Scribd
Upload
204 views10 pages

Disk Image Analsysis in Forensic

This document discusses analyzing a disk image using Autopsy. It begins by introducing disk image analysis and Autopsy. It then provides step-by-step instructions for opening a case in Autopsy, selecting the disk image file, and viewing the file structure and retrieved files. Several screenshots illustrate the Autopsy interface and examples of recovered files like emails and deleted files. It concludes that if evidence is found on the disk image, then the user should be held responsible according to law.

Uploaded by

MoTech
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
204 views10 pages

Disk Image Analsysis in Forensic

This document discusses analyzing a disk image using Autopsy. It begins by introducing disk image analysis and Autopsy. It then provides step-by-step instructions for opening a case in Autopsy, selecting the disk image file, and viewing the file structure and retrieved files. Several screenshots illustrate the Autopsy interface and examples of recovered files like emails and deleted files. It concludes that if evidence is found on the disk image, then the user should be held responsible according to law.

Uploaded by

MoTech
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 10

DISK IMAGE ANALYSIS

USING AUTOPSY

MoTech IT Articles
NOEL MOSES MWADENDE
INTRODUCTION.
This is our last part of device forensic, after doing USB write
protection, creating disk image, now it is time to retrieve all
contents of USB drive and make analysis of it.

Below are the steps


After opening autopsy, it should look as shown in the figure 1.

Fig. 1.
In the new case click addition sign to create new case as shown
in the figure 1.
Fig. 2.
After clicking new case in the figure one, new window will open
as shown in the figure 2. In the case name field, fill it with the name
of the case, make sure single user is marked.

Fig. 3.
In the figure 3, Base Directory is the directory for the case to be
written and the name of our case is MURDER CESE, so inside folder
called USB in the desktop case name will be written, fill all
information as shown in the figure 2 above and then click next.

Fig. 4.

Fig. 5.
In the figure 5 we can see the data source file which is the image
created by using FTK.

Fig. 6.

Fig. 7.
Figure number 7 shows the detected USB which contain retrieved
files.
Fig. 8.
Figure number 8 shows the tree structure of contents retrieved.
Fig. 9.

Fig. 10.

Figure number 9 and number 10 shows deleted files which is


recovered.
Fig. 11.
Figure number 11 shows retrieved emails, these tools are working
fine, if victim deleted files all files are retrieved, if user refuse that
he or did not used any email in computer, all emails are retrieve.
CONCLUSION.
If all evidences are found, in the USB of user then according to laws
user should be held responsible, thank you that is the end of Device
Forensic, thank you for being with me from the start till the end.
WAYS TO GET IN TOUCH WITH MoTech.
Linkedin.com
https://www.linkedin.com/in/motech-inc-720261191/

YouTube.com
https://www.youtube.com/channel/UCtuaigKZF3okQnKON5RM1qQ

Amazon.com
https://www.amazon.com/s?k=noel+moses+mwadende&ref=nb_s
b_n oss

Github.com
https://github.com/MoTechStore/

Scribd.com
https://www.scribd.com/user/470459684/MoTech

SlideShare.com
https://www.slideshare.net/MoTechInc?utm_campaign=profiletrac
king&utm_ medium=sssite&utm_source=ssslideview

You might also like