Hey Guys welcome to Section 5.
The autopsy forensic suite this section we're going to introduce the autopsy forensic suite and provide
some indication on how to install version 4 on Kelly Linux.
Also on the Windows VM there we're going to show two practical cases use an autopsy for first analyzing
an image of the window system.
Second analyzing an image of an Android device now will look at autopsy for overview and installation
will introduce the autopsy forensic suite and cover the new features introduced with version 3 and 4
over version 2 which comes pre-installed on Kelly Linux.
We're going to provide some indication on how to build autopsy for on Kelly Linux from the source code
and about downloading and installing autopsy version 4 on a Windows VM.
Autopsy was initially developed by Brian carrier as an old school DML based interface to the sleuth
kit tools the 2.2 for release that comes installed by default on Kelly Linux is the latest of this type
from Version 3 and on autopsy is a standalone job a program that provides a fully featured forensic
suite to analyze disk images.
The new features introduced with the latest versions especially with Wii 4 are really many and remarkable
and they make all topsy a valid open source and free alternative to Blue Zone commercial programs like
and case or pro discover just to name a few features.
We could site the analysis of several file systems leveraging the sleuth kit tools index keyword search
web artifacts and registry analysis and file identification and EXIF metadata extraction also data carving
and timeline analysis all topsy gatherer's many of the functionalities of the Seelye tools we covered
in the previous section which dealt with artifacts extraction and analysis with Seelye tools with an
easy to use graphical environment.
In addition it also allows to analyze an Android device image create multi user cases detect indicator
of compromise and generate reports of the analysis.
Autopsy has a modular and extensible structure as each feature is implemented by a module and new features
could be added writing new modules for all these reasons.
It's really worthy to make the effort of installing the latest release at the moment of recording this
video is for Dot 3.0.
I say that because quite surprisingly there are no compiled binary packages for Linux only for Windows
to build autopsy.
We first have to install a series of required packages.
For example the job development kit V8 then we download and compile the source code of the lib MWF and
sleuth's kit packages before downloading and compiling the autopsy source code.
The procedure is not that straightforward.
It's someone who's not used to building software from sources may find it complicated but to make things
easier there's a script on the sleuthed.
Or for forum to automate the installation procedure.
The script can be found on the following page.
We can take the last post and select all the code they copy and paste it into a text editor and save
it as a script to be executed.
This video we're not going to run autopsy for on Kelly Linux natively because it generates a runtime
error when creating a new case this prevents us from merging a source image to the case and to analyze
it.
This issue has not been fixed an autopsy source code at the moment of recording this video at the moment
are recording this video therefore we're going to download the Windows version of autopsy 4 and install
it on Windows 7 VM running on a virtual box.
We've seen that our VM has already been set up with its virtual network interface configured in that
mode to be able to access the internet to move the autopsy code we direct to autopsy download page on
sleuth kit dark depending on the architecture of our windows system.
We click on the relative button to download the program.
This case we click on the 64 bit version.
The file is quite large around 500 megabytes So it may take some time to download depending on the connection
when the download is complete.
We simply execute the installer and follow the installation wizard like installing any other Windows
programs.
Well done in this video we introduce the autopsy forensic suite and covered the new features introduced
with the version 3 and 4 over V-2 which is already pre-installed on Kelly Linux.
We provided some indication on how to build autopsy for from source code on Kelly Linux and then install
the program on a Windows VM.
Next video analysis of Windows image with autopsy.
We're going to show a practical example on how to use autopsy for to analyze a Windows disk image.