December 2018
Beginner to intermediate
328 pages
8h 29m
English
The Sleuth Kit began as a set of Linux-based command-line tools for forensics; eventually, a browser-based GUI named Autopsy was added. Recently, Autopsy has been released as a standalone platform on Windows, and includes support for analyzing Android images. Version 4.9.0 is shown in the following screenshots. The full process for loading and analyzing an image will be covered in Chapter 8, Android Forensic Tools Overview.
Autopsy can be downloaded from https://www.sleuthkit.org/autopsy/download.php.
Once the image has been loaded, expanding the image will show all of the volumes that Autopsy found:

One of these volumes will be the ...