Autopsy User Documentation  4.10.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
Result Viewer

The Result Viewer is located on the top right of the Autopsy screen. It shows lists of files and their corresponding attributes such as time, path, size, checksum, etc.


By default, the first three columns after the file name in the results viewer are named "S", "C" and "O".


These columns display the following:

To display more information about why an icon has appeared, you can hover over it. The Comment and Other occurrences columns query the Central Repository. If this seems to be having a performance impact, it can be disabled through the View Options. This will remove the Other occurrences column entirely and the Comment column will be based only on tags.

You can also switch it to Thumbnail view to see thumbnails of the content in the selected folder.


The Result Viewer is context-aware, meaning it will show applicable columns for the data type selected.


Copyright © 2012-2019 Basis Technology. Generated on Fri Mar 22 2019
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.