Skip to content
Snippets Groups Projects

Compare revisions

Changes are shown as if the source revision was being merged into the target revision. Learn more about comparing revisions.

Source

Select target project
No results found

Target

Select target project
  • irt/sleuthkit
1 result
Show changes
Showing
with 52 additions and 0 deletions
/*! \page mod_dspage Data Sources, Hosts, and Persons
\section ds_overview Overview
This page outlines some of the core concepts around data sources and how they are organized.
\section ds_ds Data Sources
A org.sleuthkit.datamodel.DataSource represents a set of data that has been added to a case. Examples of data sources include:
- A disk or phone image
- A set of logical files
- A report from another forensics tool
The objects in the case database are generally organized in a tree structure. The data sources are often the set of top-most items in the tree.
You can call org.sleuthkit.datamodel.SleuthkitCase.getDataSources() to get all of data sources in a case. From there you can call getChildren() to go down the tree. For example, you can go from the disk image to volumes, then to file systems, and finally to files and subfolders.
You can add data sources by various SleuthkitCase methods, such as org.sleuthkit.datamodel.SleuthkitCase.makeAddImageProcess().
\section ds_hosts Hosts
All data sources must be associated with a org.sleuthkit.datamodel.Host. A host represents the device that the data source came from. Some hosts will have only a single data source, for example when analyzing a computer with one hard drive. Other hosts may have multiple data sources, for example when analyzing a phone with an image of the handset and another image of a media card.
If you later learn that two data sources are from the same device, you can merge the hosts.
Hosts are managed from org.sleuthkit.datamodel.HostManager.
NOTE: Hosts are different from org.sleuthkit.datamodel.HostAddress. A Host is for devices that were seized and added to the case. A HostAddress is for an address of any external host that was found during the analysis of a data source. For example, a HostAddress for "www.sleuthkit.org" could be created based on web history artifacts.
\section ds_person Persons
You can optionally associate a host with a org.sleuthkit.datamodel.Person. This can allow you to more easily organize data in a large case. The concept is that you have multiple data sources representing different devices that are all owned or used by a given person. You can group that person's data sources together.
Persons are managed from org.sleuthkit.datamodel.PersonManager.
*/
gnore everything in this directory
*
# Except this file
!.gitignore
<hr/>
<p><i>Copyright &#169; 2011-2021 Brian Carrier. (carrier -at- sleuthkit -dot- org)<br/>
This work is licensed under a
<a rel="license" href="http://creativecommons.org/licenses/by-sa/3.0/us/">Creative Commons Attribution-Share Alike 3.0 United States License</a>.
</i></p>
</body>
</html>
bindings/java/doxygen/images/associated_object.png

23 KiB

bindings/java/doxygen/images/json_attribute.png

55.9 KiB

This diff is collapsed.
This diff is collapsed.
This diff is collapsed.
This diff is collapsed.
This diff is collapsed.
/*! \page db_schema_9_0_page TSK & Autopsy Database Schema (Schema version 9.0)
Schema 9.0 is not associated with a released version of Autopsy and is almost the same as schema 9.1.
Please see the \ref db_schema_9_1_page page for all changes from schema 8.6 to schema 9.0.
*/
This diff is collapsed.
This diff is collapsed.
This diff is collapsed.
This diff is collapsed.
-kr -psl -nce -ip2 -nlp -nut
This diff is collapsed.
This diff is collapsed.
This diff is collapsed.
This diff is collapsed.