This page outlines version 9.0 the database that is used by The Sleuth Kit and Autopsy. The goal of this page is to provide short descriptions for each table and column and not focus on foreign key requirements, etc. If you want that level of detail, then refer to the actual schema in addition to this.
This page outlines version 9.0 the database that is used by The Sleuth Kit and Autopsy. The goal of this page is to provide short descriptions for each table and column and not focus on foreign key requirements, etc. If you want that level of detail, then refer to the actual schema in addition to this.
Each Autopsy release is associated with a schema version with a major and minor version number. If a case with an older schema version is opened in a new version of Autopsy, the case will automatically be updated to the current schema. Going the other direction (opening a case that was created with a newer version of Autopsy), two things may happen:
- If the case database has the same major number as the version of Autopsy being used, the case should generally be able to be opened and used.
- If the case database has a higher major number than the version of Autopsy being used, an error will be displayed when attempting to open the case.
You can find a basic graphic of some of the table relationships <a href="https://docs.google.com/drawings/d/1omR_uUAp1fQt720oJ-kk8C48BXmVa3PNjPZCDdT0Tb4/edit?usp#sharing">here</a>
You can find a basic graphic of some of the table relationships <a href="https://docs.google.com/drawings/d/1omR_uUAp1fQt720oJ-kk8C48BXmVa3PNjPZCDdT0Tb4/edit?usp#sharing">here</a>
Some general notes on this schema:
Some general notes on this schema:
- Nearly every type of data is assigned a unique ID, called the Object ID
- Nearly every type of data is assigned a unique ID, called the Object ID
- The objects form a hierarchy, that shows where data came from. A child comes from its parent.
- The objects form a hierarchy, that shows where data came from. A child comes from its parent.
- For example, disk images are the root, with a volume system below it, then a file system, and then files and directories.
- For example, disk images are the root, with a volume system below it, then a file system, and then files and directories.
...
@@ -195,6 +198,18 @@ Methods that can be used to store files on local disks to prevent them from bein
...
@@ -195,6 +198,18 @@ Methods that can be used to store files on local disks to prevent them from bein
- **encoding_type** - ID of method used to store data. See org.sleuthkit.datamodel.TskData.EncodingType enum
- **encoding_type** - ID of method used to store data. See org.sleuthkit.datamodel.TskData.EncodingType enum
- **name** - Display name of technique
- **name** - Display name of technique
## tsk_file_attributes
Extended attributes for a particular file
- **id** - Id of the attribute
- **obj_id** - File this attribute is associated with (references tsk_files)
- **attribute_type_id** - Id for the type of attribute (can be looked up in the blackboard_attribute_types)
- **value_type** - The type of the value (see org.sleuthkit.datamodel.BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE)
- **value_byte** - A blob of binary data (should be NULL unless the value type is byte)
- **value_text** - A string of text (should be NULL unless the value type is string)
- **value_int32** - An integer (should be NULL unless the value type is int)
- **value_int64** - A long integer / timestamp (should be NULL unless the value type is long)
- **value_double** - A double (should be NULL unless the value type is double)
## tsk_files_derived_method
## tsk_files_derived_method
Derived files are those that result from analyzing another file. For example, files that are extracted from a ZIP file will be considered derived. This table keeps track of the derivation techniques that were used to make the derived files.
Derived files are those that result from analyzing another file. For example, files that are extracted from a ZIP file will be considered derived. This table keeps track of the derivation techniques that were used to make the derived files.
...
@@ -222,17 +237,26 @@ The \ref mod_bbpage "Blackboard" is used to store results from analysis modules.
...
@@ -222,17 +237,26 @@ The \ref mod_bbpage "Blackboard" is used to store results from analysis modules.
Stores artifacts associated with objects.
Stores artifacts associated with objects.
- **artifact_id** - Id of the artifact (assigned by the database)
- **artifact_id** - Id of the artifact (assigned by the database)
- **obj_id** - Id of the associated object
- **obj_id** - Id of the associated object
- **artifact_obj_id** - Object id of the artifact
- **artifact_type_id** - Id for the type of artifact (can be looked up in the blackboard_artifact_types table)
- **artifact_type_id** - Id for the type of artifact (can be looked up in the blackboard_artifact_types table)
- **data_source_obj_id** - Id of the data source for the artifact
- **data_source_obj_id** - Id of the data source for the artifact
- **artifact_type_id** - Type of artifact (references artifact_type_id in blackboard_artifact_types)
- **artifact_type_id** - Type of artifact (references artifact_type_id in blackboard_artifact_types)
- **review_status_id** - Review status (references review_status_id in review_statuses)
- **review_status_id** - Review status (references review_status_id in review_statuses)
## tsk_analysis_results
## tsk_analysis_results
TODO
Additional information for analysis results
- **artifact_obj_id** - Object id of the associated artifact (artifact_obj_id column in blackboard_artifacts)
