Autopsy is the premier open source forensics platform which is fast, easy-to-use, and capable of analysing all types of mobile devices and digital media. Its plug-in architecture enables extensibility from community-developed or custom-built modules. Autopsy evolves to meet the needs of hundreds of thousands of professionals in law enforcement, national security, litigation support, and corporate investigation.

Basic workflow:

  1. Create/open the case for the data source you will investigate
    • Case Name: The name you wish to give to the case
    • Base Directory: The root directory that will store all the files specific to the case (the full path will be displayed)
    • Case Type: Specify whether this case will be local (Single-user) or hosted on a server where multiple analysts can review (Multi-user)
  2. Select the data source you wish to analyze
    1. Supported Disk Image Formats:
      • Raw Single (For example: *.img, *.dd, *.raw, *.bin)
      • Raw Split (For example: *.001, *.002, *.aa, *.ab, etc)
      • EnCase (For example: *.e01, *.e02, etc)
      • Virtual Machines (For example: *.vmdk, *.vhd)
  3. Configure the ingest modules to extract specific artifacts from the data source
    1. Ingest module are basically Autopsy plugins, designed to analyze and retrieve specific data from the drive
    2. The Interesting Files Identifier module shows E-Mail Messages, Interesting Items, and Accounts, for example.
  4. Review the artifacts extracted by the ingest modules
  5. Create the report

The User Interface

The Tree Viewer has five top-level nodes:

  • Data Sources - all the data will be organized as you would typically see it in a normal Windows File Explorer. 
  • Views - files will be organized based on file types, MIME types, file size, etc. 
  • Results - as mentioned earlier, this is where the results from Ingest Modules will appear. 
  • Tags - will display files and/or results that have been tagged (read more about tagging here).
  • Reports - will display reports either generated by modules or the analyst (read more about reporting here).

When a volume, file, folder, etc., is selected from the Tree Viewer, additional information about the selected item is displayed in the Result Viewer which three tabs: Table, Thumbnail, and Summary.

In the Views tree node, files are categorized by File Types - By Extension, By MIME Type, Deleted Files, and By File Size.

  • Tip: When it comes to File Types, pay attention to this section. An adversary can rename a file with a misleading file extension. So the file will be ‘miscategorized’ By Extension but will be categorized appropriately by MIME Type.

From the Table tab in the Result Viewer, if you click any folder/file, additional information is displayed in the Contents Viewer pane.

  • Three columns might not be quickly understood what they represent.
    • S = Score - Shows a red exclamation point for a folder/file marked/tagged as notable and a yellow triangle pointing downward for a folder/file marked/tagged as suspicious.
    • C = Comment
    • O = Occurrence

Keyword Search - You know

Status Area - When Ingest Modules run, a progress bar (along with the percentage completed) will be displayed in this area.

The Data Sources Summary provides summarized info in nine different categories.

Generate Report - Note that reports don’t have additional search options, so you must manually find artifacts for the event of interest.

Additional Tools

The Timeline tool is composed of three areas:

  1. Filters: Narrow the events displayed based on the filter criteria
  2. Events: The events are displayed here based on the View Mode
  3. Files/Contents: Additional information on the event(s) is displayed in this area

There are three view modes:

  1. Counts: The number of events is displayed in a bar chart view
  2. Details: Information on events is displayed, but they are clustered and collapsed, so the UI is not overloaded
  3. List: The events are displayed in a table view

Please refer to the Autopsy documentation for the following visualisation tool: