General Autopsy Help
The Autopsy Forensic Browser is a graphical interface to command
line forensics tools and standard UNIX utilities. It allows
one to perform file system analysis on UNIX and Windows images.
All images are saved in a directory in the Evidence Locker, which
was specified at install time or at run time. See
Case Management
for more information.
The browser has the following modes:
-
Files:
Allows one to browse the image as a file system and view the contents
of files and directories. This mode even shows deleted file names
and Alternate Data Streams in NTFS images. The user can sort the
files and directories on meta data.
-
Meta Data:
Allows one to analyze the image by examining the meta data structures.
The address of a structure is entered and the details are shown.
This mode is useful for examining unallocated structures and getting
all details about allocated files (including all data units and
other information such as MD5 value).
-
Data Unit:
Allows browsing by block number. This is most useful when used
with searching or meta data browsing. The contents of the block
can be displayed in ASCII, hex dump, or through strings(1).
The meta data structure that has allocated the block will be
displayed (if any) along with the file name (if any).
-
Keyword Search :
Search an image using grep(1) for a given string or regular
expression. The result will be a list of data units that have the
string. Each data unit can be selected to view the contents.
-
Image Details:
List the details about the image. The output of this mode depends
on the file system. Examples of the data include the last mount
time, the last mount location, and a detailed break down of block
group information or File Allocation Table contents.
-
Image Integrity:
The integrity of the file system images can be validated at any
point by selecting this mode. It uses the values in md5.txt to
identify if the image has been modified in the analysis process.
-
File Activity Timelines:
Autopsy can create timelines of file activity based on the Modified,
Access, and Change (Create in FAT/NTFS) times (MAC). The timeline
will contain details about deleted and allocated content. The
resulting timeline can be either viewed within Autopsy or using
other text viewing tools (WARNING: many HTML browsers do not handle
large tables like a timeline very well so using a text editor is
recommended).
-
File Type Categories:
Autopsy can sort the files in an image based on their file type.
For example, all JPEG and GIF files would be identified as images
and all executable files would be identified. This mode will also
ignore files that are found in hash databases of known good files,
identify files that are found in a hash database of known bad files,
and identify files that have an extension that is not consistent
with their file type.
- Report Generation:
Each of the above browsing techniques allows a report to be generated.
This report lists the date, md5 value, investigator, and other
context information in a text format. This can be used for record
keeping when deleted blocks of data have been found.
Brian Carrier