Autopsy Case Management Help

## Case Management

### Overview

Autopsy organizes images based on the case and host that they came from. A case contains one or more hosts (a new case should be created for each investigation). Each host can contain one or more images, which correspond to partitions on the host.

### Creating a New Case

From the Main Menu (at startup) select New Case. You will have to enter the case name and an optional short description. The case name must be a valid directory name (no spaces - no symbols). A list of investigators will also be requested. These will be used for the audit logs, not for authentication. A directory with the same name as the case will be created in the Evidence Locker. To later rename the case, simply rename the directory.

For example:

Case Name: | `bankofmars`
Case Description: | `Theft of $1,000,000,000.01 from The Bank of Mars`
Investigators: | `gadget`

### Adding a New Host

A Host must then be created in the Case. Select the Case that was just created from the Case Gallery and enter the Host Gallery. Select Add Host and enter the host name, a short description, and time information such as time zone and clock skew. The clock skew is how many seconds the system was off from a synchronized clock. Adding a host will create a directory in the case directory and subdirectories in the host for the images, output data, logs, and reports.

You can optionally add the path to hash databases.

For example, the 'Bank of Mars' incident could have two hosts involved:

Host Name: | `db_server`
Host Description: | `Main Database Server - Solaris`
Timezone: | `EST5EDT`
Timeskew: | `-100`
Known Good Database: | `none`
Known Bad Database: | `none`

Host Name: | `file_server`
Host Description: | `Windows File Server - Win 2k`
Timezone: | `CST6CDT`
Timeskew: | `0`
Known Good Database: | `/usr/local/forensics/hash/win2k.txt`
Known Bad Database: | `/usr/local/forensics/hash/win_hack.txt`

### Adding a New Image

Next, images must be added to the host. Select the host that was just added from the Host Gallery and enter the Host Manager. Select Add Image and a new form is shown. The first text box in the form is for the path of the file system image. Type that in, or cut and paste it. The images will have to be located in the `images` directory of the host directory. You are given a choice to either create a symbolic link from the current location to the host directory, to copy the file from its current location to the host directory, or to move the file from its current location to the host directory. Select the desired import method.

The file system type must be selected from the pull down list and the mounting point entered. A sanity check will be performed on the image and file system type before it is imported. The mounting point is only for cosmetic purposes only and will have no impact on how the image is processed. By default, an MD5 value will be calculated for the image when it is imported. If it is already known, then enter it in the field.

For example, the Solaris database server in the previous example could have the following images:

Image Path: | `/mnt/db_srv/c0t0d0s0`
Import Action: | `move`
File System: | `Solaris`
Mounting | `/`
MD5: | `Add Known Value`
MD5 Value: | `bbec3acd644588d0c8af89a305227a0f`

Image Path: | `/mnt/db_srv/c0t0d0s6`
Import Action: | `move`
File System: | `Solaris`
Mounting | `/usr`
MD5: | `Ignore`

### MD5 Values

Each directory in a host has an `md5.txt` file that contains the MD5 value for files in that directory. Autopsy uses that file to validate the integrity of files. By default, when a file is imported into Autopsy, its MD5 will be calculated. If it is already known, then it can be entered in the 'Add Images' window.

### Host Subdirectories

Each host has an `images` directory and an `output` directory. All data generated by Autopsy is saved to the `output` directory. The theory behind this design, was to allow the `images` directory to have strict permissions to prevent accidently modifying the images. Therefore, the `images` directory can have its write bits removed to prevent modifications.

Brian Carrier