Practical Mobile Forensics - Fourth Edition

Analyzing an image using Autopsy

Once the image is loaded, expand the file present under Data Sources to see data present in the image. For example, the following screenshot shows the contents of the /data/ folder:

Analyzing an image in Autopsy

In the preceding example, only the /data portion of the device has been imaged. If the entire device had been imaged, then the tool would show more volumes. Depending on the underlying details of the investigation, relevant portions need to be analyzed. In the following example, by examining the folders present under com.android.browser, we can extract the list of various sites visited by the user along ...