Autopsy User Documentation  4.9.1
Graphical digital forensics platform for The Sleuth Kit and other tools.
Result Viewer

The Result Viewer is located on the top right of the Autopsy screen. It shows lists of files and their corresponding attributes such as time, path, size, checksum, etc.


result-viewer-example-1.PNG


By default, the first three columns after the file name in the results viewer are named "S", "C" and "O".

view_options_sco.png

These columns display the following:

To display more information about why an icon has appeared, you can hover over it. The Comment and Other occurrences columns query the Central Repository. If this seems to be having a performance impact, it can be disabled through the View Options. This will remove the Other occurrences column entirely and the Comment column will be based only on tags.

You can also switch it to Thumbnail view to see thumbnails of the content in the selected folder.


result-viewer-example-2.PNG


The Result Viewer is context-aware, meaning it will show applicable columns for the data type selected.

result-viewer-example-3.PNG



Copyright © 2012-2018 Basis Technology. Generated on Tue Dec 18 2018
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.