Autopsy User Documentation  4.19.3
Graphical digital forensics platform for The Sleuth Kit and other tools.
Hosts

Table of Contents

Using Hosts

Associating a Data Source With a Host

Every data source must be associated with a host. The first step in the add data source process is to select a host for the data source you are about to add to the case. This host can be auto-generated, entered by the user, or selected from the list of hosts already present in the case.

data_source_host_select.png

Viewing Hosts

Hosts are displayed in the Tree Viewer. Depending on the View Options selected, hosts may be grouped together under persons.

ui_tree_top_ds.png

OS Accounts

OS accounts can be viewed in the OS Accounts node of the tree viewer. Each OS account is associated with a host, and the host information is displayed in the OS Account tab of the content viewer.

host_os_accounts.png

Managing Hosts

Manage Hosts Menu

Go to Case->Manage Hosts to open the host management panel.

manage_hosts.png

Here you can see all hosts in the case, add new hosts, change the name of an existing host, and delete hosts that are not in use.

Merging Hosts

Over the course of processing a case, it may become clear that two (or more) hosts should be combined. Merging one host into another will move all data sources from the source host into the destination host and move or combine any OS accounts found.

To merge hosts, right-click on the host you want to merge into another host.

host_merge.png

A confirmation dialog will display stating that this can not be undone. After proceeding, the hosts will be merged together and the tree viewer node will update showing the combined data.

host_merge_result.png

Copyright © 2012-2022 Basis Technology. Generated on Tue Jun 27 2023
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.