Autopsy Named

Autopsy names a GUI forensic platform for disk images — tool literacy on YOUR $DFIR_LAB E01; not a license to analyze unauthorized media.

Autopsy Named• Audio Walkthrough

00:00/03:24

Visual · t26_autopsy_named

Autopsy literacy. $DFIR_LAB only. Original Cyberlium.

Autopsy ingests images and surfaces files, timelines, and keywords — you still own CoC and authority.

Autopsy (Basis Technology / Sleuth Kit ecosystem) adds cases, ingest modules, file trees, keyword search, timeline views, and reporting helpers atop disk images. It does not replace chain of custody, legal authority, or hash verification — it organizes analysis after those gates. Cyberlium treats Autopsy as tool literacy on YOUR $DFIR_LAB practice images — course E01, self-created VM exports — never 'drop in' stranger drives without scope. Next: Filesystem Cues.

1. Autopsy workflow (named, no stranger media)

Typical flow: create case → add data source (E01/raw) → run ingest modules → review file tree, results, timeline → export tagged items with hash notes. Working case lives on encrypted analyst volume.

On $DFIR_LAB, sketch the flow for one practice image — screenshots optional inside lab VM only.

Command guide

Try these commands — Autopsy workflow (named, no stranger media)

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

strings(1) — https://man7.org/linux/man-pages/man1/strings.1.html (ASCII extraction literacy) Sleuth Kit — https://www.sleuthkit.org/ (carving context) SANS DFIR — https://www.sans.org/cyber-security-skills/digital-forensics/

═══ INSTALL ═══

Linux (Debian/Ubuntu): Built-in (binutils)

macOS: Built-in

Windows: Use WSL or install binutils Use WSL or install file for Windows

═══ LINUX / macOS ═══

Command — copy this

export LAB_DFIR=${LAB_DFIR:-$HOME/cyberlium-lab/t26-dfir}
file "$LAB_DFIR/evidence/sample.bin"
strings "$LAB_DFIR/evidence/sample.bin"
strings -n 8 "$LAB_DFIR/evidence/sample.bin" | head -5

Primary tools to practice this lesson: strings, file. Reference sites: strings(1) (https://man7.org/linux/man-pages/man1/strings.1.html); Sleuth Kit (https://www.sleuthkit.org/); SANS DFIR (https://www.sans.org/cyber-security-skills/digital-forensics/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. What Autopsy is not

Not a substitute for memory analysis (Volatility-class tools). Not proof of authority. Not tamper-proof if you analyze read-write mounts or alter originals.

Defenders document tool version in report appendix — students note version string from lab VM.

3. Tool literacy boundary

Forbidden: importing unauthorized victim images, sharing Autopsy case folders with PII publicly, or 'finding' planted files you added yourself. Allowed: Autopsy flow card — five steps, read-only source, exhibit ID.

Ship: Autopsy flow card tied to $DFIR_LAB exhibit. Next: Filesystem Cues.

4. What you ship: Autopsy flow card for $DFIR_LAB

Five-step flow, read-only source, exhibit ID. $DFIR_LAB named. NO unauthorized imports. chmod 600.

5. What you record before the next lesson

Date. Autopsy flow card. $DFIR_LAB named. File t26-m04-l01-autopsy-named.txt chmod 600.

6. Wrong vs right: tampering evidence vs chain of custody

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Import neighbor laptop image into Autopsy. Skip exhibit ID because 'it's just lab.'
Right: Write Autopsy flow card for YOUR $DFIR_LAB image. Next: Filesystem Cues.

Hands-on Exercise