28. Introduction to Digital Forensics
28.5 Autopsy and The Sleuth Kit
In short: The Sleuth Kit (TSK) is a set of command-line forensic tools; Autopsy is its graphical front-end (both ship with Kali).
The Sleuth Kit (TSK) is a set of command-line forensic tools; Autopsy is its graphical front-end (both ship with Kali). They open a disk image and let you browse files, recover deleted ones, view timelines and search.
autopsy # start the GUI (older Kali) ; newer versions: a desktop app
# some Sleuth Kit CLI tools:
mmls evidence.dd # show the partition layout
fls -r -m / evidence.dd # list files (including deleted) as a timeline
icat evidence.dd 12345 # extract a file by its inode number
In Autopsy you create a case, add the disk image as a data source, and it automatically: lists files and deleted files, extracts pictures, web history, and documents, builds a timeline, and lets you keyword-search. You tag findings and generate a report.
Ravindra Bagale's Tip
In Autopsy, always create a new "Case" and enter the case number and your name – a professional habit. And when adding the image, keep the "hash verify" option on; it proves the evidence is intact. The tool is easy, but the process demands discipline.
Ravindra Bagale's Tip – मराठी
Autopsy मध्ये नेहमी नवीन "Case" बनवा आणि case number + तुमचे नाव लिहा – professional सवय. आणि image add करताना "hash verify" option ठेवा; तेच पुरावा अबाधित आहे हे सिद्ध करते. Tool सोपे आहे, पण process शिस्त मागते.
Ravindra Bagale's Tip – हिंदी
Autopsy में हमेशा नया "Case" बनाओ और case number + अपना नाम लिखो – professional आदत. और image add करते समय "hash verify" option रखो; वही साबित करता है कि सबूत सुरक्षित है. Tool आसान है, पर process अनुशासन माँगता है.
Lab
Open your USB image from 28.4 in Autopsy as a new case. Recover at least one deleted file, look at the file timeline, and generate a report. In your notes, write the steps you took (this is your chain-of-custody practice).