Case Management
Overview
Autopsy organizes images based on the case and host that they came
from. A case contains one or more hosts (a new case should be
created for each investigation). Each host can contain one or more
images, which correspond to partitions on the host.
Creating a New Case
From the Main Menu (at startup) select New Case. You will have
to enter the case name and an optional short description. The case
name must be a valid directory name (no spaces - no symbols). A
list of investigators will also be requested. These will be used
for the audit logs, not for authentication. A directory with the
same name as the case will be
created in the Evidence Locker. To later rename the case, simply
rename the directory.
Adding a New Host
A Host must then be created in the Case. Select the Case that was
just created from the Case Gallery and enter the Host Gallery.
Select Add Host and enter the host name, a short description,
and time information such as time zone and clock skew. The clock
skew is how many seconds the system was off from a synchronized
clock. Adding a host will create a directory in the case directory
and subdirectories in the host for the images, output data, logs,
and reports.
You can optionally add the path to hash databases.
Adding a New Image
Next, images must be added to the host. Select the host that was
just added from the Host Gallery and enter the Host Manager. Select
Add Image and a new form is shown. The first text box in
the form is for the path of the file system image. Type that in,
or cut and paste it. The images will have to be located in the
images directory of the host directory. You are given a
choice to either create a symbolic link from the current location
to the host directory, to copy the file from its current location
to the host directory, or to move the file from its current location
to the host directory. Select the desired import method. The
file system type must be selected from the pull down list and the
mounting point entered. A sanity check will be performed on the
image and file system type before it is imported. The mounting
point is only for cosmetic purposes only and will have no impact
on how the image is processed. By default, an MD5 value will be
calculated for the image when it is imported. If it is already
known, then enter it in the field.
MD5 Values
Each directory in a host has an md5.txt file that contains
the MD5 value for files in that directory. Autopsy uses that file
to validate the integrity of files. By default, when a file is
imported into Autopsy, its MD5 will be calculated. If it is already
known, then it can be entered in the 'Add Images' window.
Host Subdirectories
Each host has an images directory and an output
directory. All data generated by Autopsy is saved to the output
directory. The theory behind this design, was to allow the images
directory to have strict permissions to prevent accidently modifying
the images. Therefore, the images directory can have its write
bits removed to prevent modifications.
Brian Carrier