Overview
The major areas in the Autopsy User Interface (UI) are:
- Tree Viewer, shown in green on the left side
- Result Viewer, shown in blue on the upper right side
- Content Viewer, shown in red on the lower right side
- Keyword Search, shown in magenta in the upper right corner
- Status Area, shown in purple in the lower right corner
You can customize how data is shown in the UI through the View Options panel.
Tree Viewer
The Tree Viewer on the left-hand side is the top level of the UI. Selecting items in the Tree Viewer will cause their contents to be displayed in the Result Viewer to the right. You can browse the files in the image, find saved results generated by the ingest modules, and see the results from Tagging and Reporting. See the Tree Viewer page for additional information.
Result Viewer
The Result Viewer windows are in the upper right area of the interface and display the results from selecting something in the Tree Viewer. The columns displayed will depend on what was selected in the Tree Viewer - files will show things like path, size, and creation date while a contact would show its name, phone number, and email. Selecting an item in the Result Viewer will show details about the item in the Content Viewer below. See the Result Viewer for additional information.
Content Viewer
The Content Viewer area is in the lower right area of the interface. This area is used to view a specific file in a variety of formats. There are different tabs for different viewers. Not all tabs support all file types, so only some of them will be enabled. To display data in this area, a file must be selected from the Result Viewer window.
The Content Viewer area is part of a plug-in framework, meaning you can install modules that will add more viewer types.
For additional information see the Content Viewer page.
Keyword Search
The Keyword Search feature allows the user to search for keywords in one or more data sources contained in the current case. It is covered in more detail here: Keyword Search Module
Status Area
The Status area will show progress bars while ingest is occurring. This visually indicates what portion of the processing is already complete. You can click on the progress bars to see further detail or to cancel ingest jobs.