Custom Filtering in A3

Any Autopsy specific discussions, events, module releases, that don't fall into the other categories.

Moderator: carrier

Custom Filtering in A3

Postby Hoyt » Thu Mar 26, 2015 11:55 am

I've likely missed this somewhere and I've searched this forum and our other documentation without finding the answer, but I'm wondering if there's a way currently to selectively filter items out of view? We can filter NSRL or other ignorable known items for which we have hash signatures during ingest. Is there an ability to do something similar on the fly, say to filter current bookmarks out of view during analysis?

We work a lot with cases involving large numbers of picture files - tens of thousands often times. Once I have the results from any known hash searches, I like to bookmark those, then filter them out of view to concentrate on the remaining unknowns. This is all in an effort to reduce data as the case progresses. FTK allows me to do this and it's become a standard part of my workflow. I haven't yet figured out how to do it with Autopsy.

Thanks in advance and sorry if this has been addressed before.
Hoyt Harness, CFCE
Hoyt
 
Posts: 74
Joined: Thu Dec 11, 2014 4:02 am
Location: Little Rock, AR

Re: Custom Filtering in A3

Postby carrier » Thu Jun 04, 2015 6:59 pm

You can choose to hide known items from the table view by going to options -> Autopsy. You can choose to hide known files in the "Data Sources" or "Views" area.

We don't have finer grained filtering yet though. Are you looking for a feature that allows you to hide tagged items from the view?
carrier
 
Posts: 45
Joined: Thu May 15, 2014 3:31 pm

Re: Custom Filtering in A3

Postby Hoyt » Mon Jun 15, 2015 3:18 am

That's exactly what I'm looking for. I have an idea to try once I understand NetBeans development better and exactly which/how the underlying TSK tools or other tools come into play regarding those viewable areas. If I can come up with something and actually get it to work in my clone, I'll send a pull request to see what you think.
Hoyt Harness, CFCE
Hoyt
 
Posts: 74
Joined: Thu Dec 11, 2014 4:02 am
Location: Little Rock, AR


Return to Autopsy General

Who is online

Users browsing this forum: No registered users and 2 guests