diff --git a/docs/doxygen-user/case_management.dox b/docs/doxygen-user/case_management.dox index 5771c12166bfe5d5549476cf1dfb2cc988bc04e7..d458238b67e40e9332f6aba4adde00b2944a60cf 100755 --- a/docs/doxygen-user/case_management.dox +++ b/docs/doxygen-user/case_management.dox @@ -10,7 +10,7 @@ Each case has its own directory that is named based on the case name. The direct There are several ways to create a new case: - The opening splash screen has a button to create a new case. -- The "File", "Create New Case" menu item +- The "Case", "Create New Case" menu item The New Case wizard dialog will open and you will need to enter the case name and base directory. A directory for the case will be created inside of the "base directory". If the directory already exists, you will need to either delete the existing directory or choose a different combination of names. @@ -26,7 +26,7 @@ After you create the case, you will be prompted to add a data source, as describ To open a case, either: - Choose "Open Existing Case" or "Open Recent Case" from the opening splash screen. -- Choose the "File", "Open Case" menu item or "File", "Open Recent Case" +- Choose the "Case", "Open Case" menu item or "Case", "Open Recent Case" Navigate to the case directory and select the ".aut" file. diff --git a/docs/doxygen-user/data_sources.dox b/docs/doxygen-user/data_sources.dox index 9e1f4acf3bf5f70acf3e809adb9c54183ac46086..a09c5b6a55630eefb1a8a7b0beaebb20428d00e3 100755 --- a/docs/doxygen-user/data_sources.dox +++ b/docs/doxygen-user/data_sources.dox @@ -15,7 +15,7 @@ Autopsy supports three types of data sources: You can add a data source in several ways: - After you create a case, it automatically prompts you to add a data source. - There is a toolbar item to add a Data Source when a case is open. -- The "File", "Add Data Source" menu item when a case is open. +- The "Case", "Add Data Source" menu item when a case is open. The data source must remain accessible for the duration of the analysis because the case contains a reference to the data source. It does <b>not</b> copy the data source into the case folder. @@ -79,6 +79,9 @@ You can add files or folders that are on your local computer (or on a shared dri Some things to note when doing this: - Autopsy ignores the time stamps on files that it adds this way because they could be the timestamps when they were copied onto your examination device. - If you have a USB-attached device that you are analyzing and you choose to add the device's contents using this method, then note that it will not look at unallocated space or deleted files. Autopsy will only be able to see the allocated files. You should add the device as a "Logical Drive" to analyze the unallocated space. +- You can modify the name of the Logical File Set from the default LogicalFileSet# by clicking the "Change" button as shown in the screenshot below: + +\image html change_logical_file_set_display_name.PNG To add logical files: -# Choose "Logical Files" from the pull down. diff --git a/docs/doxygen-user/footer.html b/docs/doxygen-user/footer.html index fa43708523ae74de79d613e2952efbfacb406600..708afd5dd7b554913afa83806deb2cdf936cf952 100755 --- a/docs/doxygen-user/footer.html +++ b/docs/doxygen-user/footer.html @@ -1,5 +1,5 @@ <hr/> -<p><i>Copyright © 2012-2015 Basis Technology. Generated on $date<br/> +<p><i>Copyright © 2012-2016 Basis Technology. Generated on $date<br/> This work is licensed under a <a rel="license" href="http://creativecommons.org/licenses/by-sa/3.0/us/">Creative Commons Attribution-Share Alike 3.0 United States License</a>. </i></p> diff --git a/docs/doxygen-user/images/change_logical_file_set_display_name.PNG b/docs/doxygen-user/images/change_logical_file_set_display_name.PNG new file mode 100755 index 0000000000000000000000000000000000000000..ec73a232c6a628a2a20e3f5e10a15c43ce310315 Binary files /dev/null and b/docs/doxygen-user/images/change_logical_file_set_display_name.PNG differ diff --git a/docs/doxygen-user/images/content-viewer-1.PNG b/docs/doxygen-user/images/content-viewer-1.PNG index 6e83fd8ee836080bbadf22fd403b2079f0635dfa..96d8f39c9f5e160a45eed0dc015c5b79dd8fe740 100755 Binary files a/docs/doxygen-user/images/content-viewer-1.PNG and b/docs/doxygen-user/images/content-viewer-1.PNG differ diff --git a/docs/doxygen-user/images/directory-tree.PNG b/docs/doxygen-user/images/directory-tree.PNG index 0d7f4bd50dea3dcf29f036b2ec28e94798b49de9..69d9bf73f4287cc89f3b6bb8df483a79376bb943 100755 Binary files a/docs/doxygen-user/images/directory-tree.PNG and b/docs/doxygen-user/images/directory-tree.PNG differ diff --git a/docs/doxygen-user/images/email_results.PNG b/docs/doxygen-user/images/email_results.PNG index 1e7f7447460bbbce1a2ffccc71642fa645ab1128..1e36b83c7152de73bf35c2f05c3b1ffd634c9dfb 100755 Binary files a/docs/doxygen-user/images/email_results.PNG and b/docs/doxygen-user/images/email_results.PNG differ diff --git a/docs/doxygen-user/images/extension-mismatch-detected-configuration.PNG b/docs/doxygen-user/images/extension-mismatch-detected-configuration.PNG index d93257a5d5806b4c6228ddf9b552fd5951ad20d9..f7f2e9a2a15ffbcff942ac04fccbe0e5e01974bd 100755 Binary files a/docs/doxygen-user/images/extension-mismatch-detected-configuration.PNG and b/docs/doxygen-user/images/extension-mismatch-detected-configuration.PNG differ diff --git a/docs/doxygen-user/images/extension-mismatch-detected.PNG b/docs/doxygen-user/images/extension-mismatch-detected.PNG index 7b4085ce9acad9bbea8a74fbd13a86c202787c6f..3bd90ded78249715925cb4905faa6b508af2a663 100755 Binary files a/docs/doxygen-user/images/extension-mismatch-detected.PNG and b/docs/doxygen-user/images/extension-mismatch-detected.PNG differ diff --git a/docs/doxygen-user/images/filetype.PNG b/docs/doxygen-user/images/filetype.PNG index d14cc5470aa35e9d3b353df7e50990e78d6fe0b6..cd6d2883918c8ec2c8f08e9a94a644c3831ac042 100755 Binary files a/docs/doxygen-user/images/filetype.PNG and b/docs/doxygen-user/images/filetype.PNG differ diff --git a/docs/doxygen-user/images/interesting_files_configuration.PNG b/docs/doxygen-user/images/interesting_files_configuration.PNG index 60d4b1772fbab4efb6afb8a45051931e75d2e1e7..d027d92454b9f0529adef89a5289cfb2a1127122 100755 Binary files a/docs/doxygen-user/images/interesting_files_configuration.PNG and b/docs/doxygen-user/images/interesting_files_configuration.PNG differ diff --git a/docs/doxygen-user/images/keyword-search-configuration-dialog-general.PNG b/docs/doxygen-user/images/keyword-search-configuration-dialog-general.PNG index 97dc6da4e371abe606d6ec4667a100a69be9ed19..86e392d2e3daf92400ed69c500e5855d926eafe8 100755 Binary files a/docs/doxygen-user/images/keyword-search-configuration-dialog-general.PNG and b/docs/doxygen-user/images/keyword-search-configuration-dialog-general.PNG differ diff --git a/docs/doxygen-user/images/keyword-search-configuration-dialog-string-extraction.PNG b/docs/doxygen-user/images/keyword-search-configuration-dialog-string-extraction.PNG index 643cf6c25e90d5aae942f2e6d68f26a73c79d06b..cbe3bd976beca31f7171dc812b7b96077855ebb2 100755 Binary files a/docs/doxygen-user/images/keyword-search-configuration-dialog-string-extraction.PNG and b/docs/doxygen-user/images/keyword-search-configuration-dialog-string-extraction.PNG differ diff --git a/docs/doxygen-user/images/keyword-search-configuration-dialog.PNG b/docs/doxygen-user/images/keyword-search-configuration-dialog.PNG index cb2ce5f32ac03360341baefd628be55550da0ee2..30649c9be454b5d959c78977a4c8841a84c23441 100755 Binary files a/docs/doxygen-user/images/keyword-search-configuration-dialog.PNG and b/docs/doxygen-user/images/keyword-search-configuration-dialog.PNG differ diff --git a/docs/doxygen-user/images/keyword-search-hits.PNG b/docs/doxygen-user/images/keyword-search-hits.PNG index 446bd9ada35a68d6b3db5d99a141e2549c6734e9..f983ea25a846e34729e51a84290e0a2c1082225d 100755 Binary files a/docs/doxygen-user/images/keyword-search-hits.PNG and b/docs/doxygen-user/images/keyword-search-hits.PNG differ diff --git a/docs/doxygen-user/images/keyword-search-ingest-settings.PNG b/docs/doxygen-user/images/keyword-search-ingest-settings.PNG index dcc7cf6028bf17b8d42d22d2ad3040129bcfd2a1..78a2c99b1d79c05437617388b6a18b37a9ae683a 100755 Binary files a/docs/doxygen-user/images/keyword-search-ingest-settings.PNG and b/docs/doxygen-user/images/keyword-search-ingest-settings.PNG differ diff --git a/docs/doxygen-user/images/keyword-search-list-results.PNG b/docs/doxygen-user/images/keyword-search-list-results.PNG index 83cda9c20e4542554ed1558f4738e90fa99e26d1..368e744a4157eaa07a09fd5ff8b7ab41416ee3d9 100755 Binary files a/docs/doxygen-user/images/keyword-search-list-results.PNG and b/docs/doxygen-user/images/keyword-search-list-results.PNG differ diff --git a/docs/doxygen-user/images/keyword-search-list.PNG b/docs/doxygen-user/images/keyword-search-list.PNG index 0e33fa769d46510dcd1c3bddf5391fe6d9df5039..7cdb0b5f5afa65d850fcdd03232c744ff8564149 100755 Binary files a/docs/doxygen-user/images/keyword-search-list.PNG and b/docs/doxygen-user/images/keyword-search-list.PNG differ diff --git a/docs/doxygen-user/images/nsrl_import_process.PNG b/docs/doxygen-user/images/nsrl_import_process.PNG old mode 100644 new mode 100755 index 43a2c89eb0807ec310f71250dfab610080bbb004..48f2fbde8352bfcfa21ed4127b20ecc157d566a4 Binary files a/docs/doxygen-user/images/nsrl_import_process.PNG and b/docs/doxygen-user/images/nsrl_import_process.PNG differ diff --git a/docs/doxygen-user/images/nsrl_imported.PNG b/docs/doxygen-user/images/nsrl_imported.PNG old mode 100644 new mode 100755 index c597cc18abaa0e29d97c30d654fbbf727078019b..79408225944569ee56c4afbb83c599843cf4e0b2 Binary files a/docs/doxygen-user/images/nsrl_imported.PNG and b/docs/doxygen-user/images/nsrl_imported.PNG differ diff --git a/docs/doxygen-user/images/open-file-search-component-1.PNG b/docs/doxygen-user/images/open-file-search-component-1.PNG index 7c86dbdfc49affdb203d01584ee1962fe13455f5..a226d461b7d011308cbbfcfdb845c8dc8fd23fa1 100755 Binary files a/docs/doxygen-user/images/open-file-search-component-1.PNG and b/docs/doxygen-user/images/open-file-search-component-1.PNG differ diff --git a/docs/doxygen-user/images/open-file-search-component-2.PNG b/docs/doxygen-user/images/open-file-search-component-2.PNG index 64d15ab3675b552265929beee3239bc387956583..c968e0e223a09ae7b054f9e0b8426dc10d2147e8 100755 Binary files a/docs/doxygen-user/images/open-file-search-component-2.PNG and b/docs/doxygen-user/images/open-file-search-component-2.PNG differ diff --git a/docs/doxygen-user/images/photorec_output.PNG b/docs/doxygen-user/images/photorec_output.PNG index 859ed4f87128b4de95ebc46c857a22ada7f4279a..10bde5d8b861a810b3f33f9764d88462879c31b0 100755 Binary files a/docs/doxygen-user/images/photorec_output.PNG and b/docs/doxygen-user/images/photorec_output.PNG differ diff --git a/docs/doxygen-user/images/screenshot.PNG b/docs/doxygen-user/images/screenshot.PNG index bc94b4b382ae776589ae17a1f820eb735bb60fc4..a7a22bfd21ed645197a5324e071c635fd0e1aea7 100755 Binary files a/docs/doxygen-user/images/screenshot.PNG and b/docs/doxygen-user/images/screenshot.PNG differ diff --git a/docs/doxygen-user/images/tagging-4.PNG b/docs/doxygen-user/images/tagging-4.PNG index 1b98aaddf89ad4dba1749fe4e11ef58c684438f4..d1ee2a7b9701e25723a769bc2f99116c8d16df9b 100755 Binary files a/docs/doxygen-user/images/tagging-4.PNG and b/docs/doxygen-user/images/tagging-4.PNG differ diff --git a/docs/doxygen-user/images/ui-layout-1.PNG b/docs/doxygen-user/images/ui-layout-1.PNG index 7a99d1e26445d53a2a4d987288fbec05ad7b080a..8aa266893b3eec93b6d5c6ddb48b1ca68106ba6e 100755 Binary files a/docs/doxygen-user/images/ui-layout-1.PNG and b/docs/doxygen-user/images/ui-layout-1.PNG differ diff --git a/docs/doxygen-user/quick_start_guide.dox b/docs/doxygen-user/quick_start_guide.dox index 67afb60c9f7728c3174375ce9522283601dd3527..8c4b18c4a5ed42075454299dad98259e8eaab3f2 100755 --- a/docs/doxygen-user/quick_start_guide.dox +++ b/docs/doxygen-user/quick_start_guide.dox @@ -5,10 +5,10 @@ Data sources are added to a <strong>case</strong>. A case can have a single data source or it can have multiple data sources. Currently, a single report is generated for an entire case, so if you need to report on individual data sources, then you should use one data source per case. If there are many drives/phones/other data sources for one investigation, then your case should have multiple data sources. \subsection s2 Creating a Case -To create a case, use either the "Create New Case" option on the Welcome screen or from the "File" menu. This will start the <strong>New Case Wizard</strong>. You will need to supply it with the name of the case and a directory to store the case results into. You can optionally provide case numbers and reviewer names. +To create a case, use either the "Create New Case" option on the Welcome screen or from the "Case" menu. This will start the <strong>New Case Wizard</strong>. You will need to supply it with the name of the case and a directory to store the case results into. You can optionally provide case numbers and reviewer names. \subsection s3 Adding a Data Source -The next step is to add an input data source to the case. The <strong>Add Data Source Wizard</strong> will start automatically after the case is created or you can manually start it from the "File" menu or toolbar. You will need to choose the type of input data source to add (image, local disk, or logical files and folders). Next, supply it with the location of the source to add. +The next step is to add an input data source to the case. The <strong>Add Data Source Wizard</strong> will start automatically after the case is created or you can manually start it from the "Case" menu or toolbar. You will need to choose the type of input data source to add (image, local disk, or logical files and folders). Next, supply it with the location of the source to add. - For a disk image, browse to the first file in the set (Autopsy will find the rest of the files). Autopsy currently supports E01 and raw (dd) files. @@ -114,7 +114,7 @@ You can select an image or video from the upper right and view the video or imag A final report can be generated that will include all analysis results. Use the "Generate Report" button to create this. It will create an HTML or XLS report in the Reports folder of the case folder. -If you forgot the location of your case folder, you can determine it using the "Case Properties" option in the "File" menu. +If you forgot the location of your case folder, you can determine it using the "Case Properties" option in the "Case" menu. There is also an option to export report files to a separate folder outside of the case folder. */ \ No newline at end of file