Autopsy User Documentation  4.21.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
Personas

Table of Contents

Overview

Autopsy can store and organize account information based on personas, which represent an online identity. A person may have several online identities and therefore several personas. As an example, a single person may have a set of accounts that post online about loving cats and another set of accounts that appear unrelated that post about hating cats.

Concepts

Here are some basic concepts about persona:

Personas are stored in the Central Repository based on accounts that were found in results. These results are generated by various ingest modules such as the Recent Activity Module and Android Analyzer Module.

Autopsy provides a dedicated tool, the Personas Editor, to create, view, edit, and delete personas.

Personas Editor

The Personas Editor is loaded through the Tools -> Personas menu item.

The left panel in the Personas Editor is a table that lists personas, based on the selected criteria. The right panel displays the details of the persona currently selected in the left panel.

By default, when the Personas Editor is launched, all the personas in the Central Repository are listed in the table. You may filter this list by checking the "Filter personas by Keyword" checkbox. Type in either a persona name or an account identifier in the textbox and select the "Name" or "Account" radio button appropriately. Then click the "Show" button to show only the personas that match the filtering criteria.

personas_main.png

Create Personas

To create a new persona, click the "New Persona" button. A "Create Persona" dialog box will pop up. The following is a description of each field:

Each persona needs at least one account associated with it. These accounts must have been previously saved to the central repository. Clicking "Add" under "Accounts" will bring up another dialog with four fields, all required:

personas_create.png

When finished adding at least one account and filling in the required fields, click on OK to create the persona. A persona with the specified name will be created and associated with the specified account(s).

Edit Personas

To edit a persona, click the "Edit Persona" button. You'll be able to edit all the data about the persona.

persona_edit.png

Delete Personas

To delete a persona, select the persona in the table and click on the "Delete Persona" button. Click "Yes" on confirmation dialog to delete the selected persona.

Create Account

All personas must be associated with at least one account. Normally these account will be added to the central repository by various ingest modules, but you can also create them manually with the "Create Account" button.

personas_create_account.png

Persona integration in Content Viewers

Autopsy shows personas associated with accounts, where applicable. When viewing contact, call log and message results, Autopsy shows the personas associated with accounts in these panels. If no persona exists for an account, Autopsy provides a button for the user to create one.

As shown below, when viewing a contact result you may see persona data. When one or more personas are found associated with the accounts in the result then the Persona name is shown in the contact content viewer. There will be a "View" button to see the details of the persona.

personas_contact_found.png

If no matching persona is found, a "Create" button is shown to create a persona for the account(s). This will bring you to the Create Personas panel with the account(s) already added, assuming the accounts exist in the central repository. If the desired account does not appear, close the personas panel and then copy the account to the clipboard either by highlighting the account and hitting control+c or by right clicking on it and selecting copy. Next go to Tools->Personas to open the Personas Editor, and click "Create Account". Paste in the account and select the type, then OK. Now close the editor and click "Create" again. The account should now be auto-populated.

personas_contact_not_found.png

Personas are integrated similarly in the content viewers for call logs and messages/e-mail.

personas_calllog.png


personas_message.png

Persona Integration in the Communications Visualization Tool

Personas are integrated with the Communications Visualization Tool. When viewing accounts in the Accounts browsers in the Communications Visualization Tool, associated persona information is shown in the tooltip if you hover over the account.

personas_cvt_hover.png

As in the Autopsy main window, you may also create or view personas when examining contacts, call logs, and messages in the Communications Visualization Tool.

personas_cvt_accounts.png

Copyright © 2012-2023 BasisTech. Generated on Tue Feb 6 2024
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.