Ravindra BagaleCourses & study guides

28. Introduction to Digital Forensics

28.5 Autopsy and The Sleuth Kit

In short: The Sleuth Kit (TSK) is a set of command-line forensic tools; Autopsy is its graphical front-end (both ship with Kali).

The Sleuth Kit (TSK) is a set of command-line forensic tools; Autopsy is its graphical front-end (both ship with Kali). They open a disk image and let you browse files, recover deleted ones, view timelines and search.

autopsy        # start the GUI (older Kali) ; newer versions: a desktop app
# some Sleuth Kit CLI tools:
mmls evidence.dd            # show the partition layout
fls -r -m / evidence.dd     # list files (including deleted) as a timeline
icat evidence.dd 12345      # extract a file by its inode number

In Autopsy you create a case, add the disk image as a data source, and it automatically: lists files and deleted files, extracts pictures, web history, and documents, builds a timeline, and lets you keyword-search. You tag findings and generate a report.

Ravindra Bagale's Tip

In Autopsy, always create a new "Case" and enter the case number and your name – a professional habit. And when adding the image, keep the "hash verify" option on; it proves the evidence is intact. The tool is easy, but the process demands discipline.

Lab

Open your USB image from 28.4 in Autopsy as a new case. Recover at least one deleted file, look at the file timeline, and generate a report. In your notes, write the steps you took (this is your chain-of-custody practice).