Backtrack 4 R2 Digital Forensics Autopsy - Case Management

This video is the first in a series of Autopsy videos. In this video I examine the Digital Forensics tool Autopsy found on the Backtrack operating system and setup a case. Autopsy is a graphical front-end for the Sleuth Kit tools. I create a case, host, and add an image to the host. In the video I had to create a symbolic link to my forensics hard drive because of the volume name containing a space. For more information visit http://lecturesnippets.com

The command I used for the link:
ln -s "/media/New Folder/winxpimage.dd" /media/Forensics/

Category:

Science & Technology

Tags:

• Autopsy
• Sleuth Kit
• Backtrack
• Digital Forensics
• Computer Forensics

[polarbear35353]

Hello, I apologize if I sound ignorant but I just stared using Caine 2.0 today and I am sort of teaching myself but my questions were ; How do you get your image? Mount drive and create an ISO or will just a mount work? If a mount will work, do you have to be online to use Autopsy? Instead of linking the folders can't you just rename the New Volume folder to get around the space problem or do you have to link the folders? A friend turned me onto Ubuntu and I am trying to learn. Thank you!

[lecturesnippets]

@polarbear35353

To get an image of a partition or hard drive you can use the dcfldd command. You do not need to be online to use Autopsy. When you run the application it starts up a web server on the computer itself and you connect to it via your web browser. I several vids on my web site that are focused on using Backtrack, but you can substitute Ubuntu for many of the tasks as long as you have the software on it.

[anuragsingh84]

I have a portable hard disk that's essentially unmountable (the Windows PC it was connected to crashed and I guess that destroyed the FAT structures on it). Will Autopsy allow me to recover the data on it?

[polarbear35353]

@lecturesnippets Thank you very much!

[Screenfreezer]

Thanks so much!!