## General Autopsy Help

The Autopsy Forensic Browser is a graphical interface to command line forensics tools and standard UNIX utilities. It allows one to perform file system analysis on UNIX and Windows images.

All images are saved in a directory in the Evidence Locker, which was specified at install time or at run time. See Case Management for more information.

The browser has the following modes:

- Files: Allows one to browse the image as a file system and view the contents of files and directories. This mode even shows deleted file names and Alternate Data Streams in NTFS images. The user can sort the files and directories on meta data.
- Meta Data: Allows one to analyze the image by examining the meta data structures. The address of a structure is entered and the details are shown. This mode is useful for examining unallocated structures and getting all details about allocated files (including all data units and other information such as MD5 value).
- Data Unit: Allows browsing by block number. This is most useful when used with searching or meta data browsing. The contents of the block can be displayed in ASCII, hex dump, or through strings(1). The meta data structure that has allocated the block will be displayed (if any) along with the file name (if any).
- Keyword Search : Search an image using grep(1) for a given string or regular expression. The result will be a list of data units that have the string. Each data unit can be selected to view the contents.
- Image Details: List the details about the image. The output of this mode depends on the file system. Examples of the data include the last mount time, the last mount location, and a detailed break down of block group information or File Allocation Table contents.
- Image Integrity: The integrity of the file system images can be validated at any point by selecting this mode. It uses the values in `md5.txt` to identify if the image has been modified in the analysis process.
- File Activity Timelines: Autopsy can create timelines of file activity based on the Modified, Access, and Change (Create in FAT/NTFS) times (MAC). The timeline will contain details about deleted and allocated content. The resulting timeline can be either viewed within Autopsy or using other text viewing tools (WARNING: many HTML browsers do not handle large tables like a timeline very well so using a text editor is recommended).
- File Type Categories: Autopsy can sort the files in an image based on their file type. For example, all JPEG and GIF files would be identified as images and all executable files would be identified. This mode will also ignore files that are found in hash databases of known good files, identify files that are found in a hash database of known bad files, and identify files that have an extension that is not consistent with their file type.
- Report Generation: Each of the above browsing techniques allows a report to be generated. This report lists the date, md5 value, investigator, and other context information in a text format. This can be used for record keeping when deleted blocks of data have been found.

Brian Carrier