Overview

This section outlines the internal Autopsy design from the typical analysis work flow perspective. This page is organized based on these phases:

A Case is created.
Images are added to the case and ingest modules are run.
Results are manually reviewed and searched.
Reports are generated.

Creating a Case

The first step in Autopsy work flow is creating a case. This is done in the org.sleuthkit.autopsy.casemodule package (see Overview for details). This module contains the wizards needed and deals with how to store the information. You should not need to do much modifications in this package. But, you will want to use the org.sleuthkit.autopsy.casemodule.Case object to access all data related to this case.

Adding an Image and Running Ingest Modules

After case is created, one or more disk images can be added to the case. There is a wizard to guide that process and it is located in the org.sleuthkit.autopsy.casemodule package. Refer to the package section Add Image Process for more details on the wizard. Most developers will not need to touch this code though. An important concept though is that adding an image to a case means that Autopsy uses The Sleuth Kit to enumerate all of the files in the file system and make a database entry for them in the embedded SQLite or PostgreSQL database that was created for the case. The database will be used for all further analysis.

After image has been added to the case, the user can select one or more ingest modules to be executed on the image. Ingest modules focus on a specific type of analysis task and run in the background. They either analyze the entire disk image or individual files. The user will see the results from the modules in the result tree and in the ingest inbox.

The org.sleuthkit.autopsy.ingest package provides the basic infrastructure for the ingest module management.

If you want to develop a module that analyzes drive data, then this is probably the type of module that you want to build. See Developing Ingest Modules for more details on making an ingest module.

Viewing Results

The UI has three main areas. The tree on the left-hand side, the result viewers in the upper right, and the content viewers in the lower right. Data passes between these areas by encapsulating them in Netbeans Node objects (see org.openide.nodes.Node). These allow Autopsy to generically handle all types of data. The org.sleuthkit.autopsy.datamodel package wraps the generic org.sleuthkit.datamodel Sleuth Kit objects as Netbeans Nodes.

Nodes are modelled in a parent-child hierarchy with other nodes. All data within a Case is represented in a hierarchy with the disk images being one level below the case and volumes and such below the image.

The tree on the left hand-side shows the analysis results. Its contents are populated from the central database. This is where you can browse the file system contents and see the results from the blackboard.

The tree is implemented in the org.sleuthkit.autopsy.directorytree package.

The area in the upper right is the result viewer area. When a node is selected from the tree, the node and its children are sent to this area. This area is used to view a set of nodes. The viewer is itself a framework with modules that display the data in different layouts. For example, the standard version comes with a table viewer and a thumbnail viewer. Refer to Developing Result Viewer Modules for details on building a data result module.

When an item is selected from the result viewer area, it is passed to the bottom right content viewers. It too is a framework with many modules that know how to show information about a specific file in different ways. For example, there are viewers that show the data in a hex dump format, extract the strings, and display pictures and movies. See Developing Content Viewer Modules for details on building new content viewers.

Report generation

When ingest is complete, the user can generate reports. There is a reporting framework to enable many different formats. Autopsy currently comes with generic html, xml and Excel reports. See the org.sleuthkit.autopsy.report package for details on the framework and Developing Report Modules for details on building a new report module.