b20
Binary files /dev/null and b/docs/doxygen-user/images/generate-report-3.PNG differ
diff --git a/docs/doxygen-user/images/generate-report-4.PNG b/docs/doxygen-user/images/generate-report-4.PNG
new file mode 100755
index 0000000000000000000000000000000000000000..906ac42752d16c8d13f5bda610f8465291bf7c6c
Binary files /dev/null and b/docs/doxygen-user/images/generate-report-4.PNG differ
diff --git a/docs/doxygen-user/images/generate-report-5.PNG b/docs/doxygen-user/images/generate-report-5.PNG
new file mode 100755
index 0000000000000000000000000000000000000000..c177044235a1ce3536ca3906ac718f4aeef3c830
Binary files /dev/null and b/docs/doxygen-user/images/generate-report-5.PNG differ
diff --git a/docs/doxygen-user/images/generate-report-6.PNG b/docs/doxygen-user/images/generate-report-6.PNG
new file mode 100755
index 0000000000000000000000000000000000000000..df7229bb409f88a5918dec2df869d27dab03d3ec
Binary files /dev/null and b/docs/doxygen-user/images/generate-report-6.PNG differ
diff --git a/docs/doxygen-user/images/hash-database-configuration.PNG b/docs/doxygen-user/images/hash-database-configuration.PNG
old mode 100644
new mode 100755
index 46891afa5b02e32eceb4f51a0c128fe3d6adf464..9bc5f571d1e75896e477c02be5058e0147acdd29
Binary files a/docs/doxygen-user/images/hash-database-configuration.PNG and b/docs/doxygen-user/images/hash-database-configuration.PNG differ
diff --git a/docs/doxygen-user/images/hash-lookup.PNG b/docs/doxygen-user/images/hash-lookup.PNG
new file mode 100755
index 0000000000000000000000000000000000000000..5f70223b5ec921fe4b8b2dd5eb434f8fe0301778
Binary files /dev/null and b/docs/doxygen-user/images/hash-lookup.PNG differ
diff --git a/docs/doxygen-user/images/hashset-hits.PNG b/docs/doxygen-user/images/hashset-hits.PNG
new file mode 100755
index 0000000000000000000000000000000000000000..3677e8adca043bb61f5faf62abdf94df6cfd8478
Binary files /dev/null and b/docs/doxygen-user/images/hashset-hits.PNG differ
diff --git a/docs/doxygen-user/images/hex-content-viewer-tab.PNG b/docs/doxygen-user/images/hex-content-viewer-tab.PNG
old mode 100644
new mode 100755
diff --git a/docs/doxygen-user/images/image-detail-window.PNG b/docs/doxygen-user/images/image-detail-window.PNG
deleted file mode 100644
index d1638de35654e95a53758faba11190303bf573d7..0000000000000000000000000000000000000000
Binary files a/docs/doxygen-user/images/image-detail-window.PNG and /dev/null differ
diff --git a/docs/doxygen-user/images/inbox-button.PNG b/docs/doxygen-user/images/inbox-button.PNG
old mode 100644
new mode 100755
diff --git a/docs/doxygen-user/images/inbox-detail-screen.PNG b/docs/doxygen-user/images/inbox-detail-screen.PNG
old mode 100644
new mode 100755
diff --git a/docs/doxygen-user/images/inbox-main-screen.PNG b/docs/doxygen-user/images/inbox-main-screen.PNG
old mode 100644
new mode 100755
index be50ee0a40c96e2f9d3e2ceb2d7980765b5e1731..04d1f7e2ea0055de8bd67603ad9c74ff91540096
Binary files a/docs/doxygen-user/images/inbox-main-screen.PNG and b/docs/doxygen-user/images/inbox-main-screen.PNG differ
diff --git a/docs/doxygen-user/images/ingest_pipeline.PNG b/docs/doxygen-user/images/ingest_pipeline.PNG
new file mode 100755
index 0000000000000000000000000000000000000000..a91b73f64273fc4a1a2680dc0649c4322c5bc295
Binary files /dev/null and b/docs/doxygen-user/images/ingest_pipeline.PNG differ
diff --git a/docs/doxygen-user/images/interesting_files_configuration.PNG b/docs/doxygen-user/images/interesting_files_configuration.PNG
new file mode 100755
index 0000000000000000000000000000000000000000..60d4b1772fbab4efb6afb8a45051931e75d2e1e7
Binary files /dev/null and b/docs/doxygen-user/images/interesting_files_configuration.PNG differ
diff --git a/docs/doxygen-user/images/interesting_files_ingest_settings.PNG b/docs/doxygen-user/images/interesting_files_ingest_settings.PNG
new file mode 100755
index 0000000000000000000000000000000000000000..61f78c7e26091ea39b9295ea2177431cea4dd05c
Binary files /dev/null and b/docs/doxygen-user/images/interesting_files_ingest_settings.PNG differ
diff --git a/docs/doxygen-user/images/interesting_files_results.PNG b/docs/doxygen-user/images/interesting_files_results.PNG
new file mode 100755
index 0000000000000000000000000000000000000000..26dd994cd9a270c808c2248a75601a9ab26e6129
Binary files /dev/null and b/docs/doxygen-user/images/interesting_files_results.PNG differ
diff --git a/docs/doxygen-user/images/keyword-search-bar.PNG b/docs/doxygen-user/images/keyword-search-bar.PNG
old mode 100644
new mode 100755
index ea8d62ff4f0f37b6a36cfe9f2c7b71193f0c1e0c..dc9cc74111e878b44cfef3991aa3b15df4d69dbd
Binary files a/docs/doxygen-user/images/keyword-search-bar.PNG and b/docs/doxygen-user/images/keyword-search-bar.PNG differ
diff --git a/docs/doxygen-user/images/keyword-search-configuration-dialog-general.PNG b/docs/doxygen-user/images/keyword-search-configuration-dialog-general.PNG
old mode 100644
new mode 100755
index 4eed672ec626ce43b52424eb55ddf67b9ebaf47e..97dc6da4e371abe606d6ec4667a100a69be9ed19
Binary files a/docs/doxygen-user/images/keyword-search-configuration-dialog-general.PNG and b/docs/doxygen-user/images/keyword-search-configuration-dialog-general.PNG differ
diff --git a/docs/doxygen-user/images/keyword-search-configuration-dialog-string-extraction.PNG b/docs/doxygen-user/images/keyword-search-configuration-dialog-string-extraction.PNG
old mode 100644
new mode 100755
index ee8199878b8a415192af3d1236eb885d665d9717..643cf6c25e90d5aae942f2e6d68f26a73c79d06b
Binary files a/docs/doxygen-user/images/keyword-search-configuration-dialog-string-extraction.PNG and b/docs/doxygen-user/images/keyword-search-configuration-dialog-string-extraction.PNG differ
diff --git a/docs/doxygen-user/images/keyword-search-configuration-dialog.PNG b/docs/doxygen-user/images/keyword-search-configuration-dialog.PNG
old mode 100644
new mode 100755
index 998b7a0e871989cb9f96d1f0e5526a579a685809..cb2ce5f32ac03360341baefd628be55550da0ee2
Binary files a/docs/doxygen-user/images/keyword-search-configuration-dialog.PNG and b/docs/doxygen-user/images/keyword-search-configuration-dialog.PNG differ
diff --git a/docs/doxygen-user/images/keyword-search-hits.PNG b/docs/doxygen-user/images/keyword-search-hits.PNG
new file mode 100755
index 0000000000000000000000000000000000000000..446bd9ada35a68d6b3db5d99a141e2549c6734e9
Binary files /dev/null and b/docs/doxygen-user/images/keyword-search-hits.PNG differ
diff --git a/docs/doxygen-user/images/keyword-search-ingest-settings.PNG b/docs/doxygen-user/images/keyword-search-ingest-settings.PNG
new file mode 100755
index 0000000000000000000000000000000000000000..a393e24c8df372ec84808d17ece009ff534aa317
Binary files /dev/null and b/docs/doxygen-user/images/keyword-search-ingest-settings.PNG differ
diff --git a/docs/doxygen-user/images/keyword-search-list-results.PNG b/docs/doxygen-user/images/keyword-search-list-results.PNG
new file mode 100755
index 0000000000000000000000000000000000000000..83cda9c20e4542554ed1558f4738e90fa99e26d1
Binary files /dev/null and b/docs/doxygen-user/images/keyword-search-list-results.PNG differ
diff --git a/docs/doxygen-user/images/keyword-search-list.PNG b/docs/doxygen-user/images/keyword-search-list.PNG
new file mode 100755
index 0000000000000000000000000000000000000000..0e33fa769d46510dcd1c3bddf5391fe6d9df5039
Binary files /dev/null and b/docs/doxygen-user/images/keyword-search-list.PNG differ
diff --git a/docs/doxygen-user/images/open-file-search-component-1.PNG b/docs/doxygen-user/images/open-file-search-component-1.PNG
old mode 100644
new mode 100755
index 90dd45ee3b9691325e8848851ffa2b4ffca22e69..7c86dbdfc49affdb203d01584ee1962fe13455f5
Binary files a/docs/doxygen-user/images/open-file-search-component-1.PNG and b/docs/doxygen-user/images/open-file-search-component-1.PNG differ
diff --git a/docs/doxygen-user/images/open-file-search-component-2.PNG b/docs/doxygen-user/images/open-file-search-component-2.PNG
old mode 100644
new mode 100755
index 230b3687b236df520aeeb6cd1435df2d8ef90766..64d15ab3675b552265929beee3239bc387956583
Binary files a/docs/doxygen-user/images/open-file-search-component-2.PNG and b/docs/doxygen-user/images/open-file-search-component-2.PNG differ
diff --git a/docs/doxygen-user/images/photorec_output.PNG b/docs/doxygen-user/images/photorec_output.PNG
new file mode 100755
index 0000000000000000000000000000000000000000..859ed4f87128b4de95ebc46c857a22ada7f4279a
Binary files /dev/null and b/docs/doxygen-user/images/photorec_output.PNG differ
diff --git a/docs/doxygen-user/images/picture-content-viewer-tab.PNG b/docs/doxygen-user/images/picture-content-viewer-tab.PNG
old mode 100644
new mode 100755
diff --git a/docs/doxygen-user/images/result-viewer-example.PNG b/docs/doxygen-user/images/result-viewer-example-1.PNG
similarity index 100%
rename from docs/doxygen-user/images/result-viewer-example.PNG
rename to docs/doxygen-user/images/result-viewer-example-1.PNG
diff --git a/docs/doxygen-user/images/result-viewer-example-2.PNG b/docs/doxygen-user/images/result-viewer-example-2.PNG
new file mode 100755
index 0000000000000000000000000000000000000000..25be40d481a76906567c0b861df4e2cb2716dbfc
Binary files /dev/null and b/docs/doxygen-user/images/result-viewer-example-2.PNG differ
diff --git a/docs/doxygen-user/images/result-viewer-example-3.PNG b/docs/doxygen-user/images/result-viewer-example-3.PNG
new file mode 100755
index 0000000000000000000000000000000000000000..fbdda31e8a509e01e284e5d733a04014fe96fc73
Binary files /dev/null and b/docs/doxygen-user/images/result-viewer-example-3.PNG differ
diff --git a/docs/doxygen-user/images/result-viewer-window-example.PNG b/docs/doxygen-user/images/result-viewer-window-example.PNG
old mode 100644
new mode 100755
diff --git a/docs/doxygen-user/images/screenshot.png b/docs/doxygen-user/images/screenshot.png
old mode 100644
new mode 100755
index b6b6d840b6640d8fd67c3296f5647c01d894c40a..bc94b4b382ae776589ae17a1f820eb735bb60fc4
Binary files a/docs/doxygen-user/images/screenshot.png and b/docs/doxygen-user/images/screenshot.png differ
diff --git a/docs/doxygen-user/images/select-data-source-type.PNG b/docs/doxygen-user/images/select-data-source-type.PNG
old mode 100644
new mode 100755
index b8afc7d9a39565200661caddba56262cb3d7ff71..5f250104d15cb6f37138e4175df79ac38aa95765
Binary files a/docs/doxygen-user/images/select-data-source-type.PNG and b/docs/doxygen-user/images/select-data-source-type.PNG differ
diff --git a/docs/doxygen-user/images/select-ingest-modules.PNG b/docs/doxygen-user/images/select-ingest-modules.PNG
old mode 100644
new mode 100755
index 999b5b3cf4adb91b92d1a10797741823043e382a..1f227102b8d29d0fb24ce7f7b2555f3bb77b474e
Binary files a/docs/doxygen-user/images/select-ingest-modules.PNG and b/docs/doxygen-user/images/select-ingest-modules.PNG differ
diff --git a/docs/doxygen-user/images/show-image-details.PNG b/docs/doxygen-user/images/show-image-details.PNG
deleted file mode 100644
index ff2d6e788d45aba06c02c6a92aeae6f0257c612f..0000000000000000000000000000000000000000
Binary files a/docs/doxygen-user/images/show-image-details.PNG and /dev/null differ
diff --git a/docs/doxygen-user/images/show-volume-details.PNG b/docs/doxygen-user/images/show-volume-details.PNG
deleted file mode 100644
index 782e0d8313b8aaf5fcb75fd4c91fa46ee11f339a..0000000000000000000000000000000000000000
Binary files a/docs/doxygen-user/images/show-volume-details.PNG and /dev/null differ
diff --git a/docs/doxygen-user/images/splashscreen.PNG b/docs/doxygen-user/images/splashscreen.PNG
new file mode 100755
index 0000000000000000000000000000000000000000..9827d781ff1c764cbb269740e71b75a707f75cfd
Binary files /dev/null and b/docs/doxygen-user/images/splashscreen.PNG differ
diff --git a/docs/doxygen-user/images/string-content-viewer-tab.PNG b/docs/doxygen-user/images/string-content-viewer-tab.PNG
old mode 100644
new mode 100755
diff --git a/docs/doxygen-user/images/table-result-viewer-tab.PNG b/docs/doxygen-user/images/table-result-viewer-tab.PNG
old mode 100644
new mode 100755
diff --git a/docs/doxygen-user/images/tagging-1.PNG b/docs/doxygen-user/images/tagging-1.PNG
new file mode 100755
index 0000000000000000000000000000000000000000..b2a91afe0b141ff61fe90dc81a9a29f12e5f2bd8
Binary files /dev/null and b/docs/doxygen-user/images/tagging-1.PNG differ
diff --git a/docs/doxygen-user/images/tagging-2.PNG b/docs/doxygen-user/images/tagging-2.PNG
new file mode 100755
index 0000000000000000000000000000000000000000..8a1b3c07b44716b215bc5634cf072b7ac4e65cb9
Binary files /dev/null and b/docs/doxygen-user/images/tagging-2.PNG differ
diff --git a/docs/doxygen-user/images/tagging-3.PNG b/docs/doxygen-user/images/tagging-3.PNG
new file mode 100755
index 0000000000000000000000000000000000000000..92f5b3c940d42994f6f49ff1fee880b833556b57
Binary files /dev/null and b/docs/doxygen-user/images/tagging-3.PNG differ
diff --git a/docs/doxygen-user/images/tagging-4.PNG b/docs/doxygen-user/images/tagging-4.PNG
new file mode 100755
index 0000000000000000000000000000000000000000..1b98aaddf89ad4dba1749fe4e11ef58c684438f4
Binary files /dev/null and b/docs/doxygen-user/images/tagging-4.PNG differ
diff --git a/docs/doxygen-user/images/text-view.PNG b/docs/doxygen-user/images/text-view.PNG
old mode 100644
new mode 100755
diff --git a/docs/doxygen-user/images/threadcount.PNG b/docs/doxygen-user/images/threadcount.PNG
new file mode 100755
index 0000000000000000000000000000000000000000..c465a4a3e8b144a883c16a2b1034649ddd70e47a
Binary files /dev/null and b/docs/doxygen-user/images/threadcount.PNG differ
diff --git a/docs/doxygen-user/images/thumbnail-result-viewer-tab.PNG b/docs/doxygen-user/images/thumbnail-result-viewer-tab.PNG
old mode 100644
new mode 100755
diff --git a/docs/doxygen-user/images/ui-layout-1.png b/docs/doxygen-user/images/ui-layout-1.png
new file mode 100755
index 0000000000000000000000000000000000000000..7a99d1e26445d53a2a4d987288fbec05ad7b080a
Binary files /dev/null and b/docs/doxygen-user/images/ui-layout-1.png differ
diff --git a/docs/doxygen-user/images/volume-detail-window.PNG b/docs/doxygen-user/images/volume-detail-window.PNG
deleted file mode 100644
index e3a425427b6d0631fa848aa859c2d26026e59f78..0000000000000000000000000000000000000000
Binary files a/docs/doxygen-user/images/volume-detail-window.PNG and /dev/null differ
diff --git a/docs/doxygen-user/images/zipped_children_1.PNG b/docs/doxygen-user/images/zipped_children_1.PNG
new file mode 100755
index 0000000000000000000000000000000000000000..d391c9110500327d2d85c75f7d36f2d5983b1d30
Binary files /dev/null and b/docs/doxygen-user/images/zipped_children_1.PNG differ
diff --git a/docs/doxygen-user/images/zipped_children_2.PNG b/docs/doxygen-user/images/zipped_children_2.PNG
new file mode 100755
index 0000000000000000000000000000000000000000..f1e7318258eef6647a6690c92d464b18a2f886f7
Binary files /dev/null and b/docs/doxygen-user/images/zipped_children_2.PNG differ
diff --git a/docs/doxygen-user/ingest.dox b/docs/doxygen-user/ingest.dox
old mode 100644
new mode 100755
index b607de5cd530956f9145f32d266d36b018aaecf8..8cc209c76336e2eaee9b08a55bd73e654c03ef0e
--- a/docs/doxygen-user/ingest.dox
+++ b/docs/doxygen-user/ingest.dox
@@ -1,61 +1,55 @@
-/*! \page ingest Ingest
+/*! \page ingest_page Ingest Modules
-\section ingest_ingest Image Ingest
-Autopsy tries to automate as many things as possible for the user. There are many tasks that will always be performed in a digital investigation and they normally involve some type of image or file analysis and extraction of a certain type of information. The analysis can be a lengthy process, especially for large images and when a number of types of analysis needs to be performed.
+Ingest modules analyze the data in a data source. They perform all of the analysis of the files and parse their contents. Examples include \ref hash_db_page "hash calculation and lookup", \ref keyword_search_page "keyword searching", and \ref recent_activity_page "web artifact extraction".
-Ingest is a technique of automating these tasks. Autopsy allows to run these lengthy analysis tasks in the background, while the user can browse the application interface and review the ingest results as their appear. Ingest is similar to triage. Autopsy attempts to process files inside the ingested image in such order so that the more interesting files (user-related files) are processed files.
+Immediately after you add a data source to a case (see \ref ds_page), you will be presented with a dialog to configure the ingest modules to run on it. Once configured, they will run in the background and provide you real-time results when the find relevant information.
-The ingest process begins after the basic file system information has been added to the database. A series of ingest modules (described in a following section) run automatically behind the scenes and make their results available as soon as possible. Autopsy is designed so that these results are reported to the user in real-time, and even for very large images to be processed there can be initial results available minutes, sometimes seconds after the analysis has started.
+This page covers the use of ingest modules. Specific pages will cover the configuration of specific modules. See \ref module_install_page for details on installing 3rd-party ingest modules.
-You can start image ingest in two ways. When you add an image with the Add Data Source wizard, you will be shown the list of ingest modules and you can choose which you want to run. You can also launch the Ingest Manager run ingest by right clicking on an image in the explorer tree and choosing "Restart Image Ingest".
+\section ingest_performance Multi-threaded and Priority
-Once ingest is started, you can review the currently running ingest tasks in the task bar on the bottom-right corner of the main window. The ingest tasks can be canceled by the user if so desired.
+Ingest modules are configured to find user content quickly. The ingest modules are grouped into pipelines and each file goes down the pipeline, module by module. A pipeline may have modules in the following order:
-<b>Note: sometimes the cancellation process make take several seconds or more to complete cleanly, depending on what the ingest module was currently doing. </b>
+\image html ingest_pipeline.png
-The ingest message inbox will provide notifications when the particular ingest modules start and finish running. There may also be error notifications, and result notifications sent by specific ingest modules.
+Multiple pipelines may be running at the same time. By default, two pipelines are running, but you can add more depending on how many cores you have on your system. You can configure the number of pipelines to make in the "Tools", "Options", "General" area.
-The results from the ingest modules can typically be found in the Results area of the explorer tree. However, some modules may choose to write results to a local file or to some other location and not make them available in the UI.
+Autopsy prioritizes user content over other types of files and will send data from the "Documents and Settings" folder or "Users" folder into the pipelines before the "Windows" folder. It prioritizes each folder in the system to ensure that user content is analyzed before other content.
-\section ingest_modules Ingest Modules
-An ingest module is responsible for extracting data from and searching images. Different modules will do different things. Examples include:
-\li Calculate MD5 hash of each file
-\li Lookup MD5 hash in database
-\li Detect file type of each file
-\li Keyword search each file
-\li Extract web artifacts (downloads, history, installed programs, web search engine queries, etc.)
-\li Extract Email messages
-\li Extract connected device IDs.
-\li Extract EXIF meta-data from picture files
-\subsection ingest_modules_config Configuring Ingest Modules
+\section ingest_running Running Ingest Modules
-There are two places to configure ingest modules. When the Ingest Manager is launched, there may be a small set of options the module allows you to edit directly in the Ingest Manager. Additionally, the Ingest Manager may display an "Advanced" button, which will open up a larger configuration menu with more available settings. This advanced configuration menu can often be found in the "Tools" > "Options" menu, along with the advanced settings for numerous other ingest modules.
+There are two ways to start ingest modules:
+-# Immediately after you add a data source
+-# By right-clicking on a data source from the tree in the main interface and choosing "Run Ingest Modules"
-Before launching ingest, you should go over the modules configuration by selecting every module in the list and review the current ingest module settings. Some modules need to be configured at least the first time Autopsy is used to have default configuration populated, otherwise they won't perform any analysis. Changing the modules configuration will potentially affect number of results found, it might also affect the total time required for ingest to run and how fast the results are reported in real-time.
+Once ingest is started, you can review the currently running ingest tasks in the task bar on the bottom-right corner of the main window. The ingest tasks can be canceled by the user if so desired.
-\subsection ingest_modules_adding Adding Ingest Modules
+<b>Note: sometimes the cancellation process may take several seconds or more to complete cleanly, depending on what the ingest module was currently doing. </b>
-Ingest modules can be created by third-party-developers and can be added independently of Autopsy. This can be done through Autopsy's plugin manager. This is accessible through the "Tools" > "Plugins" menu. Currently, the best way to add an ingest module is by navigating to the module's NBM file after choosing "Add Plugin..." in the "Downloaded" tab of the plugin manager. Autopsy will require a restart after any modules are installed in order to properly load and display them.
+\section ingest_configure Configuring Ingest Modules
+You will be presented with an interface to configure the ingest modules. From here, you can choose to enable or disable each module and some modules will have further configuration settings.
+\image html select-ingest-modules.png
-\section message_inbox Message Inbox
-\subsection ingest_message_inbox Ingest Message Inbox
-The ingest message inbox is used by Autopsy to provide real-time updates during ingest. To open the inbox, click on the yellow warning sign in the top/right corner of the Autopsy window. The sign can display a number of incoming unread (not yet clicked) messages during ingest in its upper-right corner.
+There are two places to configure ingest modules. When you select the module name, you may have some "run time" options to configure in the panel to the right. These are generally settings that you may want to change from image to image.
-\image html inbox-button.PNG
+There may also be an "Advanced" button that is enabled in the lower corner. Pressing this button allows you to change global settings that are not specific to a single image. This advanced configuration panel can often be found in the "Tools", "Options" menu too.
-Ingest modules are able to post messages when notable events occur, such as a keyword or hash database hit. If a module posts many similar messages in a short time span, the inbox will group those messages so that unique updates are not lost among the noise.
+As an example, the hash lookup module will allow you to enable or disable hash databases in the "run time" options panel, but requires you to go to the "Advanced" era to add or remove hash databases from the Autopsy configuration.
-The grouped messages are colored with different shades to indicate their importance; if a message group contains a lower number of unique messages, it is potentially more important than another group with a large number of unique messages. The more unique important messages have a lighter background color.
-The ingest messages can be sorted by uniqueness/importance, or by chronological order in which they had appeared.
+\section ingest_results Viewing Ingest Module Results
-A message can be clicked to view the message details. When a message is clicked, it is marked as "read". When updates are posted with regard to a specific result or file, the message is linked to that file and the buttons in the top/right corner of the message details view can be used to browse to that data.
+Ingest modules run in the background. An ingest module can provide you results in a variety of ways, but we recommend specific methods:
+-# If they post results to the Blackboard, then you will find them in the "Results" area of the tree in the main interface.
+-# They can send a message to the Ingest Inbox so that you get a message each time something really important is found.
+\image html inbox-button.PNG
\image html inbox-main-screen.PNG
+-# If the module is a wrapper around another forensics tool, they may simply provide a link to the output of that tool, in which case you will see a new entry in the "Reports" area of the tree.
-\image html inbox-detail-screen.PNG
+All of the official Autopsy modules send results to the blackboard, but if you install third-party apps, then they may choose any approach -- including a pop-up window each time they find something.
-*/
\ No newline at end of file
+*/
diff --git a/docs/doxygen-user/ingest_template.xod b/docs/doxygen-user/ingest_template.xod
new file mode 100755
index 0000000000000000000000000000000000000000..718d5e403deaefd3440e7aead92930102641f415
--- /dev/null
+++ b/docs/doxygen-user/ingest_template.xod
@@ -0,0 +1,28 @@
+/*! \page XYZ_page XYZ Module
+
+What Does It Do
+========
+
+What does it do?
+
+Why would you use it?
+
+
+Configuration
+=======
+
+Is there anything that you need to configure?
+
+
+Using the Module
+======
+
+Ingest Settings
+------
+Are there runtime ingest settings?
+
+Seeing Results
+------
+Where do you see results? In the tree?
+
+*/
diff --git a/docs/doxygen-user/installation.dox b/docs/doxygen-user/installation.dox
old mode 100644
new mode 100755
index 125f0e27bc9573f4014a52a4a85e981d6fe064a3..c675e1df71b86b5e9d0c15874db49181105c7dd6
--- a/docs/doxygen-user/installation.dox
+++ b/docs/doxygen-user/installation.dox
@@ -19,13 +19,15 @@ Optimizing Performance
After installing Autopsy, there are several hardware-based things that we suggest you do to optimize performance:
1) Change the number of parallel pipelines that can be run at a time. The default is 2 pipelines, but this can be increased if you are running on a system with several cores. To do this:
-- Run Autopsy from the start menu or desktop
-- When presented with the case creation screen, cancel/close the menu window
-- Select tools > options
-- On the first tab, there is a drop down for "number of ingest" threads. We recommend that you set this value to be smaller than the number of cores minus two. If you set this number too high, performance can degrade because the pipelines are fighting for the same resources. Testing should be done to find an optimal setting.
+- Run Autopsy from the Start Menu or desktop
+- When presented with the case creation splash screen, cancel/close the window
+- Select "Tools", "Options"
+- On the "Autopsy" tab, there is a drop down for "Number of thread to use for file ingest". We recommend that you set this value to be smaller than the number of cores minus two. If you set this number too high, performance can degrade because the pipelines are fighting for the same resources. Individual testing should be done to find an optimal setting.
- After each change, restart Autopsy to let this setting take effect.
-2) When making a case, use different drives to store the case and the images. The case directory is where the SQLite database and keyword search index is stored. This allows the maximum amount of data to be read and written at the same time.
+\image html threadcount.PNG
+
+2) When making a case, use different drives to store the case and the images. The case directory is where the SQLite database and keyword search index are stored. This allows the maximum amount of data to be read and written at the same time.
3) We have had best performance using either local solid state drives or fibre channel-attached SAN storage.
diff --git a/docs/doxygen-user/interesting_files.dox b/docs/doxygen-user/interesting_files.dox
new file mode 100755
index 0000000000000000000000000000000000000000..ced85020eb0e033ec67224d3285b40b30848101f
--- /dev/null
+++ b/docs/doxygen-user/interesting_files.dox
@@ -0,0 +1,79 @@
+/*! \page interesting_files_identifier_page Interesting Files Identifier Module
+
+What Does It Do
+========
+
+The Interesting Files module allows you to search for files or directories in a data source and generate alerts when they are found. You configure rules for the files that you want to find.
+
+You would use this to be notified when certain things are found. There are examples below that generate alerts when VMWare images are found or when iPhone backup files are found. This module is useful for file types that will frequently have a consistent name and that may not be part of the standard checklist that you look for, or if you simply want to automate your checklist.
+
+Configuration
+=======
+
+Add rules using "Tools", "Options", "Interesting Files".
+
+All rules need to be part of a set. Sets need to have the following defined:
+
+- Set Name (required)
+- Set Description (optional)
+
+Rules specify what to look for in a data source. Each rule specifies:
+- Type: If the rule should be applied to only files, only directories, or both files and directories.
+- Name Pattern: String to match the file name against.
+- Name Pattern Type: Should the pattern be matched against the full file type or just the extension.
+- Path Pattern: A substring of the parent path that must be matched. This allows you to restrict generic names to a specific structure (such as an application name). A substring match is performed.
+- Rule Name: Additional details that are displayed in the UI when that rule is matched. Allows you to determine which rule in the set matched.
+
+\image html interesting_files_configuration.PNG
+
+
+VMWare Example
+--------
+This set of rules is to detect VMWare Player or vmdk files. This would help to make sure you look into the virtual machines for additional evidence.
+
+NOTE: This is not extensive and is simply a minimal example:
+
+
+- Set Name: VMWare
+- Rule 1:
+ - Type: Files
+ - Full Name: vmplayer.exe
+ - Name: Program EXE
+- Rule 2:
+ - Type: Files
+ - Extension: vmdk
+ - Name: VMDK File
+
+iPhone Backups Example
+-------------
+This set of rules is to detect a folder for iPhone Backups. These are typically in a folder such as "%AppData%\Roaming\Apple Computer\MobileSync\Backup" on Windows. Here is a rule that you could use for that.
+
+- Set Name: iPhone Backups
+- Rule 1:
+ - Type: Directory
+ - Name: Backup
+ - Path: Apple Computer/MobileSync
+
+
+Using the Module
+======
+
+When you enable the Interesting Files module, you can choose what rule sets to enable. To add rules, use the "Advanced" button from the ingest module panel.
+
+When files are found, they will be in the Interesting Files area of the tree. You shoudl see the set and rule names with the match.
+
+
+Ingest Settings
+------
+
+When running the ingest modules, the user can choose which interesting file rules to enable .
+<br>
+\image html interesting_files_ingest_settings.PNG
+
+Seeing Results
+------
+The results show up in the tree under "Results", "Interesting Items".
+
+\image html interesting_files_results.PNG
+
+*/
diff --git a/docs/doxygen-user/keyword_search.dox b/docs/doxygen-user/keyword_search.dox
old mode 100644
new mode 100755
index 2e36fc16accafe71f43ab407bae64464423042ad..dbdb6c19dfc92a2aa2c604b7500179210aa3ca18
--- a/docs/doxygen-user/keyword_search.dox
+++ b/docs/doxygen-user/keyword_search.dox
@@ -1,27 +1,18 @@
-/*! \page keyword_search Keyword Search
+/*! \page keyword_search_page Keyword Search Module
-Autopsy ships a keyword search module, which provides the \ref ingest "ingest capability" and also supports a manual text search mode.
+What Does It Do
+========
-The keyword search ingest module extracts text from the files on the image being ingested and adds them to the index that can then be searched.
+The Keyword Search module facilitates both the \ref ingest_page "ingest" portion of searching and also supports manual text searching after ingest has completed. It extracts text from the files being ingested and adds them to a Solr index that can then be searched.
-Autopsy tries its best to extract maximum amount of text from the files being indexed. First, the indexing will try to extract text from supported file formats, such as pure text file format, MS Office Documents, PDF files, Email files, and many others. If the file is not supported by the standard text extractor, Autopsy will fallback to string extraction algorithm. String extraction on unknown file formats or arbitrary binary files can often still extract a good amount of text from the file, often good enough to provide additional clues. However, string extraction will not be able to extract text strings from binary files that have been encrypted.
+Autopsy tries its best to extract the maximum amount of text from the files being indexed. First, the indexing will try to extract text from supported file formats, such as pure text file format, MS Office Documents, PDF files, Email, and many others. If the file is not supported by the standard text extractor, Autopsy will fall back to a string extraction algorithm. String extraction on unknown file formats or arbitrary binary files can often extract a sizeable amount of text from a file, often enough to provide additional clues to reviewers. String extraction will not extract text strings from encrypted files.
-Autopsy ships with some built-in lists that define regular expressions and enable user to search for Phone Numbers, IP addresses, URLs and E-mail addresses. However, enabling some of these very general lists can produce a very large number of hits, many of them can be false-positives.
+Configuration
+=======
-Once files are in the index, they can be searched quickly for specific keywords, regular expressions, or using keyword search lists that can contain a mixture of keywords and regular expressions. Search queries can be executed automatically by the ingest during the ingest run, or at the end of the ingest, depending on the current settings and the time it takes to ingest the image.
-
-Search queries can also be executed manually by the user at any time, as long as there are some files already indexed and ready to be searched.
-
-Keyword search module will save the search results regardless whether the search is performed by the ingest process, or manually by the user. The saved results are available in the Directory Tree in the left hand side panel.
-
-To see keyword search results in real-time while ingest is running, add keyword lists using the \subpage keyword_search_configuration_dialog "Keyword Search Configuration Dialog" and select the "Use during ingest" check box. You can select "Send messages to inbox during ingest" per list, if the hits on that list should be reported in the Inbox, which is recommended for very specific searches.
-
-See (\ref ingest "Ingest") for more information on ingest in general.
-
-Once there are files in the index, the \subpage keyword_search_bar "Keyword Search Bar" will be available for use to manually search at any time.
-
-<!----------------------------------->
+Autopsy ships with some built-in lists that define regular expressions and enable the user to search for Phone Numbers, IP addresses, URLs and E-mail addresses. However, enabling some of these very general lists can produce a very large number of hits, and many of them can be false-positives. Regular expressions involving backtracking can potentially take a long time to complete.
+Once files are placed in the Solr index, they can be searched quickly for specific keywords, regular expressions, or keyword search lists that can contain a mixture of keywords and regular expressions. Search queries can be executed automatically by the ingest during the ingest run, or at the end of the ingest, depending on the current settings and the time it takes to ingest the image.
\section keyword_search_configuration_dialog Keyword Search Configuration Dialog
@@ -35,48 +26,97 @@ To create a list, select the 'New List' button and choose a name for the new Key
<b>List Import and Export</b> \n
Autopsy supports importing Encase tab-delimited lists as well as lists created previously with Autopsy. For Encase lists, folder structure and hierarchy is currently ignored. This will be fixed in a future version. There is currently no way to export lists for use with Encase. This will also be added in future releases.
+<b>Lists tab</b> \n
+\image html keyword-search-configuration-dialog.PNG
+
+<br>
<b>String extraction setting</b> \n
The string extraction setting defines how strings are extracted from files from which text cannot be extracted because their file formats are not supported. This is the case with arbitrary binary files (such as the page file) and chunks of unallocated space that represent deleted files.
When we extract strings from binary files we need to interpet sequences of bytes as text differently, depending on the possible text encoding and script/language used. In many cases we don't know what the specific encoding / language the text is be encoded in in advance. However, it helps if the investigator is looking for a specific language, because by selecting less languages the indexing performance will be improved and a number of false positives will be reduced.
The default setting is to search for English strings only, encoded as either UTF8 or UTF16. This setting has the best performance (shortest ingest time).
The user can also use the String Viewer first and try different script/language settings, and see which setting gives satisfactory results for the type of text relevant to the investigation. Then the same setting that works for the investigation can be applied to the keyword search ingest.
+<br>
+<b> String Extraction tab</b>
+\image html keyword-search-configuration-dialog-string-extraction.PNG
+<br>
+<br>
+<b>General Settings</b> \n
+<br>
<b>NIST NSRL Support</b> \n
The hash database ingest service can be configured to use the NIST NSRL hash database of known files. The keyword search advanced configuration dialog "General" tab contains an option to skip keyword indexing and search on files that have previously marked as "known" and uninteresting files. Selecting this option can greatly reduce size of the index and improve ingest performance. In most cases, user does not need to keyword search for "known" files.
<b>Result update frequency during ingest</b> \n
To control how frequently searches are executed during ingest, user can adjust the timing setting available in the keyword search advanced configuration dialog "General" tab. Setting the number of minutes lower will result in more frequent index updates and searches being executed and the user will be able to see results more in real-time. However, more frequent updates can affect the overall performance, especially on lower-end systems, and can potentially lengthen the overall time needed for the ingest to complete.
-<b>Lists tab</b> \n
-\image html keyword-search-configuration-dialog.PNG
-
-<b> String Extraction tab</b>
-\image html keyword-search-configuration-dialog-string-extraction.PNG
+One can also choose to have no periodic searches. This will speed up the ingest. Users choosing this option can run their keyword searches once the entire keyword search index is complete.
<b>General tab</b>
\image html keyword-search-configuration-dialog-general.PNG
+
-
+
<!----------------------------------------->
+<br>
+Using the Module
+======
+Search queries can be executed manually by the user at any time, as long as there are some files already indexed and ready to be searched. Searching before indexing is complete will naturally only search indexes that are already compiled.
+
+
+See (\ref ingest_page "Ingest") for more information on ingest in general.
+
+Once there are files in the index, the \subpage keyword_search_bar "Keyword Search Bar" will be available for use to manually search at any time.
+
+<!----------------------------------->
+
+Ingest Settings
+------
+The Ingest Settings for the Keyword Search module allow the user to enable or disable the specific built-in search expressions, Phone Numbers, IP Addresses, Email Addresses, and URLs. Using the Advanced button (covered below), one can add custom keyword groups.
+
+\image html keyword-search-ingest-settings.PNG
+
+<br>
\section keyword_search_bar Keyword Search Bar
-The keyword search bar is used to search for keywords in the manual mode (outside of ingest). The existing index will be searched for matching words, phrases, lists, or regular expressions. Results will be opened in a separate Results Viewer for every search executed and they will also be saved in the Directory Tree.
+The keyword search bar is used to search for keywords in the manual mode (outside of ingest). The existing index will be searched for matching words, phrases, lists, or regular expressions.
<b>Individual Keyword Search</b> \n
-Individual keyword or regular expressions can be quickly searched using the search text box widget. To toggle between keyword and regular expression mode, use the down arrow in the search box.
+Individual keyword or regular expressions can be quickly searched using the search text box widget. You can select "Exact Match", "Substring Match" and "Regular Expression" match.
+
+\image html keyword-search-bar.PNG
+<br>
+Results will be opened in a separate Results Viewer for every search executed and they will also be saved in the Directory Tree as shown in the screenshot below.
+<br>
+\image html keyword-search-hits.PNG
+<br>
<b>Keyword List Search</b> \n
Lists created using the Keyword Search Configuration Dialog can be manually searched by the user by pressing on the 'Keyword Lists' button, selecting the check boxes corresponding to the lists to be searched, and pressing the 'Search' button.
+\image html keyword-search-list.PNG
+<br>
+The results of the keyword list search are shown in the tree, as shown below.
+<br>
+\image html keyword-search-list-results.PNG
+<br>
+
<b>Searching during ingest</b> \n
-The manual search for individual keywords or regular expressions can be executed also during the ongoing ingest on the current index using the search text box widget. Note however, that you may miss some results if not entire index has yet been populated. Autopsy enables you to perform the search on an incomplete index in order to retrieve some preliminary results in real-time.
+The manual search for individual keywords or regular expressions can be executed also during the ongoing ingest on the current index using the search text box widget. Note however, that you may miss some results if the entire index has not yet been populated. Autopsy enables you to perform the search on an incomplete index in order to retrieve some preliminary results in real-time.
+The manual search for individual keywords or regular expressions can be executed also during the ongoing ingest on the current index using the search text box widget. Note however, that you may miss some results if the entire index has not yet been populated. Autopsy enables you to perform the search on an incomplete index in order to retrieve some preliminary results in real-time.
During the ingest, the manual search by keyword list is deactivated. A newly selected list can instead be added to the ongoing ingest, and it will be searched in the background instead.
Keywords and lists can be managed during ingest.
-\image html keyword-search-bar.PNG
+
+Seeing Results
+------
+
+The Keyword Search module will save the search results regardless whether the search is performed by the ingest process, or manually by the user. The saved results are available in the Directory Tree in the left hand side panel.
+
+To see keyword search results in real-time while ingest is running, add keyword lists using the \subpage keyword_search_configuration_dialog "Keyword Search Configuration Dialog" and select the "Use during ingest" check box. You can select "Send messages to inbox during ingest" per list, if the hits on that list should be reported in the Inbox, which is recommended for very specific searches.
+
-*/
\ No newline at end of file
+*/
diff --git a/docs/doxygen-user/main.dox b/docs/doxygen-user/main.dox
old mode 100644
new mode 100755
index ca5fb8224ed186c8b3da91c0549fdebfa3b6d265..ce65ba0b704ca673dca7092723bcd07ef06f6ec8
--- a/docs/doxygen-user/main.dox
+++ b/docs/doxygen-user/main.dox
@@ -18,19 +18,33 @@ The following topics are available here:
- Cases and Adding Data Sources
- \subpage cases_page
- \subpage ds_page
-- Automated Analysis
- - \subpage ingest "Ingest"
- - \subpage hash_db_page
- - \subpage keyword_search "Keyword Search"
+ - \subpage uilayout_page
+- Automated Analysis (Modules)
+<!-- Try to put in order they are shown in Ingest panel -->
+ - \subpage ingest_page "Ingest Modules"
+ - \subpage recent_activity_page
+ - \subpage hash_db_page
+ - \subpage file_type_identification_page
+ - \subpage archive_extractor_page
+ - \subpage EXIF_parser_page
+ - \subpage keyword_search_page
+ - \subpage email_parser_page
+ - \subpage extension_mismatch_detector_page
+ - \subpage e01_verifier_page
+ - \subpage android_analyzer_page
+ - \subpage interesting_files_identifier_page
+ - \subpage photorec_carver_page
- Manual Analysis
- - \subpage directory_tree "Directory Tree"
- - \subpage file_search "File Search"
- - \subpage result_viewers "Result Viewers"
- - \subpage content_viewers "Content Viewers"
- - \subpage image_viewer
- - \subpage timeline
+ - \subpage tree_viewer_page
+ - \subpage result_viewer_page
+ - \subpage content_viewer_page
+<!-- - \subpage image_viewer_page Not released yet-->
+ - \subpage file_search_page
+ - \subpage timeline_page
- \subpage stix_page
- Reporting
+ - \subpage tagging_page
+- \subpage module_install_page
If the topic you need is not listed, refer to the Help system in the tool or the wiki (http://wiki.sleuthkit.org/index.php?title=Autopsy_User%27s_Guide).
diff --git a/docs/doxygen-user/module_install.dox b/docs/doxygen-user/module_install.dox
new file mode 100755
index 0000000000000000000000000000000000000000..ad8337e6605eea3866e90b846b40ccb57dcea7e4
--- /dev/null
+++ b/docs/doxygen-user/module_install.dox
@@ -0,0 +1,17 @@
+/*! \page module_install_page Installing 3rd-Party Modules
+
+There are various places in Autopsy that developers can write custom plug-in modules. This page covers how to install them.
+
+There are two types of modules:
+- Modules written in Java that are shipped in NBM (NetBeans Module) files.
+- Modules written in Python that are shipped as a folder in a ZIP file.
+
+\section module_install_nbm Installing NetBeans Module
+If you have an NBM file, then it may contain one or more Autopsy modules. To install it, use the plugin manager at "Tools", "Plugins".
+
+Choose the "Downloaded" tab and then choose "Add Plugins". Browse to the NBM file. It may require you to restart Autopsy.
+
+\section module_install_python Installing Python Module
+If you have a ZIP file with a Python module in it, then unzip the file and you should get a folder. Open the Python module library folder using "Tools", "Python Plugins". Copy the module folder into there and Autopsy should identify and use it next time it loads modules.
+
+*/
diff --git a/docs/doxygen-user/photorec_carver.dox b/docs/doxygen-user/photorec_carver.dox
new file mode 100755
index 0000000000000000000000000000000000000000..564468a14e5386c1d47f9b2dc8c6c32c626b5203
--- /dev/null
+++ b/docs/doxygen-user/photorec_carver.dox
@@ -0,0 +1,32 @@
+/*! \page photorec_carver_page PhotoRec Carver Module
+
+What Does It Do
+========
+
+The PhotoRec Carver module carves files from unallocated space in the data source and sends the files found through the ingest processing chain.
+
+This can help a reviewer discover more information about files that used to be on the device and were subsequently deleted. These are simply extra files that were found in "empty" portions of the device storage.
+
+
+Configuration
+=======
+
+There is nothing to configure for this module.
+
+
+Using the Module
+======
+Select the checkbox in the Ingest Modules settings screen to enable the PhotoRec Carver. Ensure that "Process Unallocated Space" is selected.
+
+Ingest Settings
+------
+There are no run-time settings for this module, but the global seeting to "Process Unallocated Space" is needs to be selected to make this work.
+
+Seeing Results
+------
+The results of carving show up on the tree under data source with the heading "Unallocated".
+
+\image html photorec_output.PNG
+
+Applicable types also show up in the "Views", "File Types" portion of the the tree, depending upon the file type.
+*/
diff --git a/docs/doxygen-user/quick_start_guide.dox b/docs/doxygen-user/quick_start_guide.dox
old mode 100644
new mode 100755
index 66c6e7114d5715d4cb56e0d4a0df18c7c688cba1..5d7a8c5a27a1ea3e0c7c235d12f7e722c560ba1c
--- a/docs/doxygen-user/quick_start_guide.dox
+++ b/docs/doxygen-user/quick_start_guide.dox
@@ -22,19 +22,24 @@ Autopsy will start to analyze these data sources and add them to the case and in
\subsection s4 Ingest Modules
-You will next be prompted to configure the Ingest Modules. Ingest modules will run in the background and perform specific tasks. The Ingest Modules analyze files in a prioritized order so that files in a user's directory are analyzed before files in other folders. Ingest modules can be developed by third-parties and here are some of the standard ingest modules that come with Autopsy:
-
-- <strong>Recent Activity</strong> extracts user activity as saved by web browsers and the OS. Also runs regripper on the registry hive.
-- <strong>Hash Lookup</strong> uses hash databases to ignore known files from the NIST NSRL and flag known bad files. Use the "Advanced" button to add and configure the hash databases to use during this process. You will get updates on known bad file hits as the ingest occurs. You can later add hash databases via the Tools -> Options menu in the main UI. You can download an index of the NIST NSRL from http://sourceforge.net/projects/autopsy/files/NSRL/
-- <strong>Keyword Search</strong> uses keyword lists to identify files with specific words in them. You can select the keyword lists to search for automatically and you can create new lists using the "Advanced" button. Note that with keyword search, you can always conduct searches after ingest has finished. The keyword lists that you select during ingest will be searched for at periodic intervals and you will get the results in real-time. You do not need to wait for all files to be indexed.
-- <strong>Archive Extractor</strong> opens ZIP, RAR, and other archive formats and sends the files from those archive files back through the pipelines for analysis.
-- <strong>Exif Image Parser</strong> extracts EXIF information from JPEG files and posts the results into the tree in the main UI.
-- <strong>Thunderbird Parser</strong> Identifies Thunderbird MBOX files and extracts the e-mails from them.
-
+You will next be prompted to configure the Ingest Modules. Ingest modules will run in the background and perform specific tasks. The Ingest Modules analyze files in a prioritized order so that files in a user's directory are analyzed before files in other folders. Ingest modules can be developed by third-parties. The standard ingest modules included with Autopsy are:
+
+- <strong>\subpage recent_activity_page</strong> extracts user activity as saved by web browsers and the OS. Also runs Regripper on the registry hive.
+- <strong>\subpage hash_db_page</strong> uses hash databases to ignore known files from the NIST NSRL and flag known bad files. Use the "Advanced" button to add and configure the hash databases to use during this process. You will get updates on known bad file hits as the ingest occurs. You can later add hash databases via the Tools -> Options menu in the main UI. You can download an index of the NIST NSRL from http://sourceforge.net/projects/autopsy/files/NSRL/
+- <strong>\subpage file_type_identification_page</strong> determines file types based on signatures and reports them based on MIME type. It stores the results in the Blackboard. Uses Tike open source library. Many modules depend on this. You can define your own custom file types in Tools, Options, File Types.
+- <strong>\subpage archive_extractor_page</strong> opens ZIP, RAR, and other archive formats and sends the files from those archive files back through the pipelines for analysis.
+- <strong>\subpage EXIF_parser_page</strong> extracts EXIF information from JPEG files and posts the results into the tree in the main UI.
+- <strong>\subpage keyword_search_page</strong> uses keyword lists to identify files with specific words in them. You can select the keyword lists to search for automatically and you can create new lists using the "Advanced" button. Note that with keyword search, you can always conduct searches after ingest has finished. The keyword lists that you select during ingest will be searched for at periodic intervals and you will get the results in real-time. You do not need to wait for all files to be indexed.
+- <strong>\subpage email_parser_page</strong> identifies Thunderbird MBOX files and PST format files based on file signatures, extracting the e-mails from them, adding the results to the Blackboard.
+- <strong>\subpage extension_mismatch_detector_page</strong> uses the results from the File Type Identification and flags files that have an extension not traditionally associated with the file's detected type. Ignores 'known' (NSRL) files. You can customize the MIME types and file extensions per MIME type in Tools, Options, File Extension Mismatch.
+- <strong>\subpage e01_verifier_page</strong> computes a checksum on E01 files and compares with the E01 file's internal checksum to ensure they match.
+- <strong>\subpage android_analyzer_page</strong> allows you to parse common items from Android devices. Places artifacts into the BlackBoard.
+- <strong>\subpage interesting_files_identifier_page</strong> searches for files and directories based on user-specified rules in Tools, Options, Interesting Files. Works as a "File Alerting Module". Generates messages in the inbox when specified files are found.
+- <strong>\subpage photorec_carver_page</strong> carves files from unallocated space and sends them through the file processing chain.
When you select a module, you will have the option to change its settings. For example, you can configure which keyword search lists to use during ingest and which hash databases to use. Refer to the help system inside of Autopsy for details on configuring each module.
-While ingest modules are running in the background, you will see a progress bar in the lower right. You can use the GUI to review incoming results and perform other tasks while ingest at that time.
+While ingest modules are running in the background, you will see a progress bar in the lower right. You can use the GUI to review incoming results and perform other tasks while ingesting at the same time.
\section s1a Analysis Basics
@@ -71,7 +76,7 @@ You may learn that a known bad file was found or that a file was found with a re
When you select a message, you can then jump to the Results tree where more details can be found or jump to the file's location in the filesystem.
-\subsection s2b Timeline (beta)
+\subsection s2b Timeline
There is a basic timeline view that you can access via the Tools -> Make Timeline feature. This will take a few minutes to create the timeline for analysis. Its features are still in development.
diff --git a/docs/doxygen-user/recent_activity.dox b/docs/doxygen-user/recent_activity.dox
new file mode 100755
index 0000000000000000000000000000000000000000..41efe651c0fc671ee7941e8c95795c3fc999857b
--- /dev/null
+++ b/docs/doxygen-user/recent_activity.dox
@@ -0,0 +1,29 @@
+/*! \page recent_activity_page Recent Activity Module
+
+What Does It Do
+========
+
+The Recent Activity module extracts user activity as saved by web browsers (including web searches), installed programs, and the operating system. It also runs Regripper on the Registry hive.
+
+This allows you to see what activity has occured in the last seven days of usage, what web sites were vistied, what the machine did, and what it connected to.
+
+Configuration
+=======
+
+There is nothing to configure for this module.
+
+
+Using the Module
+======
+
+Ingest Settings
+------
+There are no run-time settings for this module.
+
+Seeing Results
+------
+Results show up in the tree under "Extracted Content".
+
+\image html extracted_content.png
+
+*/
diff --git a/docs/doxygen-user/reporting.dox b/docs/doxygen-user/reporting.dox
new file mode 100755
index 0000000000000000000000000000000000000000..cce28e550ed7847fa44a6f992cb9bb506f22c198
--- /dev/null
+++ b/docs/doxygen-user/reporting.dox
@@ -0,0 +1,42 @@
+/*! \page reporting_page Reporting
+
+Reporting
+
+To create a report, go to "Tools", "Generate Report". You can choose several different types of reports. We will go through the HTML report here.
+\image html generate-report-1.PNG
+<br>
+
+When you have selected a report type, choose between
+- All Results
+- Tagged Results
+
+<br>
+\image html generate-report-2.PNG
+<br>
+
+If you select All Results, you can choose the Data Types (Artifact Types) you would like included.
+<br>
+\image html generate-report-3.PNG
+<br>
+
+If you selecte Tagged Results, you can choose the tags you would like included.
+<br>
+\image html generate-report-4.PNG
+<br>
+<br>
+In our case, an HTML report is generated.
+<br>
+<br>
+<b>All Results HTML Report:</b>
+<br>
+\image html generate-report-5.PNG
+<br>
+<br>
+<b>Tagged Results HTML Report:</b>
+<br>
+\image html generate-report-6.PNG
+<br>
+There are other types of reports to choose, but they operate on the same principle. Select either All Results or Tagged results to include.
+<br>
+
+*/
diff --git a/docs/doxygen-user/result_viewer.dox b/docs/doxygen-user/result_viewer.dox
new file mode 100755
index 0000000000000000000000000000000000000000..190f2d7e5f555022400fa3fb9d0326c488dc238e
--- /dev/null
+++ b/docs/doxygen-user/result_viewer.dox
@@ -0,0 +1,20 @@
+/*! \page result_viewer_page Result Viewer
+
+The Result Viewer is located on the top right of the Autopsy screen. It shows lists of files and their corresponding attributes such as time, path, size, checksum, etc.
+
+<br>
+\image html result-viewer-example-1.PNG
+<br>
+
+You can also switch it to Thumbnail view to see thumbnails of the content in the selected folder.
+
+<br>
+\image html result-viewer-example-2.PNG
+<br>
+
+The Result Viewer is context-aware, meaning it will show applicable columns for the data type in selected.
+<br>
+\image html result-viewer-example-3.PNG
+<br>
+
+*/
diff --git a/docs/doxygen-user/result_viewers.dox b/docs/doxygen-user/result_viewers.dox
old mode 100644
new mode 100755
index 8862be5ae20647da048d3c4838bfd8cef40373dd..190f2d7e5f555022400fa3fb9d0326c488dc238e
--- a/docs/doxygen-user/result_viewers.dox
+++ b/docs/doxygen-user/result_viewers.dox
@@ -1,38 +1,20 @@
-/*! \page result_viewers Result Viewers
-\section about_result_viewers About Result Viewers
-The Result Viewer windows are in the upper right area of the interface and display the results from selecting something in the Data Explorer Tree area. You will have the option to display the results in a variety of formats.
-Currently, there are 2 main tabs in the Result Viewer window:
-\li \ref table_result_viewer
-\li \ref thumbnail_result_viewer
+/*! \page result_viewer_page Result Viewer
-\section right_click_functions Right Click Functions
-Viewers in Result Viewers have certain right-click functions built-in into them that can be accessed when a node a certain type is selected (a file, directory or a result).
-Here are some examples that you may see:
-\li Open File in External Viewer: Opens the selected file in an "external" application as defined by the local OS. For example, HTML files may be opened by IE or Firefox, depending on what the local system is configured to use.
-\li View in New Window: Opens the content in a new internal Content Viewer (instead of in the default location in the lower right).
-\li Extract: Make a local copy of the file or directory for further analysis.
-\li Search for files with the same MD5 Hash: Searches the entire file-system for any files with the same MD5 Hash as the one selected.
+The Result Viewer is located on the top right of the Autopsy screen. It shows lists of files and their corresponding attributes such as time, path, size, checksum, etc.
-<b>Example</b>\n
-Below is an example of a "Result Viewer" window:
-\image html result-viewer-window-example.PNG
+<br>
+\image html result-viewer-example-1.PNG
+<br>
-\section table_result_viewer Table Result Viewers
-
-Thumbnail Results Viewer
-Thumbnail Results Viewer displays the data catalog as a table of thumbnail images in adjustable sizes. This viewer only supports picture file(s) (Currently, only supports JPG, GIF, and PNG formats). Click the Thumbnail tab to select this view. Note that for a large number of images in a directory selected in the Data Explorer, or for a View selected that contains a large number of images, it might take a while to populate this view for the first time before the images are cached.
+You can also switch it to Thumbnail view to see thumbnails of the content in the selected folder.
-<b>Example</b>\n
-Below is an example of "Thumbnail Results Viewer" window:
-\image html table-result-viewer-tab.PNG
+<br>
+\image html result-viewer-example-2.PNG
+<br>
-\section thumbnail_result_viewer Thumbnail Result Viewers
-Table Results Viewer (Directory Listing) displays the data catalog as a table with some details (properties) of each file. The properties that it shows are: name, time (modified, changed, accessed, and created), size, flags (directory and meta), mode, user ID, group ID, metadata address, attribute address, and type (directory and meta). Click the Table Viewer tab to select this view.
-
-The Results Viewer can be also activated for saved results and it can show a high level results grouped, or a results at a file level, depending on which node on the Directory Tree is selected to populate the Table Results Viewer.
-
-<b>Example</b>\n
-Below is an example of a "Table Results Viewer" window:
-\image html thumbnail-result-viewer-tab.PNG
+The Result Viewer is context-aware, meaning it will show applicable columns for the data type in selected.
+<br>
+\image html result-viewer-example-3.PNG
+<br>
*/
diff --git a/docs/doxygen-user/stix.dox b/docs/doxygen-user/stix.dox
old mode 100644
new mode 100755
diff --git a/docs/doxygen-user/tagging.dox b/docs/doxygen-user/tagging.dox
new file mode 100755
index 0000000000000000000000000000000000000000..ce238f7a116a7b21fa2ead4f8080c6eadfa6205f
--- /dev/null
+++ b/docs/doxygen-user/tagging.dox
@@ -0,0 +1,33 @@
+/*! \page tagging_page Tagging
+
+Tagging (or Bookmarking) allows you to make a reference to a file or object and easily find it later.
+
+When an interesting item is discovered, the user can tag it by right clicking the item and selecting one of the tag options.
+
+When you tag a Blackboard artifact result, you have the choice to either:
+- Tag File -- use this when the file itself is of interest
+- Tag Result -- use this when the result is of interest
+
+Which to choose depends upon the context and what you desire in the final report.
+
+\image html tagging-1.PNG
+
+Once you have choosen to tag the file or the result, there are two more options:
+- Quick Tag -- use this if you just want the tag
+- Tag and Comment -- use this if you need to add a comment about this tag
+
+\image html tagging-2.PNG
+<br>
+You can create arbitrary tag names. Autopsy remembers your tag names from previous cases, so choose wisely. Choose a tag from the list you have created, or create a "New Tag".
+
+\image html tagging-3.PNG
+
+You can apply tags to groups of items at once. Select multiple items in the Blackboard, right click, and add the appropriate tag.
+Items may have more than one tag.
+
+Tagged results are shown in the "Results" portion of the tree under "Tags".
+
+<br>
+\image html tagging-4.PNG
+<br>
+*/
diff --git a/docs/doxygen-user/timeline.dox b/docs/doxygen-user/timeline.dox
old mode 100644
new mode 100755
index 655bfdc0f109282cc5f253e5dbab203156e0e53c..cd65b1d7d5390969e4bf47c5cbe0a8e9fb1d5ae6
--- a/docs/doxygen-user/timeline.dox
+++ b/docs/doxygen-user/timeline.dox
@@ -1,4 +1,4 @@
-/*! \page timeline Timeline
+/*! \page timeline_page Timeline
Overview
========
This document outlines the use of the new Timeline feature of Autopsy. This feature was funded by DHS S&T to help provide free and open source digital forensics tools to law enforcement.
@@ -7,7 +7,7 @@ This document assumes basic familiarity with Autopsy.
Quick Start
===========
-# Create a case as normal and add a disk image (or folder of files) as a data source. To get the most out of the timeline, ensure that you have the hash lookup module enabled with NSRL (to ignore known files) and have the EXIF and recent activity modules enabled to collect additional temporal data.
--# After the image has been added, click Tools-> Timeline in the menu. This will open the Timeline tool in a new window. You can do this while ingest is running, but you will not have access to the temporal data that will be found after you create the timeline, unless you re-open the timeline tool.
+-# After the image has been added, click "Tools", "Timeline" in the menu. This will open the Timeline tool in a new window. You can do this while ingest is running, but you will not have access to the temporal data that will be found after you create the timeline, unless you re-open the timeline tool.
diff --git a/docs/doxygen-user/tree_viewer.dox b/docs/doxygen-user/tree_viewer.dox
new file mode 100755
index 0000000000000000000000000000000000000000..6a40c02d8d4056759538f74018b751373fefacb0
--- /dev/null
+++ b/docs/doxygen-user/tree_viewer.dox
@@ -0,0 +1,10 @@
+/*! \page tree_viewer_page Tree Viewer
+
+The Tree Viewer shows the discovered folders by the data sources they come from, as well as a list of files in the folders. It is located on the left side of the Autopsy screen.
+
+Each folder in the tree on the left shows how many items are contained within it in parenthesis after the directory name. See the picture below.
+
+<br>
+\image html directory-tree.PNG
+<br>
+*/
diff --git a/docs/doxygen-user/uilayout.dox b/docs/doxygen-user/uilayout.dox
new file mode 100755
index 0000000000000000000000000000000000000000..b3550ffd27f871bd7d167ec4d91b9e63fe8f4de7
--- /dev/null
+++ b/docs/doxygen-user/uilayout.dox
@@ -0,0 +1,168 @@
+/*! \page uilayout_page UI Layout
+
+
+<br>
+\section ui_overview Overview
+
+The major areas in the Autopsy User Interface (UI) are:
+- \ref ui_tree, shown outlined in green below
+- \ref ui_results, shown outlined in blue below
+- \ref ui_content, shown outlined in red below
+- \ref ui_keyword, shown outlined in yellow below
+- \ref ui_status, shown in solid purple below
+
+\image html ui-layout-1.PNG
+
+<br>
+<br>
+<br>
+\section ui_tree Tree Viewer
+\subpage tree_viewer_page "More..."
+<br>
+
+
+The tree on the left-hand side is find saved results from automated procedures (ingest). The tree has four main areas:
+- <b>Data Sources:</b> This shows the directory tree hierarchy of the file systems in the images. You can navigate to a specific file or directory here. Each data source added is represented as a drive. If you add a data source multiple times, it shows up multiple times.
+- <b>Views:</b> Specific types of files from the data sources are shown here, aggregated by type or other properties. Files here can come from more than one data source. Look here for files of a specific type or property.
+- <b>Results:</b> Where you can see the results from the background ingest tasks and you can see your previous search results. Go here to see what was found by the ingest modules and to find your previous search results.
+- <b>Reports:</b> References to reports that you have generated or ingest modules created show up here
+
+
+\subsection ui_tree_ds Data Sources
+
+The Data Sources section shows each data source that has been added to the case, in order added (top one is first).
+Right clicking on the various nodes in the Data Sources section of the tree will allow you to get more options for each data source and its contents.
+
+Unallocated space are chunks of the file system that is currently not being used for anything. Unallocated space can store deleted files and other interesting artifacts. On the actual image, Unallocated space is stored in blocks with distinct locations on the system. However, because of the way various carving tools work, it is more ideal to feed them a single, large unallocated file. Autopsy provides access to both methods of looking at unallocated space.
+\li <b>Individual blocks in a volume</b> There is a folder named "Unalloc". This folder contains all the individual unallocated blocks as the image is storing them. You can right click and extract them the same way you can extract any other type of file in the Directory Tree.
+\li <b>Single files</b> Right click on a volume and select "Extract Unallocated Space as Single File" to concatenate all the unallocated files in the volume into a single, continuous file. (If desired, you can right click on an image, and select "Extract Unallocated Space to Single Files" which will do the same thing, but once for each volume in the image).
+
+An example of the single file extraction option is shown below.
+\image html extracting-unallocated-space.PNG
+
+\subsection ui_tree_views Views
+
+Views filter all the files in the case by some external property of the file, not by any internal analysis of the file.
+- <b>File Type</b> Sorts files by file extension, and shows them in the appropriate group. For example, .mp3 and .wav both end up in the "Audio" group.
+- <b>Recent Files</b> Displays files that are accessed within the last seven days the user had the device.
+- <b>Deleted Files</b> Displays files that have been deleted but the names have been recovered.
+- <b>File Size</b> Sorts files based upon size. This can give you an idea where to look for files you are interested in.
+
+
+\subsection ui_tree_results Results
+- <b>Extracted Content:</b> Many ingest modules will place results here; EXIF data, GPS locations, or Web History for example
+- <b>Keyword Hits:</b> Keyword search hits show up here
+- <b>Hashset Hits:</b> Hashset hits show up here
+- <b>E-Mail Messages:</b> Email messages show up here
+- <b>Interesting Items:</b> Things deemed interesting show up here
+- <b>Tags:</b> Any item you tag shows up here so you can find it again easily
+
+\subsection ui_tree_reports Reports
+
+Reports can be added by \subpage ingest_page or created using the \subpage reporting_page tool.
+
+<br>
+<br>
+<br>
+\section ui_results Result Viewer
+\subpage result_viewer_page "More..."
+<br>
+
+The Result Viewer windows are in the upper right area of the interface and display the results from selecting something in the tree. You will have the option to display the results in a variety of formats.
+
+\subsection right_click_functions Right Click Functions
+Viewers in Result Viewers have certain right-click functions built-in into them that can be accessed when a node a certain type is selected (a file, directory or a result).
+Here are some examples that you may see:
+\li Open File in External Viewer: Opens the selected file in an "external" application as defined by the local OS. For example, HTML files may be opened by IE or Firefox, depending on what the local system is configured to use.
+\li View in New Window: Opens the content in a new internal Content Viewer (instead of in the default location in the lower right).
+\li Extract: Make a local copy of the file or directory for further analysis.
+\li Search for files with the same MD5 Hash: Searches the entire file-system for any files with the same MD5 Hash as the one selected.
+
+
+\subsection table_result_viewer Table Result Viewers
+
+Thumbnail Results Viewer
+Thumbnail Results Viewer displays the data catalog as a table of thumbnail images in adjustable sizes. This viewer only supports picture file(s) (Currently, only supports JPG, GIF, and PNG formats). Click the Thumbnail tab to select this view. Note that for a large number of images in a directory selected in the Data Explorer, or for a View selected that contains a large number of images, it might take a while to populate this view for the first time before the images are cached.
+
+<b>Example</b>\n
+Below is an example of "Table Results Viewer" window:
+\image html table-result-viewer-tab.PNG
+
+
+\subsection thumbnail_result_viewer Thumbnail Result Viewers
+Table Results Viewer (Directory Listing) displays the data catalog as a table with some details (properties) of each file. The properties that it shows are: name, time (modified, changed, accessed, and created), size, flags (directory and meta), mode, user ID, group ID, metadata address, attribute address, and type (directory and meta). Click the Table Viewer tab to select this view.
+
+The Results Viewer can be also activated for saved results and it can show a high level results grouped, or a results at a file level, depending on which node on the Directory Tree is selected to populate the Table Results Viewer.
+
+<b>Example</b>\n
+Below is an example of a "Table Results Viewer" window:
+\image html thumbnail-result-viewer-tab.PNG
+
+<br>
+<br>
+<br>
+\section ui_content Content Viewer
+\subpage content_viewer_page "More..."
+<br>
+
+The Content Viewer area is in the lower right area of the interface. This area is used to view a specific file in a variety of formats. There are different tabs for different viewers. Not all tabs support all file types, so only some of them will be enabled. To display data in this area, a file must be selected from the Result Viewer window.
+
+The Content Viewer area is part of a plug-in framework. You can install modules that will add more viewer types. This section describes the viewers that come by default with Autopsy.
+
+\subsection result_content_viewers Result Content Viewer
+Content Viewer shows the artifacts (saved results) associated with the item selected in the Result Viewer.
+<b>Example</b>
+Below is an example of "Result Content Viewer" window:
+\image html result-viewer-example-1.PNG
+
+\subsection hex_content_viewer Hex Content Viewer
+Hex Content Viewer shows you the raw and exact contents of a file. In this Hex Content Viewer, the data of the file is represented as hexadecimal values grouped in 2 groups of 8 bytes, followed by one group of 16 ASCII characters which are derived from each pair of hex values (each byte). Non-printable ASCII characters and characters that would take more than one character space are typically represented by a dot (".") in the following ASCII field.
+
+<b>Example</b> \n
+Below is an example of "Hex Content Viewer" window:
+\image html hex-content-viewer-tab.PNG
+
+\subsection media_content_viewer Media Content Viewer
+
+The Media Content Viewer will show a picture or video file. Video files can be played and paused. The size of the picture or video will be reduced to fit into the screen. If you want more complex analysis of the media, then you must export the file.
+
+If you select an non-picture file or an unsupported picture format on the "Result Viewers", this tab will be disabled.
+
+<b>Example</b> \n
+Here's one of the example of the "Media Content Viewer":
+\image html picture-content-viewer-tab.PNG
+
+\subsection string_content_viewer String Content Viewer
+
+Strings Content Viewer scans (potentially binary) data of the file / folder and searches it for data that could be text. When appropriate data is found, the String Content Viewer shows data strings extracted from binary, decoded, and interpreted as UTF8/16 for the selected script/language.
+
+Note that this is different from the Text Content Viewer, which displays the text for a file that is stored in the keyword search index. The results may be the same or they could be different, depending how the data were interpreted by the indexer.
+
+<b>Example</b> \n
+Below is an example of "String Content Viewer" window:
+\image html string-content-viewer-tab.PNG
+
+\subsection text_content_viewer Text Content Viewer
+
+Text Content Viewer uses the keyword search index that may have been populated during Image Ingest. If a file has text stored in the index, then this tab will be enabled and it will be displayed to the user if a file or a result associated with a file is selected.
+
+This tab may have more text on it than the "String View", which relies on searching the file for text-looking data. Some files, like PDF, will not have text-looking data at the byte-level, but the keyword indexing process knows how to interpret a PDF file and produce text. For the files the indexer knows about, there may be the METADATA section at the end of the displayed extracted text. If an indexed document contains any metadata (such as creation date, author, etc), it will be displayed there. Note that, unlike the "String View", the Text View does not have its built-in settings for the script/language to use for extracted strings. This is because the script/language is used at indexing time, and that setting is associated with the Keyword Search indexer, not the viewer.
+
+If this tab is not enabled, then either the file has no text or you did not enable Keyword Search as an ingest module. Note that this viewer is also used to display highlighted keyword hits when operated in the "Search Matches" mode, selected on the right-hand side of the viewer's toolbar.
+
+\image html text-view.PNG
+
+
+<br>
+<br>
+<br>
+\section ui_keyword Keyword Search
+Keyword Search allows the user to search for keywords in the data source. It is covered in more detail here: \subpage keyword_search_page
+<br>
+<br>
+<br>
+\section ui_status Status Area
+The Status area will show progress bars while ingest is occuring. This visually indicates to the user what portion of the processing is already complete. The user can click on the progress bars to see further detail or to cancel ingest jobs.
+<br>
+
+*/
diff --git a/docs/doxygen-user/workflow.dox b/docs/doxygen-user/workflow.dox
old mode 100644
new mode 100755
index 792069bc8df783b9dc9cf926f9121ce6b979f234..d4d439e4559b533c29137823b580732cfff23b6b
--- a/docs/doxygen-user/workflow.dox
+++ b/docs/doxygen-user/workflow.dox
@@ -1,10 +1,10 @@
/*! \page workflow_page Autopsy Workflow
Analyzing data in Autopsy uses the following workflow:
--# A case is created (see \ref cases_page)
--# One or more data sources are added (see \ref ds_page)
--# Ingest modules automatically analyze the data sources to extract information
--# Manual analysis is performed to identify the evidence.
--# Reports are generated.
+-# <b>Create a Case</b>: A case is a container for one or more data sources. One must be created before data is analyzed. See \ref cases_page for more details.
+-# <b>Adding a Data Source</b>: One or more data sources are added to the case. Data sources include disk images and local files. See \ref ds_page for more details.
+-# <b>Analyze with Ingest Modules</b>: After the data source is added, ingest modules operate in the background to analyze the data. Results are posted to the interface in real time and provide alerts as necessary. Example ingest modules include \ref hash_db_page "hash calculation and lookup", \ref keyword_search_page "keyword searching", and \ref recent_activity_page "web artifact extraction". 3rd-party modules can be developed and added to the pipelines. See \ref ingest_page.
+-# <b>Manual Analysis</b>: User navigates interface, file contents, and ingest module results to identify the evidence. Interesting items can be tagged for later reporting and analysis.
+-# <b>Report Generation</b>: User generates final report based on selected tags or all results.
*/
diff --git a/docs/doxygen/Doxyfile b/docs/doxygen/Doxyfile
old mode 100644
new mode 100755
diff --git a/docs/doxygen/debugTsk.dox b/docs/doxygen/debugTsk.dox
new file mode 100755
index 0000000000000000000000000000000000000000..2863bc1e9fe39983c44c817332e7904195fc9a4d
--- /dev/null
+++ b/docs/doxygen/debugTsk.dox
@@ -0,0 +1,12 @@
+/*! \page mod_debugTsk_page Debugging The Sleuth Kit
+
+If you find that you need to debug some of the C/C++ code from The Sleuth Kit (TSK), then here are the steps to follow:
+
+-# Ensure that you have the Debug version of the TSK JNI dll built (both 32-bit and 64-bit to be safe). This assumes you built TSK from source and are not simply using the developer platform. You may have to build the libtsk_jni twice because sommetimes it complains about not being able to find a .map file.
+-# Run the 'dist-debug' target for the TSK DataModel project. This copies the debug versions of the dll into the JAR file. If you run the 'dist' target, then you will get Release versions of the dll and you won't have the needed symbols for debugging.
+-# Build the Autopsy suite so that it copies the new JAR file with the debug dlls.
+-# Set your breakpoints in the TSK source.
+-# Run Autopsy in the debugger.
+-# In VC++, do Debug->Attach to process... If you don't see this menu item, set Tools->Settings->Expert Settings. There is also a Tools->Attach to process..(Ctrl+Alt+P). Attach to nbexex64,exe (netbeasn64.exe is the IDE).
+
+*/
diff --git a/docs/doxygen/footer.html b/docs/doxygen/footer.html
old mode 100644
new mode 100755
index f62135d90b590c1c4d9e5ff1cf0c94e5f3548c84..983a55f4873833678c28ed3b14d8780d55f37269
--- a/docs/doxygen/footer.html
+++ b/docs/doxygen/footer.html
@@ -1,5 +1,5 @@
<hr/>
-<p><i>Copyright © 2012-2014 Basis Technology <br/>
+<p><i>Copyright © 2012-2014 Basis Technology. Generated on: $date<br/>
This work is licensed under a
<a rel="license" href="http://creativecommons.org/licenses/by-sa/3.0/us/">Creative Commons Attribution-Share Alike 3.0 United States License</a>.
</i></p>
diff --git a/docs/doxygen/main.dox b/docs/doxygen/main.dox
old mode 100644
new mode 100755
index 7e567d0bb4337d5f3560f17cfff27f03526b17cf..154ad8583cd6bd16a13dd584d515eb7fa160b8c0
--- a/docs/doxygen/main.dox
+++ b/docs/doxygen/main.dox
@@ -24,6 +24,7 @@ These pages are more detailed if you want to modify Autopsy code instead of writ
- \subpage workflow_page
- \subpage regression_test_page
- \subpage native_page
+- \subpage mod_debugTsk_page
<!-- Note that Case still has lots of content in package.dox -->
*/
diff --git a/docs/doxygen/modAdvanced.dox b/docs/doxygen/modAdvanced.dox
old mode 100644
new mode 100755
diff --git a/docs/doxygen/modContent.dox b/docs/doxygen/modContent.dox
old mode 100644
new mode 100755
diff --git a/docs/doxygen/modDev.dox b/docs/doxygen/modDev.dox
old mode 100644
new mode 100755
diff --git a/docs/doxygen/modDevPython.dox b/docs/doxygen/modDevPython.dox
old mode 100644
new mode 100755
diff --git a/docs/doxygen/modIngest.dox b/docs/doxygen/modIngest.dox
old mode 100644
new mode 100755
diff --git a/docs/doxygen/modMobile.dox b/docs/doxygen/modMobile.dox
old mode 100644
new mode 100755
diff --git a/docs/doxygen/modReport.dox b/docs/doxygen/modReport.dox
old mode 100644
new mode 100755
diff --git a/docs/doxygen/modResult.dox b/docs/doxygen/modResult.dox
old mode 100644
new mode 100755
diff --git a/docs/doxygen/native_libs.dox b/docs/doxygen/native_libs.dox
old mode 100644
new mode 100755
diff --git a/docs/doxygen/platformConcepts.dox b/docs/doxygen/platformConcepts.dox
old mode 100644
new mode 100755
diff --git a/docs/doxygen/regressionTesting.dox b/docs/doxygen/regressionTesting.dox
old mode 100644
new mode 100755
diff --git a/docs/doxygen/viewer_image.jpg b/docs/doxygen/viewer_image.jpg
old mode 100644
new mode 100755
diff --git a/docs/doxygen/workflow.dox b/docs/doxygen/workflow.dox
old mode 100644
new mode 100755
diff --git a/docs/javahelp-notes.txt b/docs/javahelp-notes.txt
old mode 100644
new mode 100755