Autopsy User Documentation  4.9.1
Graphical digital forensics platform for The Sleuth Kit and other tools.
Communications Visualization Tool

Overview

The Communications Visualization Tool gives a consolidated view of all communication events for the case. This allows an analyst to quickly view communications data such as:

Usage

The Communications Visualization Tool is loaded through the Tools->Communications menu item.

cvt_main.png

From the left hand column, you can choose which devices to display, which types of data to display, and optionally select a time range. After any changes to the filters, use the Apply button to update the tables.

The middle column displays each account, its device and type, and the number of associated messages (emails, call logs, etc.). By default it will be sorted in descending order of frequency.

Selecting an account in the middle column will bring up the messages for that account in the right hand column. Here data about each message is displayed in the top section, and the messages itself can be seen in the bottom section (if applicable).

cvt_messages.png

The middle column and the right hand column both have a UI Quick Search feature which can be used to quickly find a visible item in their section's table.

Visualization

The Visualize tab in the middle panel will show a graph of one or more accounts selected in the Browse tab.

To start, right click the first account you want to view.

cvt_select_account.png

There are two options, which are equivalent when no accounts have previously been selected:

After selecting either option, the middle tab will switch to the Visualize view and the graph will be displayed.

cvt_visualize.png

The options at the top allow you to clear the graph, try different graph layouts, and resize the graph. The nodes in the graph can be dragged around and nodes and edges can be selected to display their messages or relationships in the right side tab. For example, in the image below the link between two email addresses has been selected so the Messages viewer is displaying the single email between those two email addresses.

cvt_links.png

Copyright © 2012-2018 Basis Technology. Generated on Tue Dec 18 2018
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.