Once Autopsy is installed the analyst can open a case with very little pre-configuration. The following process will discuss the process for opening a new case:
- To begin an analysis, first ensure that the entire disk image is located in a single directory.This enables the entire image to be utilized during the analysis.
In the preceding screenshot, is an image file taken from a suspect system.The image has been divided into four 2 GB files.Autopsy will be able to take the four files and reconstruct the entire volume that has been imaged.
During this chapter, a memory image from the Computer Forensic Reference Data Sets is ...
