Where a time skew is known, you can also add this in advance. Lists of known rootkits and other Malware can be added as a known bad list. This can be as complex as the NSRL lists or as simple as a hashed list of your own organizations "known good" files. Also, you can add and use a list of known good or known bad hashes. As it states, the Timezone and skew can be configured. Step 5 - Add a Host to the CaseĬlick "Add Host" and you will be presented with a screen (above) that allows you to add the host and a description. This displays where the evidence is located on the system. In the example above, we see an example case I created for a CHFI course I created. Step 4 - Note where the Evidence Directory is located An example could be something along the lines of "." if you do external consulting as I do or it could be related to specific designations within a company.You will see the message (displayed in Step 4) when the case file is created. For this, you should have a means of identifying cases. This will include the name of the Case itself and a description of the case. To begin, click New Case.īegin by entering the details about the case. This will add a new case folder to the system and allow you to begin adding evidence. By default, you will connect to the Autopsy service using the URL " The default start page is displayed in Step 2.Ĭlick New Case. Step 1 - Start the Autopsy Forensic BrowserĪutopsy is a web based front end to the FSK (Forensic Toolkit). You can start Autopsy by clicking on the magnifying glass in the upper right corner. Autopsy is built into the SANS Investigative Forensic Toolkit Workstation ( SIFT Workstation) that you can download from. We will start with the presumption that you have the Forensic Toolkit Installed (whether through the use of a Live CD such as Helix or if it is installed on a Forensic Workstation). This tool is an essential for Linux forensics investigations and can be used to analyze Windows images. This is a brief tutorial on how to use the Autopsy Forensic Browser as a front end for the Sleuthkit. Immediately apply the skills and techniques learned in SANS courses, ranges, and summits
0 Comments
Leave a Reply. |