Disk examination with The Sleuth Kit and Autopsy
You examine an image layer by layer with The Sleuth Kit commands, then open the same case in Autopsy and turn it into reportable findings with keyword search, hash sets and tags.
Level 301 · 16 lessons · 15 practice labs
Lessons
Sleuth Kit layers
- The Sleuth Kit layer model: volume, file system, metadata, data
- Identifying the volume and file system with mmls and fsstat
- Finding and extracting a file by inode with fls, istat and icat
- Scanning unallocated space with blkls and blkcat
- Sorting files by type and hash with sorter and hfind
- Short task: extract a deleted archive using only TSK commands
An Autopsy case
- Opening a case and adding a data source in Autopsy
- Ingest modules: file type, metadata, recent activity
- Known-good and known-bad hash sets (NSRL)
- Keyword and regular-expression search
- Autopsy’s timeline view
- Short task: find and tag card numbers and email addresses in the case
Findings and report
- Tags, comments and picking notable findings
- Producing HTML and Excel reports from Autopsy
- Confirming a finding with a second tool: reproducibility
- Capstone: examine and report a data-leak case in Autopsy
Practice labs
- Identify the volume and file system: Extract the image's partitions, file system type and cluster size with mmls and fsstat.
- Find and extract a file by inode: Find a specific file with fls, istat and icat, read its metadata and extract its content.
- Extract a deleted archive with TSK only: Find and extract a deleted archive using only the command line tools and verify its hash against the given value.
- Export the unallocated space: Export the unallocated space to a separate file with blkls and report its size.
- Search for a keyword in unallocated space: Search unallocated space for a project name and show the block that holds it with blkcat.
- Sort files by type and hash: Classify files with sorter and hfind and list the executables not in the known-good set.
- Open a case and add a data source: Create a case in Autopsy, add the image and fill in the case details.
- Choose and run ingest modules: Run the file type, metadata and recent activity modules and count the findings in the results tree.
- Known-good and known-bad hash sets: Load the hash sets, eliminate known files and find the one flagged as known bad.
- Run a keyword search: Search the case for a customer name and list the files it appears in.
- Find and tag card numbers and email addresses: Find and tag files containing card numbers and email addresses with regular expression search.
- Narrow the incident in the timeline view: Zoom to the incident hour in the timeline view and interpret file and web activity together.
- Tag and comment a finding: Tag three important files and write why each matters.
- Verify a finding with a second tool: Find the deleted file you found in Autopsy again with TSK commands and compare the results.
- Examine and report a data leak case: Find and tag the leaked documents in Göktaşı Yazılım's prepared image and produce the HTML report.
About this course
You examine an image layer by layer with The Sleuth Kit commands, then open the same case in Autopsy and turn it into reportable findings with keyword search, hash sets and tags.
What you will learn
- Sleuth Kit layers
- An Autopsy case
- Findings and report
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.