Autopsy User Documentation  4.11.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
Tagging

Tagging (or Bookmarking) allows you to create a reference to a file or object and easily find it later. Tagging is also used by the central repository to mark items as notable.

Tagging items

When an interesting item is discovered, the user can tag it by right-clicking the item and selecting one of the tag options.

When you tag a Blackboard artifact result, you have the choice to either:

Which to choose depends upon the context and what you desire in the final report.

tagging-1.PNG

At this point there are three options:

tagging-2.PNG
tagging_new_tag.png

There are several default tag names:

You can also create custom tag names. These tag names will be automatically saved for future use and will be displayed above the default tag names.

If you just want to tag the item with the default "Bookmark" tag, you can also use the keyboard shortcut control+B instead of going through the menus.

You can also apply tags to groups of items at once. Select multiple items in the Blackboard, right click, and add the appropriate tag. Items may have more than one tag.

Tagged results are shown in the "Results" portion of the tree under "Tags". Tagged items are also highlighted in the Results Viewer.

tagging-4.PNG

Managing tags

The list of tags can be edited through the Tags tab on the Options menu.

tagging-5.PNG

From here, new tags can be added, existing tags can be edited, and user-created tags can be deleted. Note that deleting a tag does not remove it from any tagged items, and that tag will still be usable in any case where it has been used to tag an item.

tagging-6.PNG

If using the central repository, changing the notable status will effect tagged items in the current case only in the following way:

Hiding tags from other users

Tags are associated with the account name of the user that tagged them. This information is visible through selecting items under the "Tags" section of the directory tree:

tagging_user_name.png

or through the Annotations content viewer:

content_viewer_annotations.png

It is possible to hide all tagged files and results in the "Tags" area of the tree that were tagged by other users. Open the View Options menu either through the gear icon above the directory tree or through Tools->Options, and then select the checkbox to hide other users' tags in the tags area of the tree.

tagging_view_options.png

Copyright © 2012-2019 Basis Technology. Generated on Fri Jun 21 2019
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.