Digital › Module 4 › Lesson 1
Autopsy Named
Autopsy names a GUI forensic platform for disk images — tool literacy on YOUR $DFIR_LAB E01; not a license to analyze unauthorized media.
Visual · t26_autopsy_named
Autopsy literacy. $DFIR_LAB only. Original Cyberlium.
Opening
Autopsy ingests images and surfaces files, timelines, and keywords — you still own CoC and authority.
Autopsy (Basis Technology / Sleuth Kit ecosystem) adds cases, ingest modules, file trees, keyword search, timeline views, and reporting helpers atop disk images. It does not replace chain of custody, legal authority, or hash verification — it organizes analysis after those gates. Cyberlium treats Autopsy as tool literacy on YOUR $DFIR_LAB practice images — course E01, self-created VM exports — never 'drop in' stranger drives without scope. Next: Filesystem Cues.
1. Autopsy workflow (named, no stranger media)
Typical flow: create case → add data source (E01/raw) → run ingest modules → review file tree, results, timeline → export tagged items with hash notes. Working case lives on encrypted analyst volume.
On $DFIR_LAB, sketch the flow for one practice image — screenshots optional inside lab VM only.
Command guide
Try these commands — Autopsy workflow (named, no stranger media)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
strings(1) — https://man7.org/linux/man-pages/man1/strings.1.html (ASCII extraction literacy) Sleuth Kit — https://www.sleuthkit.org/ (carving context) SANS DFIR — https://www.sans.org/cyber-security-skills/digital-forensics/
═══ INSTALL ═══
Linux (Debian/Ubuntu): Built-in (binutils)
macOS: Built-in
Windows: Use WSL or install binutils Use WSL or install file for Windows
═══ LINUX / macOS ═══
Command — copy this
export LAB_DFIR=${LAB_DFIR:-$HOME/cyberlium-lab/t26-dfir}
file "$LAB_DFIR/evidence/sample.bin"
strings "$LAB_DFIR/evidence/sample.bin"
strings -n 8 "$LAB_DFIR/evidence/sample.bin" | head -5Primary tools to practice this lesson: strings, file. Reference sites: strings(1) (https://man7.org/linux/man-pages/man1/strings.1.html); Sleuth Kit (https://www.sleuthkit.org/); SANS DFIR (https://www.sans.org/cyber-security-skills/digital-forensics/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. What Autopsy is not
Not a substitute for memory analysis (Volatility-class tools). Not proof of authority. Not tamper-proof if you analyze read-write mounts or alter originals.
Defenders document tool version in report appendix — students note version string from lab VM.
3. Tool literacy boundary
Forbidden: importing unauthorized victim images, sharing Autopsy case folders with PII publicly, or 'finding' planted files you added yourself. Allowed: Autopsy flow card — five steps, read-only source, exhibit ID.
Ship: Autopsy flow card tied to $DFIR_LAB exhibit. Next: Filesystem Cues.
4. What you ship: Autopsy flow card for $DFIR_LAB
Five-step flow, read-only source, exhibit ID. $DFIR_LAB named. NO unauthorized imports. chmod 600.
5. What you record before the next lesson
Date. Autopsy flow card. $DFIR_LAB named. File t26-m04-l01-autopsy-named.txt chmod 600.
6. Wrong vs right: tampering evidence vs chain of custody
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Import neighbor laptop image into Autopsy. Skip exhibit ID because 'it's just lab.'
Right
Write Autopsy flow card for YOUR $DFIR_LAB image. Next: Filesystem Cues.
Mission: map Autopsy steps on YOUR image
1) List five workflow steps. 2) Note read-only mount rule. 3) Tie to CoC exhibit ID. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Case naming convention early saves merged-case headaches.
Knowledge Check
APPLY: Autopsy literacy on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: Autopsy replaces legal authority to examine evidence.
True or False
Knowledge Check
APPLY: Before Autopsy ingest you should:
Multiple choice