Lab-Proj 12: The Sleuth Kit and Autopsy
Lab-Proj 12: The Sleuth Kit and Autopsy
Starting Autopsy
In BackTrack, in a Termina, window, execute these commands:
cd /pentest/forensics/autopsy
./autopsy
The program launches, printing the text shown below on this page. Leave this window open.
Troubleshooting: On some older versions of BackTrack, Autopsy won't launch this way. We
solved that problem with this process in the lab:
First execute this command to install autopsy:
apt-get install autopsy
Now find the directory that contains autopsy with these commands:
cd /
find -name autopsy
Use cd to move to the directory that contains autopsy. Execute this command to see what files
are there:
ls
If there is no autopsy executable, there should be a file named configure
Execute these commands:
mkdir /a
./configure
Now answer two questions: the first answer is n because we aren't using a known file
database, and the second answer is a working directory: enter /a (the directory you just
created).
After the .configure is done, it should create the autopsy executable. Start it with this
command:
./autopsy
Click Next.
In the "Image File Details" section, click the "Calculate the hash value for this image"
button, as shown below. Click Add.
The next screen shows the MD5 hash, ending in 4419, as shown below on this page.
Click OK.
Searching in Autopsy
The "Select a volume to analyze or add a new image file" window appears, as shown below
on this page. Click the Analyze button.
Try searching through the files for images. I was able to view the kittens, as shown below,
but I could not find the incriminating image, because it is a deleted file.
Possibly Sleuthkit is able to do some file carving, reconstructing deleted files, but it is very
clumsy to use compared FTK.
Turning in your Project
Upload the image to cms with the subject line: Lab-Proj 12 from YOUR NAME.