You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Content viewer modules are located in the lower right of Autopsy and in other panels (such as timeline). They allow the user to view or analyze a specific file in different ways.
Data source processor modules are used to add data sources to a case. They are responsible for parsing input data and populating the database with files (or other items) so that ingest modules and other modules can analyze them.
Ingest modules analyze data sources in pipelines. They can run in parallel and all files in the data source will typically be analyzed by them (unless there are ingest filters in place for triage situations).
4
+
5
+
This is the most common extension point in Autopsy and modules can be written in either Java or Python.
6
+
7
+
These modules will analyze the content for differnet things and then post their results to the backend database so that they can be seen to the user. These modules do not have a user interface except for configuration.
Report modules are typically run at the end of an investigation to produce an output report. The extension point is also used as a place to manually start analysis techniques.
0 commit comments