28. Introduction to Digital Forensics
28.5 Autopsy and The Sleuth Kit
The Sleuth Kit (TSK) is a set of command-line forensic tools; Autopsy is its graphical front-end (both ship with Kali). They open a disk image and let you browse files, recover deleted ones, view timelines and search.
autopsy # start the GUI (older Kali) ; newer versions: a desktop app
# some Sleuth Kit CLI tools:
mmls evidence.dd # show the partition layout
fls -r -m / evidence.dd # list files (including deleted) as a timeline
icat evidence.dd 12345 # extract a file by its inode number
In Autopsy you create a case, add the disk image as a data source, and it automatically: lists files and deleted files, extracts pictures, web history, and documents, builds a timeline, and lets you keyword-search. You tag findings and generate a report.
Ravindra Bagale's Tip
Autopsy madhe nehmi navin "Case" banva ani case number + tumcha naav liha – professional savay. Ani image add kartana "hash verify" option theva; tech purava atut aahe he siddha karte. Tool sope aahe, pan process shist magto.
Lab
Open your USB image from 28.4 in Autopsy as a new case. Recover at least one deleted file, look at the file timeline, and generate a report. In your notes, write the steps you took (this is your chain-of-custody practice).