diff --git a/docs/doxygen-user/case_management.dox b/docs/doxygen-user/case_management.dox index 0fa16f5261d26634f837a0903adaff92c3b0db5d..bf933e460adc15c500974cb6570679616996817f 100644 --- a/docs/doxygen-user/case_management.dox +++ b/docs/doxygen-user/case_management.dox @@ -1,12 +1,10 @@ -/*! \page case_management Cases and Data Sources - -\section case_mgmt_cases Cases +/*! \page cases_page Cases You need to create a case before you can analyze data in Autopsy. A case can contain one or more data sources (disk images, disk devices, logical files). The data sources can be from multiple drives in a single computer or from multiple computers. It's up to you. Each case has its own directory that is named based on the case name. The directory will contain configuration files, a database, reports, and other files that modules generates. The main Autopsy case configuration file has a .aut extension. -\subsection case_mgmt_case_create Creating a Case +\section case_create Creating a Case There are several ways to create a new case: - The opening window has a button to create a new case. @@ -18,9 +16,9 @@ The "New Case" wizard dialog will open and you will need to enter the case name You will also be prompted for optional information, such as investigator name and case number. -After you create the case, you will be prompted to add a data source, as described in \ref case_mgmt_ds_add. +After you create the case, you will be prompted to add a data source, as described in \ref ds_add. -\subsection case_mgmt_case_open Opening a Case +\section case_open Opening a Case To open a case, either: - Choose "Open Case" or "Open Recent Case" from the opening window. @@ -28,102 +26,4 @@ To open a case, either: Navigate to the case directory and select the ".aut" file. - - -\section case_mgmt_ds Data Sources - -Data source is the term that we use in Autopsy to refer to disk images, logical files, etc. This is the data that you want to add in to analyze. You must have a case open before you can add a data source. - -Autopsy supports three types of data sources: -- Disk Image: A file (or set of files) that is a byte-for-byte copy of a hard drive or media card. (see \ref case_mgmt_ds_img) -- Local Drive: Local storage device (local drive, USB-attached drive, etc.). (see \ref case_mgmt_ds_local) -- Logical Files: Local files or folders. (see \ref case_mgmt_ds_log) - - - -\subsection case_mgmt_ds_add Adding a Data Source - -You can add a data source in several ways: -- After you create a case, it automatically prompts you to add a data source. -- There is a toolbar item to add a Data Source when a case is open. -- The "File" -> "Add Data Source" menu item when a case is open. - -The data source must remain accessible for the duration of the analysis because the case contains only a reference to the data source. It does not copy the data source into the case folder. - - - -\subsection case_mgmt_ds_process Data Source Adding Process - -Regardless of the type of data source, there are some common steps in the process: - -1) You will be prompted to specify the data source to add (details are provided below) - -\image html select-data-source-type.PNG - -2) Autopsy will perform a basic examination of the data source and populate an embedded database with an entry for each file in the data source. No content is analyzed in the process, only the files are enumerated. - -3) While it is examining the data source, you will be prompted with a list of ingest modules to enable. - -\image html select-ingest-modules.PNG - -4) After you configure the ingest modules, you may need to wait for Autopsy to finish its basic examination of the data source. - -\image html data-source-progress-bar.PNG - -5) After the ingest modules have been configured and the basic examination of the data source is complete, the ingest modules will begin to analyze the file contents. - - - -\subsection case_mgmt_ds_img Adding a Disk Image - -Supported Image Formats - -Autopsy supports disk images in the following formats: -- Raw Single (For example: *.img, *.dd, *.raw, etc) -- Raw Split (For example: *.001, *.002, *.aa, *.ab, etc) -- EnCase (For example: *.e01, *e02, etc) - -To add a disk image: - --# Choose "Image File" from the pull down. --# Browse to the first file in the disk image. You need to specify only the first file and it will find the rest. --# Choose the timezone that the disk image came from. This is most important for when adding FAT file systems because it does not store timezone information and Autopsy will not know how to normalize to UTC. --# Choose to perform orphan file finding on FAT file systems. This can be a time intensive process because it will require that Autopsy look at each sector in the device. - - -\subsection case_mgmt_ds_local Adding a Local Drive - -Autopsy can analyze a local drive without needing to first make an image copy of it. This is most useful when analyzing a USB-attached device through a write blocker. - -Note that if you are analyzing a local drive that is being updated, then Autopsy will not see files that are added after you add it as a data source. - -You will need to be running Autopsy as an Administrator to view all devices. - -To add a local drive: --# Choose "Local Drive" from the pull down. --# Choose the device from the pull down list. --# Choose to perform orphan file finding. See comment in \ref case_mgmt_ds_img about this setting. - - -\subsection case_mgmt_ds_log Adding a Logical File - -You can add files or folders that are on your local computer (or on a shared drive) without putting them into a disk image. This is useful if you have only a collection of files that you want to analyze. - -Some things to note when doing this: -- Autopsy ignores the time stamps on files that it adds this way because they could be the timestamps when they were copied onto your examination device. -- If you have a USB-attached device that you are analyzing and you choose to add the device's contents using this method, then note that it will not look at unallocated space or deleted files. Autopsy will only be able to see the allocated files. You should add the device as a "Logical Drive" to get the unallocated space. - -To add logical files: --# Choose "Logical Files" from the pull down. --# Press the "Add" button and navigate to a folder or file to add. Choosing a folder will cause all of its contents (including sub-folders) to be added. --# Continue to press "Add" until all files and folders have been selected. - -All of the files that you added in the panel will be grouped together into a single data source, called "LogicalFileSet" in the main UI. - -\subsection case_mgmt_ds_rem Removing a Data Source - -You cannot currently remove an data source from a case. - - - */ diff --git a/docs/doxygen-user/data_explorer.dox b/docs/doxygen-user/data_explorer.dox deleted file mode 100644 index 52bec54c8441c16e27a35d2c37ec8ca143f6c057..0000000000000000000000000000000000000000 --- a/docs/doxygen-user/data_explorer.dox +++ /dev/null @@ -1,19 +0,0 @@ -/*! \page data_explorer Data Explorers - -\section about_the_data_explorer About the Data Explorer -The Data Explorer view in Autopsy is the \ref directory_tree "directory tree" node structure seen on the left hand side. -The data explorer contains the following data: -\li Image file-system with its directory structure that can be navigated, -\li Saved results of image and file analysis, such as results produced by the ingest process, -\li Built-in views and filters on the file-system and saved results. - -The data explorer provides different methods for finding relevant data, such as: -\li All files of a specific type -\li Different extracted content types (web bookmarks, web history, installed programs, devices, etc.) -\li Hash database hits -\li Keyword hits -\li File bookmarks - -The Data Explorer will publish all relevant data to the \ref result_viewers "Result Viewer" when specific nodes are clicked. In general, if you are looking for an 'analysis technique', then this is where you should look. - -*/ \ No newline at end of file diff --git a/docs/doxygen-user/data_sources.dox b/docs/doxygen-user/data_sources.dox new file mode 100644 index 0000000000000000000000000000000000000000..5dc8e8e0edbac7c7eb4fcd49ec9919ffd7a9d78a --- /dev/null +++ b/docs/doxygen-user/data_sources.dox @@ -0,0 +1,96 @@ +/*! \page ds_page Data Sources + + +Data source is the term that we use in Autopsy to refer to disk images, logical files, etc. This is the data that you want to add in to analyze. You must have a case open before you can add a data source. + +Autopsy supports three types of data sources: +- Disk Image: A file (or set of files) that is a byte-for-byte copy of a hard drive or media card. (see \ref ds_img) +- Local Drive: Local storage device (local drive, USB-attached drive, etc.). (see \ref ds_local) +- Logical Files: Local files or folders. (see \ref ds_log) + + + +\section ds_add Adding a Data Source + +You can add a data source in several ways: +- After you create a case, it automatically prompts you to add a data source. +- There is a toolbar item to add a Data Source when a case is open. +- The "File" -> "Add Data Source" menu item when a case is open. + +The data source must remain accessible for the duration of the analysis because the case contains only a reference to the data source. It does not copy the data source into the case folder. + + + +\section ds_process Data Source Adding Process + +Regardless of the type of data source, there are some common steps in the process: + +1) You will be prompted to specify the data source to add (details are provided below) + +\image html select-data-source-type.PNG + +2) Autopsy will perform a basic examination of the data source and populate an embedded database with an entry for each file in the data source. No content is analyzed in the process, only the files are enumerated. + +3) While it is examining the data source, you will be prompted with a list of ingest modules to enable. + +\image html select-ingest-modules.PNG + +4) After you configure the ingest modules, you may need to wait for Autopsy to finish its basic examination of the data source. + +\image html data-source-progress-bar.PNG + +5) After the ingest modules have been configured and the basic examination of the data source is complete, the ingest modules will begin to analyze the file contents. + + + +\section ds_img Adding a Disk Image + +Supported Image Formats + +Autopsy supports disk images in the following formats: +- Raw Single (For example: *.img, *.dd, *.raw, etc) +- Raw Split (For example: *.001, *.002, *.aa, *.ab, etc) +- EnCase (For example: *.e01, *e02, etc) + +To add a disk image: + +-# Choose "Image File" from the pull down. +-# Browse to the first file in the disk image. You need to specify only the first file and it will find the rest. +-# Choose the timezone that the disk image came from. This is most important for when adding FAT file systems because it does not store timezone information and Autopsy will not know how to normalize to UTC. +-# Choose to perform orphan file finding on FAT file systems. This can be a time intensive process because it will require that Autopsy look at each sector in the device. + + +\section ds_local Adding a Local Drive + +Autopsy can analyze a local drive without needing to first make an image copy of it. This is most useful when analyzing a USB-attached device through a write blocker. + +Note that if you are analyzing a local drive that is being updated, then Autopsy will not see files that are added after you add it as a data source. + +You will need to be running Autopsy as an Administrator to view all devices. + +To add a local drive: +-# Choose "Local Drive" from the pull down. +-# Choose the device from the pull down list. +-# Choose to perform orphan file finding. See comment in \ref ds_img about this setting. + + +\section ds_log Adding a Logical File + +You can add files or folders that are on your local computer (or on a shared drive) without putting them into a disk image. This is useful if you have only a collection of files that you want to analyze. + +Some things to note when doing this: +- Autopsy ignores the time stamps on files that it adds this way because they could be the timestamps when they were copied onto your examination device. +- If you have a USB-attached device that you are analyzing and you choose to add the device's contents using this method, then note that it will not look at unallocated space or deleted files. Autopsy will only be able to see the allocated files. You should add the device as a "Logical Drive" to get the unallocated space. + +To add logical files: +-# Choose "Logical Files" from the pull down. +-# Press the "Add" button and navigate to a folder or file to add. Choosing a folder will cause all of its contents (including sub-folders) to be added. +-# Continue to press "Add" until all files and folders have been selected. + +All of the files that you added in the panel will be grouped together into a single data source, called "LogicalFileSet" in the main UI. + +\section ds_rem Removing a Data Source + +You cannot currently remove an data source from a case. + +*/ \ No newline at end of file diff --git a/docs/doxygen-user/footer.html b/docs/doxygen-user/footer.html index f62135d90b590c1c4d9e5ff1cf0c94e5f3548c84..4029c565969d9a42b4f83433cbe46067e22c2774 100644 --- a/docs/doxygen-user/footer.html +++ b/docs/doxygen-user/footer.html @@ -1,5 +1,5 @@ <hr/> -<p><i>Copyright © 2012-2014 Basis Technology <br/> +<p><i>Copyright © 2012-2015 Basis Technology <br/> This work is licensed under a <a rel="license" href="http://creativecommons.org/licenses/by-sa/3.0/us/">Creative Commons Attribution-Share Alike 3.0 United States License</a>. </i></p> diff --git a/docs/doxygen-user/main.dox b/docs/doxygen-user/main.dox index e3612dad7cf7130a8a313176389ce5168f249f3d..30cf03f82c18ec5d14e3044d491a9f2fd6d9bf9b 100644 --- a/docs/doxygen-user/main.dox +++ b/docs/doxygen-user/main.dox @@ -4,8 +4,7 @@ Overview ----- -This is the User's Guide for the open source Autopsy platform (http://www.sleuthkit.org/autopsy/). -It is a work in progress. We are moving documentation from the JavaHelp system to this document. +This is the User's Guide for the open source Autopsy platform (http://www.sleuthkit.org/autopsy/). Autopsy allows you to examine a hard drive or mobile device and recover evidence from it. This is the user guide to help you use the tool. If you are looking for the developer's guide to help you develop modules, it can be found at http://www.sleuthkit.org/autopsy/docs/api-docs/3.1/. Note that Autopsy 3 is a complete rewrite from Autopsy 2 and none of this document is relevant to Autopsy 2. @@ -15,20 +14,24 @@ The following topics are available here: - \subpage installation_page - \subpage quick_start_guide "Quick Start Guide" -- \subpage overview "Overview" -- \subpage case_management "Case Management" -- \subpage hash_database_management_window "Hash Database Management Window" -- \subpage keyword_search "Keyword Search" -- \subpage ingest "Ingest" -- \subpage data_explorer "Data Explorers" -- \subpage directory_tree "Directory Tree" -- \subpage file_search "File Search" -- \subpage result_viewers "Result Viewers" -- \subpage content_viewers "Content Viewers" -- \subpage image_viewer -- \subpage timeline -- \subpage stix_page +- \subpage workflow_page +- Cases and Adding Data Sources + - \subpage cases_page + - \subpage ds_page +- Automated Analysis + - \subpage ingest "Ingest" + - \subpage hash_database_management_window "Hash Database Management Window" + - \subpage keyword_search "Keyword Search" +- Manual Analysis + - \subpage directory_tree "Directory Tree" + - \subpage file_search "File Search" + - \subpage result_viewers "Result Viewers" + - \subpage content_viewers "Content Viewers" + - \subpage image_viewer + - \subpage timeline + - \subpage stix_page +- Reporting If the topic you need is not listed, refer to the Help system in the tool or the wiki (http://wiki.sleuthkit.org/index.php?title=Autopsy_User%27s_Guide). -*/ \ No newline at end of file +*/ diff --git a/docs/doxygen-user/overview.dox b/docs/doxygen-user/overview.dox deleted file mode 100644 index a6cd10cc71dd8384667c22b2324c10c6d843878a..0000000000000000000000000000000000000000 --- a/docs/doxygen-user/overview.dox +++ /dev/null @@ -1,14 +0,0 @@ -/*! \page overview Overview - -\section Overview -Autopsy allows you to conduct a digital forensic investigation. It is a graphical interface to The Sleuth Kit and other tools. This page outlines the basic concepts of the program. The remainder of the help guide is organized around these concepts. -The main Autopsy features include: importing a Data Source (image, disk, files) and exploring its file systems, running analysis modules (ingest), viewing ingest results, viewing content and generating reports. -Autopsy is an extensible application; it provides a plug-in framework that allows other other parties to supply plug-ins and supply additional: image and file ingest for new types of analysis, different content viewers and different types of reports to be supported. There are plug-ins for for several ingest modules, viewers and reports that are bundled by default with Autopsy. -All data is organized around the concept of a case. A case can have one or more data sources loaded into it. -The main window has three major areas: -\li \ref data_explorer "Data Explorer Tree": This area is where you go find major analysis functionality. It allows you to start finding the relevant files quickly. -\li \ref result_viewers "Result Viewers": This area is where the files and directories that were found from the explorer window can be viewed. There are different formatting options for the files. -\li \ref content_viewers "Content Viewers": This area is where file content can be viewed after they are selected from the Result Viewer area. -The main take away from this should be that analysis techniques and result categories can be found on the left-hand side, the results from choosing something on the left are always listed in the upper right, and the file contents are displayed in the lower left. - -*/ \ No newline at end of file diff --git a/docs/doxygen-user/result_viewers.dox b/docs/doxygen-user/result_viewers.dox index ebd98957bbc8296079b783946a17fcd88fdefd2a..8862be5ae20647da048d3c4838bfd8cef40373dd 100644 --- a/docs/doxygen-user/result_viewers.dox +++ b/docs/doxygen-user/result_viewers.dox @@ -35,4 +35,4 @@ The Results Viewer can be also activated for saved results and it can show a hig Below is an example of a "Table Results Viewer" window: \image html thumbnail-result-viewer-tab.PNG -*/ \ No newline at end of file +*/ diff --git a/docs/doxygen-user/workflow.dox b/docs/doxygen-user/workflow.dox new file mode 100644 index 0000000000000000000000000000000000000000..792069bc8df783b9dc9cf926f9121ce6b979f234 --- /dev/null +++ b/docs/doxygen-user/workflow.dox @@ -0,0 +1,10 @@ +/*! \page workflow_page Autopsy Workflow + +Analyzing data in Autopsy uses the following workflow: +-# A case is created (see \ref cases_page) +-# One or more data sources are added (see \ref ds_page) +-# Ingest modules automatically analyze the data sources to extract information +-# Manual analysis is performed to identify the evidence. +-# Reports are generated. + +*/