diff --git a/framework/docs/basics.dox b/framework/docs/basics.dox index ec8b2b5071ff932252153bedba85a06cda01fa80..bdfdef0c515fa7c472120b8fd0d9e5c2bfaf1abb 100644 --- a/framework/docs/basics.dox +++ b/framework/docs/basics.dox @@ -2,11 +2,11 @@ <h3>Basic Concepts</h3> <ul> - <li><b>Central Database:</b> All data is stored in a central database, which can be as simple as a local SQLite file or as complex as a database managed by a database server. The details are hidden from the modules because the TskImgDB class is used to store and retrieve data.</li> + <li><b>Central Database:</b> All data is stored in a central database, which can be as simple as a local SQLite file or as complex as a database managed by a database server. The details are hidden from the modules because the TskImgDB class is used to store and retrieve data from the central database.</li> <li><b>Services:</b> There are core services that the framework provides to the programs that incorporate the framework and to the modules that fit into the framework. See \ref mod_stuff_services for more details.</li> - <li><b>Pipelines and Plug-in Modules:</b> The framework provides a pipeline infrastructure that modules can be dropped into. The framework comes with basic modules, but it is expected that other developers will provide modules that can be used. See \ref pipeline_config_page and \ref mod_devpage to learn how to build pipelines and modules.</li> + <li><b>Pipelines and Plug-In Modules:</b> The framework provides a pipeline infrastructure that modules can be dropped into. The framework comes with basic modules, but it is expected that other developers will provide modules that can be used. See \ref pipeline_config_page and \ref mod_devpage to learn how to build pipelines and modules.</li> <li><b>Blackboard:</b> The framework uses a blackboard to allow modules to communicate. Modules can post results to the blackboard and other modules can query the blackboard for previous findings. See \ref mod_bbpage for more details. </li> diff --git a/framework/docs/img_db_schema_v1_5.dox b/framework/docs/img_db_schema_v1_5.dox index 99bedc6999060e8f6b6ef2b19e2cb4a307d70519..970edd1f04a3bbb7679a0ef18da20f2661507d6a 100755 --- a/framework/docs/img_db_schema_v1_5.dox +++ b/framework/docs/img_db_schema_v1_5.dox @@ -5,7 +5,7 @@ \subsection db_info_table db_info Contains metadata about the software that produced the image database. - <i>name</i> - Name of the software, e.g., DBSchema, Sleuth Kit, etc. (TEXT) -- <i>version</i> - Version of the software, e.g., 1.5, 4.0.0b1, etc. (TEXT) +- <i>version</i> - Version of the software, e.g., 1.5, 4.0.0, etc. (TEXT) \subsection modules_table modules Contains one row for each module used to produce the image database. diff --git a/framework/docs/main.dox b/framework/docs/main.dox index f96c054a16a08309c300e5b6a2171ac9a58c358a..0abf93fb870b9f63660e0187adbe1f068695ff63 100644 --- a/framework/docs/main.dox +++ b/framework/docs/main.dox @@ -1,7 +1,10 @@ /*! \mainpage The Sleuth Kit (TSK) Framework User's Guide and API Reference <h3>Overview</h3> - The framework in TSK makes it easier to build automated, end-to-end digital forensics applications. It's plug-in pipelines allow you to incorporate a variety of analysis techniques. The framework was designed to be used in a distributed environment so that jobs could be scheduled among a cluster of computers, but it can also be used in a simple desktop environment. The tsk_analyzeimg program is an example of a desktop program that uses the framework. + The framework in TSK makes it easier to build automated, end-to-end digital forensics applications. + It's plug-in pipelines allow you to incorporate a variety of analysis techniques. + The framework was designed to be used in a distributed environment so that jobs could be scheduled among a cluster of computers, but it can also be used in a simple desktop environment. + The tsk_analyzeimg program provided with the Sleuth Kit is an example of a desktop program that uses the framework. If you need only volume and file system-level support, then the original Sleuth Kit library may be all you need. If you want an end-to-end solution though, then the framework will help solve your problems. @@ -25,7 +28,7 @@ The following pages are relevant when developing modules to be used in the frame <h3>Developers Guide to Using the Framework</h3> -The following pages are relevant when integrating the framework into an existing application. +The following pages are relevant when integrating the framework into a new or existing application. - \subpage fw_setup_page - \subpage fw_extract_page - \subpage fw_pipeline_page diff --git a/framework/docs/module_blackboard.dox b/framework/docs/module_blackboard.dox index a1c9e9bcd75171ef1c911e0df4eb3649b08f417a..ffd1e1a8b366f77198c33d6d3f63e568d0911384 100644 --- a/framework/docs/module_blackboard.dox +++ b/framework/docs/module_blackboard.dox @@ -112,7 +112,7 @@ The artifacts are added to the underlying database as soon as it is created and \section bb_query Querying the Blackboard There are a variety of get methods in TskFile that allow you to get artifacts and attributes for a given file (TskFile.getArtifacts() for example). There are also methods in TskBlackboard that allow you to get artifacts and attributes across all files (TskBlackboard.getArtifacts for example). -TODO: ADD MORE HERE. +<!--TODO: ADD MORE HERE.--> */ diff --git a/framework/docs/pipeline.dox b/framework/docs/pipeline.dox index 972a14542394849503ada44ca558d9fb059ef8c4..5872167324401072b68fb8cdb3936a0e361ddc05 100755 --- a/framework/docs/pipeline.dox +++ b/framework/docs/pipeline.dox @@ -8,7 +8,7 @@ Modules can communicate with each other, so the MD5 hash could be passed from th Pipelines are configured using an XML file, which is described later. -\section pipe_types File Analysis vs. Post-processing Pipelines +\section pipe_types File Analysis vs. Post-Processing Pipelines The framework currently supports two types of pipelines: file analysis pipelines and post-processing pipelines. Each type of pipeline is used in a different context. @@ -25,7 +25,7 @@ Second, a post-processing module is a more efficient mechanism for analyzing a s For example, if you need a Windows registry analysis module, it would be better to develop it as a post-processing module that simply locates the handful of registry hive files in an image and analyzes them. If the registry analysis module was instead developed as a file analysis module, it would be run for every file in the image and most of the time it would decide to ignore the file because it wasn't a registry hive. -\section pipe_modtypes Plug-in vs. Executable Modules +\section pipe_modtypes Plug-In vs. Executable Modules There are two major types of modules that can exist in either type of pipeline. One is a dynamic linked library (DLL) or plug-in module and the other is an executable (EXE) module. Plug-in modules are programmed specifically for inclusion into the framework. These modules can access all of the framework resources. What's required to create one of these modules is described in \ref mod_devpage.