Autopsy User Documentation  4.5.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
Tagging

Tagging (or Bookmarking) allows you to create a reference to a file or object and easily find it later. Tagging is also used by the central repository to mark items as notable.

When an interesting item is discovered, the user can tag it by right-clicking the item and selecting one of the tag options.

When you tag a Blackboard artifact result, you have the choice to either:

Which to choose depends upon the context and what you desire in the final report.

tagging-1.PNG

Once you have chosen to tag the file or the result, there are two more options:

tagging-2.PNG


There are several default tag names:

You can also create custom tag names. These tag names will be automatically saved for future use. Choose a tag from the list you have created, or create a "New Tag".

tagging-3.PNG

If you just want to tag the item with the default "Bookmark" tag, you can also use the keyboard shortcut control+B instead of going through the menus.

You can also apply tags to groups of items at once. Select multiple items in the Blackboard, right click, and add the appropriate tag. Items may have more than one tag.

Tagged results are shown in the "Results" portion of the tree under "Tags". Tagged items are also highlighted in the Results Viewer.


tagging-4.PNG


The list of tags can be edited through the Tags tab on the Options menu.

tagging-5.PNG


From here, new tags can be added, existing tags can be edited, and user-created tags can be deleted. Note that deleting a tag does not remove it from any tagged items, and that tag will still be usable in any case where it has been used to tag an item.

tagging-6.PNG


If using the central repository, changing the notable status will effect tagged items in the current case only in the following way:


Copyright © 2012-2016 Basis Technology. Generated on Tue Feb 20 2018
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.