Opening a case

Once Autopsy has been installed, the analyst can open a case with very little preconfiguration. The following steps will discuss the process of opening a new case:

  1. To begin an analysis, ensure that the entire disk image is located in a single directory. This allows the entire image to be utilized during the analysis:

In the preceding screenshot, an image file has been taken from a suspect system. The image has been divided into four 2 GB files. Autopsy will be able to take the four files and reconstruct the entire volume that has been imaged.

In this chapter, a memory image from the Computer Forensic Reference Data Sets is ...

Get Digital Forensics and Incident Response - Second Edition now with the O’Reilly learning platform.

O’Reilly members experience live online training, plus books, videos, and digital content from nearly 200 publishers.