Skip to content
Snippets Groups Projects
Commit a32bd7b8 authored by Brian Carrier's avatar Brian Carrier
Browse files

Merge pull request #1044 from sidheshenator/doxygen-user-docs

JavaHelp packages safely deleted
parents e4f573d9 8846d739
No related branches found
No related tags found
No related merge requests found
Showing
with 0 additions and 554 deletions
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title>Data Source Basics</title>
<link rel="stylesheet" href="nbdocs:/org/sleuthkit/autopsy/core/docs/ide.css" type="text/css">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<h2>About Data Sources</h2>
<p>
Autopsy supports 3 types of data sources that can be added to the Case:</p>
<ul>
<li>Disk Image (raw, Encase, etc).
"Image" refers to a byte-for-byte copy of a hard drive or other storage media.
</li>
<li>Disk Device (physical or logical disk partition, plugged in the user machine and detected by Autopsy).
Note: to correctly detect all devices, Autopsy needs to run as Administrator.
</li>
<li>Logical Files (files and folders on the user machine file system)</li>
</ul>
<p>
User needs to select the data source type from the pull down menu in the Add Data Source wizard.
</p>
<p>
To analyze a Data Source, user should use the <a href="nbdocs:/org/sleuthkit/autopsy/casemodule/docs/addImage.html">Add Data Source Wizard</a>
to add it to a <a href="nbdocs:/org/sleuthkit/autopsy/casemodule/docs/casemodule-about.html">case</a>.
</p>
<p>
Autopsy populates an embedded database for each data source (image, disk device, logical files) that it imports.
This database is a SQLite database and it contains all of the file system metadata from the input data source.
The database is stored in the case directory, but the data source will stay in its original location.
The data source must remain accessible for the duration of the analysis because the database contains only basic file system information (meta-data, not the actual content).
The image / files are needed to retrieve file content.
</p>
<h2>Supported Image Formats</h2>
<p>Currently, Autopsy supports these image formats:</p>
<ul>
<li>Raw Single (For example: *.img, *.dd, *.raw, etc)</li>
<li>Raw Split (For example: *.001, *.002, *.aa, *.ab, etc)</li>
<li>EnCase (For example: *.e01, *e02, etc)</li>
</ul>
<h2>Removing a Data Source</h2>
<p>You cannot currently remove an data source from a case.</p>
</body>
</html>
Core/src/org/sleuthkit/autopsy/casemodule/docs/addImage-icon.png

1.4 KiB

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title>Adding Data Source (Image, Disk, Files) Wizard</title>
<link rel="stylesheet" href="nbdocs:/org/sleuthkit/autopsy/core/docs/ide.css" type="text/css">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<h2>Adding a Data Source</h2>
<p>There are two ways to add an data source to the currently opened case:</p>
<ul>
<li>Go to "File" and select "Add Data Source..." </li>
<li>Select the <img src="addImage-icon.png" alt="Add Image Icon" /> icon on the toolbar</li>
</ul>
<p>This will bring up the Add Data Source wizard. It will guide you through the process.</p>
<p>Here are some notes on what is going on during the process:</p>
<ul>
<li>
The first panel will ask you to select the data source type and
browse for the data source (image or files located on the computer, or select the device detected).
In case of adding a disk image, you will also need to specify the timezone that the disk image came from
so that the dates and times can be properly displayed and converted.
As soon as you click 'Next >', Autopsy will begin analyzing the disk image and populating the database in the background.
<br />
<img src="AddImageWizard1_Help.png" alt="Add Image Wizard Panel 1 Help" />
</li>
<li>
The second panel allows you to choose which ingest modules to run on the image.
Refer to the <a href="nbdocs:/org/sleuthkit/autopsy/ingest/docs/ingest-about.html">Image Ingest</a> part of the help guide for more details.
<br />
<img src="AddImageWizard2_Help.png" alt="Add Image Wizard Panel 3 Help" />
</li>
<li>
The third panel provides a progress bar and information about the data source Autopsy is currently processing.
If small enough, the input may have already finished processing, allowing you to continue past this panel.
However, it may be necessary to wait for a short time while the database is populated.
<br />
<img src="AddImageWizard3_Help.png" alt="Add Image Wizard Panel 2 Help" />
</li>
<li>
Once the input data source finishes adding, the ingest modules you selected will automatically run in the background.
If the data source is processed before you select ingest modules, Autopsy will wait until you have done so.
</li>
</ul>
<p>
Note that in case of image, Autopsy will store the path to the image in its configuration file.
If the image moves, then Autopsy will give an error because it can't find the image file and it will prompt user to point to the new image location.
</p>
</body>
</html>
\ No newline at end of file
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title>About Cases</title>
<link rel="stylesheet" href="nbdocs:/org/sleuthkit/autopsy/core/docs/ide.css" type="text/css">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<h2>About Cases</h2>
<p>
In Autopsy, a "case" is a container concept for a set of <a href="nbdocs:/org/sleuthkit/autopsy/casemodule/docs/aboutImage.html">input data sources (disk images, disk devices, logical files)</a>.
The set of data could be from multiple drives in a single computer or from multiple computers.
When you make a case, it will create a directory to hold all of the information.
The directory will contain the main Autopsy configuration file, other module's configuration files,
some databases, generated reports, and some other information (temporary files, cache files).
The main Autopsy case configuration file as a .aut extension - that is the file used to "Open" the case.
In general, it is recommended for the user not to modify any files in the Case directory and leave it to Autopsy manage it.
</p>
<p>
If you want to view case details or edit some case information,
use the <a href="nbdocs:/org/sleuthkit/autopsy/casemodule/docs/caseProperties.html">Case Properties</a> window.
</p>
<h2>Creating a Case</h2>
<p>Refer to the <a href="nbdocs:/org/sleuthkit/autopsy/casemodule/docs/createNewCase.html">Creating a Case</a> page for more details.</p>
<h2>Opening a Case</h2>
<p>
To open a case, choose "Open Case" from the File menu or use the "Ctrl + O" keyboard shortcut.
Navigate to the case directory and select the ".aut" file.
</p>
</body>
</html>
<?xml version="1.0" encoding="UTF-8"?>
<!--
To change this template, choose Tools | Templates
and open the template in the editor.
-->
<!DOCTYPE helpset PUBLIC "-//Sun Microsystems Inc.//DTD JavaHelp HelpSet Version 2.0//EN" "http://java.sun.com/products/javahelp/helpset_2_0.dtd">
<helpset version="2.0">
<title>Case Help</title>
<maps>
<homeID>org.sleuthkit.autopsy.casemodule.about</homeID>
<mapref location="casemodule-map.xml"/>
</maps>
<view mergetype="javax.help.AppendMerge">
<name>TOC</name>
<label>Table of Contents</label>
<type>javax.help.TOCView</type>
<data>casemodule-toc.xml</data>
</view>
<view mergetype="javax.help.AppendMerge">
<name>Index</name>
<label>Index</label>
<type>javax.help.IndexView</type>
<data>casemodule-idx.xml</data>
</view>
</helpset>
<?xml version="1.0" encoding="UTF-8"?>
<!--
To change this template, choose Tools | Templates
and open the template in the editor.
-->
<!DOCTYPE index PUBLIC "-//Sun Microsystems Inc.//DTD JavaHelp Index Version 2.0//EN" "http://java.sun.com/products/javahelp/index_2_0.dtd">
<index version="2.0">
<indexitem text="Overview" target="org.sleuthkit.autopsy.casemodule.overview"/>
<indexitem text="Quick Start" target="org.sleuthkit.autopsy.casemodule.quickstart"/>
<indexitem text="About Cases" target="org.sleuthkit.autopsy.casemodule.about"/>
<indexitem text="Creating a Case" target="org.sleuthkit.autopsy.casemodule.how-to-create-case"/>
<indexitem text="About Data Sources" target="org.sleuthkit.autopsy.casemodule.image-about"/>
<indexitem text="Adding a Data Source" target="org.sleuthkit.autopsy.casemodule.add-image"/>
<indexitem text="Case Properties Window" target="org.sleuthkit.autopsy.casemodule.caseproperties"/>
<indexitem text="Hash Database Management" target="org.sleuthkit.autopsy.casemodule.hashdbmgmt"/>
</index>
<?xml version="1.0" encoding="UTF-8"?>
<!--
To change this template, choose Tools | Templates
and open the template in the editor.
-->
<!DOCTYPE map PUBLIC "-//Sun Microsystems Inc.//DTD JavaHelp Map Version 2.0//EN" "http://java.sun.com/products/javahelp/map_2_0.dtd">
<map version="2.0">
<mapID target="org.sleuthkit.autopsy.casemodule.overview" url="overview.html"/>
<mapID target="org.sleuthkit.autopsy.casemodule.quickstart" url="QuickStart.html"/>
<mapID target="org.sleuthkit.autopsy.casemodule.about" url="casemodule-about.html"/>
<mapID target="org.sleuthkit.autopsy.casemodule.how-to-create-case" url="createNewCase.html"/>
<mapID target="org.sleuthkit.autopsy.casemodule.image-about" url="aboutImage.html"/>
<mapID target="org.sleuthkit.autopsy.casemodule.add-image" url="addImage.html"/>
<mapID target="org.sleuthkit.autopsy.casemodule.caseproperties" url="caseProperties.html"/>
<mapID target="org.sleuthkit.autopsy.casemodule.hashdbmgmt" url="hashDbMgmt.html"/>
</map>
<?xml version="1.0" encoding="UTF-8"?>
<!--
To change this template, choose Tools | Templates
and open the template in the editor.
-->
<!DOCTYPE toc PUBLIC "-//Sun Microsystems Inc.//DTD JavaHelp TOC Version 2.0//EN" "http://java.sun.com/products/javahelp/toc_2_0.dtd">
<toc version="2.0">
<tocitem text="Quick Start Guide" target="org.sleuthkit.autopsy.casemodule.quickstart"/>
<tocitem text="Overview" target="org.sleuthkit.autopsy.casemodule.overview"/>
<tocitem text="Case Management">
<tocitem text="Case">
<tocitem text="About Cases" target="org.sleuthkit.autopsy.casemodule.about"/>
<tocitem text="Creating a Case" target="org.sleuthkit.autopsy.casemodule.how-to-create-case"/>
</tocitem>
<tocitem text="Data Source">
<tocitem text="About Data Source" target="org.sleuthkit.autopsy.casemodule.image-about"/>
<tocitem text="Adding a Data Source" target="org.sleuthkit.autopsy.casemodule.add-image"/>
</tocitem>
<tocitem text="Case Properties Window" target="org.sleuthkit.autopsy.casemodule.caseproperties"/>
<tocitem text="Hash Database Management Window" target="org.sleuthkit.autopsy.casemodule.hashdbmgmt"/>
</tocitem>
</toc>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title>Hash Database Management</title>
<link rel="stylesheet" href="nbdocs:/org/sleuthkit/autopsy/core/docs/ide.css" type="text/css">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<h2>Hash Database Management Window</h2>
<p>
The Hash Database Management window is where you can set and update your hash database information.
Hash databases are used to identify files that are 'known'.
</p>
<ul>
<li>
Known good files are those that can be safely ignored.
This set of files frequently includes standard OS and application files.
Ignoring such uninteresting to the investigator files, can greatly reduce image analysis time.
</li>
<li>
Known bad (also called notable) files are those that should raise awareness.
This set will vary depending on the type of investigation, but common examples include contraband images and malware.
</li>
</ul>
<h2>Notable / Known Bad Hashsets</h2>
<p>Autopsy allows for multiple known bad hash databases to be set. Autopsy supports three formats:</p>
<ul>
<li>EnCase: An EnCase hashset file.</li>
<li>MD5sum: Output from running the md5, md5sum, or md5deep program on a set of files.</li>
<li>NSRL: The format of the NSRL database.</li>
<li>HashKeeper: Hashset file conforming to the HashKeeper standard.</li>
</ul>
<h2>NIST NSRL</h2>
<p>
Autopsy can use the <a href="http://www.nsrl.nist.gov">NIST NSRL</a> to detect 'known files'.
Note that the NSRL contains hashes of 'known files' that may be good or bad depending on your perspective and investigation type.
For example, the existence of a piece of financial software may be interesting to your investigation and that software could be in the NSRL.
Therefore, Autopsy treats files that are found in the NSRL as simply 'known' and does not specify good or bad.
Ingest modules have the option of ignoring files that were found in the NSRL.
</p>
<p>
To use the NSRL, you must concatenate all of the NSRLFile.txt files together.
You can use 'cat' on a Unix system or from within Cygwin to do this.
</p>
<h2>Adding Hashsets</h2>
<p>
Autopsy needs an index of the hashset to actualy use a hash database.
It can create the index if you import only the hashset.
When you select the database from within this window, it will tell you if the index needs to be created.
Autopsy uses the hash database management system from The Sleuth Kit. You can manually create an index using the 'hfind' command line tool or you can use Autopsy.
If you attempt proceed without indexing a database, Autopsy will offer to automatically produce an index for you.
</p>
<p>
You can also specify only the index file and not use the full hashset - the index file is sufficient to identify known files.
This can save space. To do this, specify the .idx file from the Hash Database Management window.
</p>
<h2>Using Hashsets</h2>
<p>
There is an <a href="nbdocs:/org/sleuthkit/autopsy/ingest/docs/ingest-about.html">ingest module</a> that will hash the files and look them up in the hashsets.
It will flag files that were in the notable hashset and those results will be shown in the Results tree of the <a href="nbdocs:/org/sleuthkit/autopsy/directorytree/docs/directorytree-about.html">Data Explorer</a>.
</p>
<p>Other ingest modules are able to use the known status of a file to decide if they should ignore the file or process it.</p>
<p>
You can also see the results in the <a href="nbdocs:/org/sleuthkit/autopsy/filesearch/docs/open-filesearch.html">File Search</a> window.
There is an option to choose the 'known status'. From here, you can do a search to see all 'known bad' files.
From here, you can also choose to ignore all 'known' files that were found in the NSRL.
You can also see the status of the file in a column when the file is listed.
</p>
<img src="hashdb.PNG" alt="Hash Database Configuration" />
</body>
</html>
Core/src/org/sleuthkit/autopsy/casemodule/docs/hashdb.PNG

57.3 KiB

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title>Overview</title>
<link rel="stylesheet" href="nbdocs:/org/sleuthkit/autopsy/core/docs/ide.css" type="text/css">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<h2>Overview</h2>
<p>
Autopsy allows you to conduct a digital forensic investigation.
It is a graphical interface to The Sleuth Kit and other tools.
This page outlines the basic concepts of the program.
The remainder of the help guide is organized around these concepts.
</p>
<p>
The main Autopsy features include: importing a Data Source (image, disk, files) and exploring its file systems,
running analysis modules (ingest), viewing ingest results, viewing content and generating reports.
</p>
<p>
Autopsy is an extensible application; it provides a plug-in framework that allows other other parties to supply plug-ins and supply additional:
image and file ingest for new types of analysis, different content viewers and different types of reports to be supported.
There are plug-ins for for several ingest modules, viewers and reports that are bundled by default with Autopsy.
</p>
<p>
All data is organized around the concept of a <a href="nbdocs:/org/sleuthkit/autopsy/casemodule/docs/casemodule-about.html">case</a>.
A case can have one or more data <a href="nbdocs:/org/sleuthkit/autopsy/casemodule/docs/aboutImage.html">sources</a> loaded into it.
</p>
<p>The main window has three major areas:</p>
<ul>
<li>
<a href="nbdocs:/org/sleuthkit/autopsy/corecomponents/docs/dataexplorer-about.html">Data Explorer Tree</a>:
This area is where you go find major analysis functionality.
It allows you to start finding the relevant files quickly.
</li>
<li>
<a href="nbdocs:/org/sleuthkit/autopsy/corecomponents/docs/dataresult-about.html">Result Viewers</a>:
This area is where the files and directories that were found from the explorer window can be viewed.
There are different formatting options for the files.
</li>
<li>
<a href="nbdocs:/org/sleuthkit/autopsy/corecomponents/docs/datacontent-about.html">Content Viewers</a>:
This area is where file content can be viewed after they are selected from the Result Viewer area.
</li>
</ul>
<p>
The main take away from this should be that analysis techniques and result categories can be found on the left-hand side,
the results from choosing something on the left are always listed in the upper right,
and the file contents are displayed in the lower left.
</p>
<img src="Autopsy_overview.png" alt="Autopsy Overview Window" />
</body>
</html>
<!--
Tip: to create a link which will open in an external web browser, try:
<object classid="java:org.netbeans.modules.javahelp.BrowserDisplayer">
<param name="content" value="http://www.netbeans.org/">
<param name="text" value="<html><u>http://www.netbeans.org/</u></html>">
<param name="textFontSize" value="medium">
<param name="textColor" value="blue">
</object>
To create a link to a help set from another module, you need to know the code name base and path, e.g.:
<a href="nbdocs://org.netbeans.modules.usersguide/org/netbeans/modules/usersguide/configure/configure_options.html">Using the Options Window</a>
(This link will behave sanely if that module is disabled or missing.)
-->
\ No newline at end of file
/*
* To change this template, choose Tools | Templates
* and open the template in the editor.
*/
@HelpSetRegistration(helpSet = "casemodule-hs.xml", position = 3000)
package org.sleuthkit.autopsy.casemodule.docs;
import org.netbeans.api.javahelp.HelpSetRegistration;
Core/src/org/sleuthkit/autopsy/core/docs/blue-ball-mid.gif

105 B

Core/src/org/sleuthkit/autopsy/core/docs/blue-sqr-mid.gif

51 B

/*
* rave.css 08/13/2004
*
* Copyright © 1997, 2011, Oracle and/or its affiliates. All rights reserved.
* Use is subject to license terms.
*
* Changes from NetBeans ide.css:
* Oct. 2003
* Got rid of <tr> and <td> definitions.
* Changed table definition and added <border> tag
* to improve appearance of tables in web browsers.
* Added <th> definition to make default text alignment left.
*
* Added <dl>, <dt>, and <dd> definitions to be used instead
* of formatting tables for See Also lists. For example:
* <dl>
* <dt>See Also</dt>
* <dd>First Linked Element of List</dd>
* <dd>Second Linked Element of List</dd>
* </dl>
*
* Added <ul> and <ol> definitions that support blue ball
* and blue square graphics for bullets. Definitions
* account for sublists and for subslists of sublists.
*
*/
/* ===================================================================================================
To add this stylesheet in an Autopsy module's JavaHelp:
<link rel="stylesheet" href="nbdocs:/org/sleuthkit/autopsy/core/docs/ide.css" type="text/css">
=================================================================================================== */
body {font-size: medium;
font-family: SansSerif, Arial, Helvetica, sans-serif;
margin-left: 5;
margin-right: 5;
color: Black;
background-color: White;}
p { font-size: medium;
margin-top: 5;
margin-bottom: 5;
max-width: 960}
h1 { font-size: large;
font-weight: bold;
margin-top: 10;
margin-bottom: 5;}
h2 { font-size: large;
font-weight: bold;
margin-top: 10;
margin-bottom: 5;}
h3 { font-size: medium;
font-weight: bold;
margin-top: 10;
margin-bottom: 5;}
h4 { font-size: medium;
font-weight: bold;
margin-top: 10;
margin-bottom: 5;}
/*
* Use the h6 tag for the term in a glossary popup
* topic. The term being defined is the heading for
* the topic.
*/
h6 { font-size: small;
font-weight: bold;
margin-top: 0;
margin-bottom: 10;}
li {margin-top: 0;
margin-bottom: 5;}
li p{margin-top: 5;
margin-bottom: 0;}
/* Ordered lists */
ul {list-style-image:url(blue-ball-mid.gif);
margin-top: 5;
margin-bottom: 0;
margin-left: 16;
}
ul li ul{list-style-image:url(blue-sqr-mid.gif);}
ul ul{list-style-image:url(blue-sqr-mid.gif);}
/* Numbered lists embedded in ordered lists */
ul li ol{list-style-image:none;
list-style-type: decimal;}
ul li ol li ol{list-style-type: lower-alpha;}
ul li ol ol{list-style-type: lower-alpha;}
ul ol{list-style-image:none;
list-style-type: decimal;}
ul ol li ol{list-style-type: lower-alpha;}
ul ol ol{list-style-type: lower-alpha;}
/* Graphics for notes and warnings */
ul.note {list-style-image:url(tip.gif);
margin-top: 5;
margin-bottom: 0;
margin-left: 16;
}
ul.warning {list-style-image:url(warn.gif);
margin-top: 5;
margin-bottom: 0;
margin-left: 16;
}
/* Numbered lists */
ol {list-style-type: decimal;
margin-top: 5;
margin-bottom: 0;
margin-left: 22;
}
ol li ol{list-style-type: lower-alpha;}
ol ol{list-style-type: lower-alpha;}
/* Ordered lists embedded in Numbered lists */
ol li ul {list-style-image:url(blue-ball-mid.gif);}
ol li ul li ul {list-style-image:url(blue-sqr-mid.gif);}
ol li ul ul {list-style-image:url(blue-sqr-mid.gif);}
ol ul {list-style-image:url(blue-ball-mid.gif);}
ol ul li ul {list-style-image:url(blue-sqr-mid.gif);}
ol ul ul{list-style-image:url(blue-sqr-mid.gif);}
dl {margin-left: 0;
margin-top: 10;
margin-bottom: 5;}
dt {font-size: small;
font-style: normal;
font-weight: bold;
margin-top: 0;
margin-bottom: 0;
text-indent: 0;}
dd {font-size: small;
font-style: normal;
font-weight: normal;
margin-top: 2;
margin-left: 25;}
table {border-style: solid;
border-color: silver;
margin-top: 5;
margin-bottom: 5;}
td {border-style: solid;
border-color: silver;
padding-left: 1;
padding-right: 1;
padding-top: 1;
padding-bottom: 1;}
th {border-style: solid;
border-color: silver;
padding-left: 1;
padding-right: 1;
padding-top: 1;
padding-bottom: 1;}
small {font-size: x-small;}
img {padding: 2;}
Core/src/org/sleuthkit/autopsy/core/docs/tip.gif

817 B

Core/src/org/sleuthkit/autopsy/core/docs/warn.gif

580 B

Core/src/org/sleuthkit/autopsy/corecomponents/docs/ContentViewer_example.png

47.5 KiB

Core/src/org/sleuthkit/autopsy/corecomponents/docs/Hex_Content_Viewer.png

39.7 KiB

Core/src/org/sleuthkit/autopsy/corecomponents/docs/Picture_Content_Viewer.png

48.7 KiB

0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment