Tagging

Tagging (or Bookmarking) allows you to create a reference to a file or object and easily find it later.

When an interesting item is discovered, the user can tag it by right-clicking the item and selecting one of the tag options.

When you tag a Blackboard artifact result, you have the choice to either:

• Tag File – use this when the file itself is of interest
• Tag Result – use this when the result is of interest

Which to choose depends upon the context and what you desire in the final report.

Once you have chosen to tag the file or the result, there are two more options:

• Quick Tag – use this if you just want the tag
• Tag and Comment – use this if you need to add a comment about this tag

You can create arbitrary tag names. Autopsy remembers your tag names from previous cases, so choose wisely. Choose a tag from the list you have created, or create a "New Tag".

If you just want to tag the item with the default "Bookmark" tag, you can also use the keyboard shortcut control+B instead of going through the menus.

You can also apply tags to groups of items at once. Select multiple items in the Blackboard, right click, and add the appropriate tag. Items may have more than one tag.

Tagged results are shown in the "Results" portion of the tree under "Tags". Tagged items are also highlighted in the Results Viewer.

The list of tags can be edited through the Tags tab on the Options menu.