Once Autopsy has been installed, the analyst can open a case with very little preconfiguration. The following steps will discuss the process of opening a new case:
- To begin an analysis, ensure that the entire disk image is located in a single directory. This allows the entire image to be utilized during the analysis:
In the preceding screenshot, an image file has been taken from a suspect system. The image has been divided into four 2 GB files. Autopsy will be able to take the four files and reconstruct the entire volume that has been imaged.
In this chapter, a memory image from the Computer Forensic Reference Data Sets is ...
