Hey Guys welcome to analysis of a Windows image with autopsy.
Previously we introduced autopsy the new features a version for and how to install it on a Windows VM.
We're going to take a look at how to analyze a Windows disk image with autopsy.
We're going to create a new case then open the image and examine the various artifacts extracted from
it.
This includes files of metadata Internet artifacts deleted data and so on.
Finally we're going to cover the timeline analysis and visualization.
Let's assume our Windows VM an autopsy four is up and running autopsy for when opened shows an initial
dialog box asking us to create a new case or open an existing one.
We select Create new case another dialog window appears we can insert information about the case the
name for example suspect PC and the base directory where we want to save the relative files the case
type is single user.
Then click on next we could insert other optional info like the case number and the examiner.
We click on finish and the case is being created once the case is created.
We have to select the data source that in our case is an image file.
We downloaded a sample image from the hacking case scenario from the computer forensic reference data
sets.
At this you are el We've downloaded the image in the case format split into two files.
Let's go back to the autopsy program and select our target image which we previously saved in a shared
folder between the VM and the host system.
Click on next in the next step we have to select which just modules to run for our analysis.
Obviously the more modules we use the more will be the time and disk space needed.
But the results will be more accurate and complete.
This case the only module we exclude is the android analyzer and the VM extractor.
We click on next then on finish.
An autopsy starts running the modules showing the progress and the corresponding status bars which are
in the bottom right corner.
The interface of autopsy has an intuitive layout all the results of the analysis are organized under
a tree structure on the left hand side of the window.
This is called the tree viewer.
The right hand side is divided into the result viewer the top pan and the content viewer the bottom
pan.
When the analysis is finished we could browse the tree view or to examine all the data and artifacts
extracted from the image the data sources presents the image and the partitions in which it is divided.
We select the NTFS partition and it's directories are listed under the tree viewer we can browse through
the directories and files in the result viewer.
We can browse through the directories and files and the result viewer
the attributes of metadata are also listed for each directory and files.
There's also a thumbnail view to see a preview of image files.
Clicking on a file we can see its contents in the content viewer pan.
Also it's hexadecimal representation and the output of the strings tool and the file meta data.
If the file is in an image or a video we can view the file directly in the media view.
Otherwise we can open it with an external application by right clicking on the file and selecting open
an external view if the photo recover module is enabled the deleted files recovered during the analysis
are displayed in the tree viewer under the views deleted file subtree
another useful feature is the file search which we can access from the Tools menu
the file search allows to search for files by the name size date and the known status
we could choose to only view unknown known or known bad files.
To filter files by the known status the hashed database lookup module must be enabled.
This module calculates M.D five hash values for files and looks up hash values in a database.
This database can be imported in the Tools Options menu selecting hashed database then clicking on import
DB instead of importing the whole N.S. RL database we can import a pre-made index which can be downloaded
from this autopsy project page on Source Forge dot net.
The file is a pretty big download when the file has been downloaded.
We unzip and then select the index file to be imported.
The results of the hash database look a module can be seen in the tree viewer under the hash net hits
tab autopsy allows to search for keywords.
Clicking on the keyword search tab where we can search an exact string where we could search an exact
string substring or regular expression.
Clicking on keyword list we can also search using built in keywords that are regular expressions that
identify phone numbers IP addresses email and your Elle's even credit card numbers.
Using these built in list can produce a very large number of results so we can define our keyword lists
that can also be based on the regular expressions to do so we click on manage list then a new list.
We type a name for the list.
For example names we could add new keywords.
Clicking on the corresponding button we could specify exact strings to match substrings and also regular
expressions.
The keyword lists can also be specified in the Tools menu options then in keyword search module configuration
where we can add new lists
the list can be used by the module to automatically search for the specified keywords.
The search results are displayed under the keyword hits subtree in the tree viewer.
For example we could see a list of all the email addresses and for each address the file where the file
where it's been found under the extracted content subtree.
We can examine several artifacts and data extracted from the image the attached devices OS information
OS user accounts
recent documents and various web artifacts like bookmarks cookies Web history and web search
e-mail messages are extracted by the email parser module and shown under the relative node in the tree
viewer.
An important feature that has been introduced with V3 and significantly enhanced with before is the
timeline analysis and visualization.
This feature includes from all the autopsy results that appear in the tree viewer with with the associated
time stamps.
Each event has a time stamp type and description to generate a timeline.
We click on the timeline button and the process takes several minutes to complete.
After the process is complete a second window is open as we could see in the timeline window.
There are three view modes Kountze details and list counts shows a stacked bar chart and displays the
amount of events of a given type that occurred in a given timeframe but does not show specific events.
For instance events related to the file system are displayed in red while those related to web activity
is green.
We can filter events based on their type and subtypes show and only those that interest us.
Events can also be filtered based on a text string and hiding known files.
If we're interested in viewing the events of a more limited timeframe we could click on the Zoom in
and out tool then select a specific time frame.
For instance one single day we can also select it using the calendar having select a time range.
We would like to see the succession and details of the events that occurred to do so we change to the
details view
details view shows individual or groups of related events where the x axis represents the date and time
it shows specific events that happened in a given timeframe or the events occurred before or after a
given event.
Now the y axis is only used as a space to lay out overlapping events events with the same type of description
that occur close together and time may be clustered together and can be expanded.
And collapsed moving the mouse cursor over the event.
Events can also be pinned
list view displays the events in chronological order.
One event for each row with a relative attributes.
It's also possible to save a screen capture of the current view to be included in the report.
Clicking on snapshot report will see more details how to generate reports of the whole forensic analysis
in the last section of the course.
The reporting phase great work in this video we looked at how to analyze a Windows disk image with autopsy.
First we created a new case then open the image and examine the various artifacts extracted from it.
We also cover timeline analysis and visualization.
Next video we're going to see how to analyze an Android device image with autopsy for.