How to Forensically Analyze a Disk Using Autopsy?

If you are working as an incident responder, security analyst, or forensic investigator, then most of the time, you will be busy investigating a cyber incident or cybercrime. You may be involved in a lot of nitty-gritty stuff that is broadly called digital forensics. Well, digital forensics is a very broad term that encompasses file analysis, memory forensics, reverse engineering, dump analysis, disc analysis, and so forth. It is not possible to cover all of them in a single post. We have decided to dedicate this post to disc forensics since Digital forensics and incident response (DFIR) investigations rely heavily on disk forensics to uncover valuable evidence.

Disk forensics is the process of extracting forensic information from storage mediums like hard drives, USB devices, and firmware. It plays a crucial role in digital forensics and incident response (DFIR) investigations by uncovering valuable artifacts left behind by attackers or criminal activity.  There are several premium and open-source tools available to perform disc forensics. However, we are covering one such most powerful open-source tool in this post called, Autopsy from Basis Technology, which is trusted by enterprises and law enforcement worldwide.

In this comprehensive guide, we will look into digital forensic analysis, what is Autopsy, what are its features of it,  and finally, learn how to forensically analyze a disk using Autopsy. Let’s begin this post with an introduction to disc forensics.

What is Digital Forensics?

Digital forensics is the process of collecting, analyzing, and preserving digital evidence to investigate and solve crimes or security incidents. It involves the examination of electronic devices, networks, and digital media to uncover relevant information and establish a clear understanding of digital events. The goal is to provide accurate and admissible evidence that can be used in legal proceedings.

What is Disc Forensics?

Disc Forensics is a subset of Digital Forensics. Disk forensics refers to the process of forensically analyzing storage media devices such as hard disk drives, solid-state drives, USB storage devices, logical drives, virtual drives, and more. The goal of disk forensics is to extract digital information and artifacts from a storage device in a forensically sound manner. Some of the key steps involved in disk forensics include:

It is crucial to create a digital copy or forensic image of the drive without modifying any data. This allows investigators to work on the image instead of the original drive, preserving the integrity of the evidence. Forensic images are created with specialized imaging tools that perform bit-stream transfers. Popular options include FTK Imager, EnCase Imager, and dd for Linux.

Once an image is obtained, investigators use tools like Autopsy to extract artifacts like:

What is the Need for Disc Forensics? Why It is Important?

Disk forensics provides crucial evidence for many types of investigations and incident response scenarios. Some examples include:

Given the wealth of digital evidence available on storage media, disk forensics provides immense value to public and private sector investigative scenarios where concrete data-driven insights are required.

What is Autopsy?

Autopsy is a free open-source digital forensic tool created by Basis Technology. It is primarily used by cyber forensic investigators, law enforcement, military, etc. 

Autopsy is the graphical interface for The Sleuth Kit, which is a comprehensive collection of command-line tools and a library designed for investigating disk images in the field of digital forensics. Autopsy aims to provide a user-friendly and efficient interface for digital forensic investigations, supporting both beginner and advanced users. It is compatible with Windows, macOS, and Linux operating systems.

Autopsy is a powerful forensic tool that offers a wide range of features for analyzing digital evidence. Some of its key capabilities include:

How to Download and Install Autopsy?

Autopsy runs on Windows, Linux, and macOS.

Downloading Autopsy

Go to the Autopsy website and download the latest release. At the time we published this post, we have Autopsy v4.20.0 was released.

Installing Autopsy

Once the downloads are complete, run the Autopsy installer as administrator. Accept the license agreement and installation defaults to install it under C:\Program Files\autopsy-4.19.3-64bit.

The only prerequisites on Windows are Java 8+ and 20 GB of free space. The installer will notify you if any requirements are missing.

Here are instructions on how to download and install Autopsy on Windows, Mac, and Linux:

Windows

MacOS

Linux

This installs the latest Autopsy version packaged for your Linux distribution.

How to Forensically Analyze a Disk Using Autopsy?

As we said earlier, the disc forensics process starts with creating an exact digital copy of the drive. Hence, in addition to Autopsy, we also need a disk imaging tool to create forensic images. A popular free option is FTK Imager from AccessData. However, for this demo, we are not going to create any forensic image of the disc. Instead, we have downloaded a sample forensic image file from this link:  https://downloads.digitalcorpora.org/corpora/drives/nps-2010-emails/ . If you want more sample images for practice, you can get more free forensic testing image samples from here.

Autopsy will enable the extraction of artifacts like installed programs, archives, email & web activities, user accounts, and many more things.

Step 1: Launch Autopsy

Upon the installation of Autopsy, when we launch Autopsy for the first time, Autopsy will great with the below screen. Since Autopsy uses the concept of cases to organize investigations, choose “New Case”.
We need to create a folder structure for cases before using Autopsy. Under C:\Users\<User>\, create a folder called Cases. Under it, create separate folders for individual cases, like Test and NIST. Autopsy will automatically create case databases and reports inside these folders. With this, Autopsy is fully installed and configured. Next, we will learn how cases work in Autopsy.

Step 2 Create a New Case

After clicking the new case we will have to provide the necessary information like the case name, base directory and where do you wish to store the analyzed data.

Step 3: Select Host

After providing the above information we have to add a data source which is to create a new host for new cases. In the next step, we have to select the type of source we are adding. In this case, we are adding a disk image.

Step 4: Select the Data Source Type

1. Disk Image or VM File: Represents exact copies of hard drives, media cards, or virtual machine images.2. Local Disk: Refers to physical storage devices such as hard disks, pen drives, and memory cards connected to the system.3. Logical Files: Encompasses local folders and individual files stored on the system.4. Unallocated Space Image File: Represents image files that represent unallocated space on storage devices, which do not contain a file system but require analysis for potential.

Step 5: Add the Image File

We can provide the location of the image file and decide on what fields need to be extracted from the image file, if you are not sure of what needs to be extracted you can select all fields.

Step 6: Select Ingest Modules

Carefully choose the modules and the data. This step can take time depending on the size of the image file uploaded and modules selected once the ingestion is successfully done it will show the analyzed data.

Step 7: Analyze the Data

Now we are in the data analysis phase. where you can view the data in different dimensions. extract artifacts and metadata, and do all the investigations.

Autopsy even lets you view the deleted files present in the image file. This feature is known as file carving. File carving is a method used to recover deleted or formatted files on a computer by searching for specific file patterns in a data stream. It involves extracting and reconstructing the deleted files from the available data.

We can view the image file and metadata and other details right there on the screen, its so simple and efficient to use.

Autopsy allows you to see all the email IDs listed in the sample image file, we can also search using the keywords which makes this process more effective.

Step 8: Timeline view in Autopsy

One interesting feature of the autopsy is it will show all the events inside the image file in a timeline. Anyways, we can customize this data as we need.

Step 9: Generate Reports

Autopsy does come with reporting options. It allows generating reports containing all results or just bookmarked items, which can be saved as HTML, Excel, or CSV files.
Autopsy will enable to extraction of artifacts like installed programs, archives, email & web activities, user accounts, and many more things.

Features are endless. We can’t go into every feature explaining in this single post. We attacked a video by HackerSploit associated with Akamai. Please don’t miss to watch. More information is covered in the video.

Source:

Bottom Line

By walking through this demo, we learned how Autopsy simplifies the process of disk forensics analysis. Key takeaways include:

Autopsy is an invaluable free tool for any forensic investigator or DFIR professional. This guide should have provided a solid foundation for getting started with Autopsy and leveraging it for real-world disk forensics. The capabilities of Autopsy and digital forensics extend much further than highlighted here. To dive deeper, I recommend checking Autopsy’s extensive documentation and training material. You can also browse through the many forensic sample images provided by CFReDS and other sources to continue honing your skills. Thanks for reading! Let me know if you have any other topics you would like covered.

We hope this article helped in understanding digital forensic analysis, what Autopsy is, what are its features of it,  and finally, how to forensically analyze a disk using Autopsy. Thanks for reading this post. Please share this post and help secure the digital world. Visit our website, thesecmaster.com, and our social media page on Facebook, LinkedIn, Twitter, Telegram, Tumblr, Medium, and Instagram and subscribe to receive updates like this.