Autopsy and Sleuth Kit
Autopsy is the leading open-source disk forensics platform — a GUI front-end over The Sleuth Kit (TSK) command-line tools. This chapter covers the investigation workflow in Autopsy, the most useful ingest modules, keyword search, and using TSK command-line tools when you need scriptable output.
You have a 500 GB E01 disk image. Your goals: browse the filesystem to find attacker-dropped files, search the disk for specific keywords (C2 domain, known tool names, attacker-used file paths), recover deleted files, and extract the KAPE-equivalent artifacts for timeline analysis. Autopsy does all of this from a single case — this chapter walks through the setup and investigation workflow.
Autopsy Case Setup
Autopsy Investigation Workflow
═══════════════════════════════════════════════════════════════════
1. Launch Autopsy → New Case
├── Case name: CASE-2026-009
├── Base directory: D:\cases\
└── Case type: Single-user (multi-user for teams)
2. Add Data Source
├── Image File → select .E01 or .dd
├── Configure ingest modules (see list below)
└── Autopsy begins background ingestion
3. Ingest Modules (run at data source addition):
├── File Type Identification ← detects file type from header
├── Hash Lookup ← hash against NSRL, custom hash sets
├── Recent Activity ← browsers, recent docs, installed programs
├── Keyword Search ← text search across all files + carved
├── Windows Registry ← parses registry hives automatically
├── Volatility (optional) ← integrate memory analysis if .mem exists
└── EXIF metadata ← image geolocation and metadata
4. Investigation:
├── File Browser: navigate filesystem, filter by type/date
├── Deleted Files: marked with X icon
├── Keyword Search: search across entire disk
├── Timeline: chronological artifact browser
└── Reports: generate HTML or CSV report of findings
Sleuth Kit Command-Line Tools
When you need scriptable, pipeline-friendly disk analysis, TSK command-line tools give you precise control over filesystem inspection:
| Tool | Purpose | Example |
|---|---|---|
| mmls | Display partition table / volume layout | mmls disk.dd |
| fsstat | Show filesystem statistics (type, cluster size, MFT location) | fsstat -o 2048 disk.dd |
| fls | List files and directories (including deleted entries) | fls -r -o 2048 disk.dd |
| istat | Display MFT record details for a specific inode | istat -o 2048 disk.dd 25 |
| icat | Extract file content by inode number | icat -o 2048 disk.dd 25 > recovered.exe |
| blkcat | Extract disk sectors by block number | blkcat -o 2048 disk.dd 1234 10 > sectors.bin |
| blkls | Extract unallocated space | blkls -e -o 2048 disk.dd > unalloc.dd |
| tsk_loaddb | Load image metadata into SQLite database | tsk_loaddb -d case.db disk.dd |
IMAGE="/cases/CASE-2026-009/FINANCE-SRV01.E01"
# Step 1: Show partition table to find volume offset
mmls $IMAGE
# Output:
# DOS Partition Table
# Offset Sector: 0
# Units are in 512-byte sectors
# Slot Start End Length Description
# 000: Meta 0000000000 0000000000 0000000001 Primary Table (#0)
# 001: ------- 0000000000 0000002047 0000002048 Unallocated
# 002: 000:000 0000002048 0000206847 0000204800 NTFS / exFAT (0x07) ← OS volume
# 003: 000:001 0000206848 0000976773134 0000976566287 NTFS (0x07) ← data volume
# Note offset of the NTFS partition: 2048 sectors
OFFSET=2048
# Step 2: List all files including deleted (recursive)
fls -r -o $OFFSET -d $IMAGE > /cases/CASE-2026-009/fls-deleted.txt
# -d: only show deleted files
# -r: recursive
# Output format: d/d = directory deleted, r/r = regular file deleted
# Step 3: Find files by extension in deleted entries
grep -i "\.exe\|\.dll\|\.ps1\|\.bat\|\.zip\|\.7z" /cases/CASE-2026-009/fls-deleted.txt
# Step 4: Recover a specific deleted file by inode number
# From fls output: r/r 123456-128-1: svchost32.exe ← inode 123456
icat -o $OFFSET $IMAGE 123456 > /cases/CASE-2026-009/recovered-svchost32.exe
# Step 5: Extract unallocated space for carving
blkls -e -o $OFFSET $IMAGE > /cases/CASE-2026-009/unallocated.dd
foremost -t exe,zip,7z -i /cases/CASE-2026-009/unallocated.dd \
-o /cases/CASE-2026-009/carved/Keyword Search in Autopsy
# Autopsy's keyword search uses a Lucene index — fast for large images
# Via Autopsy GUI: Keyword Search panel → enter term → search
# Via command line: srch_strings (part of TSK) + grep
# Extract printable strings from image and search
srch_strings -a $IMAGE | grep -i "185.220.101.47\|evil-c2\|cobalt"
# More targeted: extract strings only from specific file types
# First get unallocated space, then search it
srch_strings /cases/CASE-2026-009/unallocated.dd | \
grep -iP "(?:https?://|\\\\\\\\)[a-z0-9.-]+\.[a-z]{2,6}" | \
sort -u | head -50
# Search for specific indicators in the E01 image using bulk_extractor
bulk_extractor \
-o /cases/CASE-2026-009/bulk-output/ \
-x jpeg_carved -x zip_carved \ # disable unnecessary carvers
$IMAGE
# bulk_extractor creates:
# domains.txt — all domains found in image
# email.txt — all email addresses
# ip_histogram.txt — IP addresses with frequency
# url.txt — all URLs
# These are goldmines for C2 infrastructure identificationUsing Autopsy's Timeline
Autopsy's built-in Timeline view aggregates timestamps from all parsed artifacts into a single chronological display:
Autopsy Timeline View
═══════════════════════════════════════════════════════════════════
Sources aggregated in Autopsy Timeline:
├── MFT timestamps (M/A/C/B for every file)
├── Registry key LastWriteTime
├── Event log timestamps (after Windows Registry ingest)
├── Browser history timestamps (after Recent Activity ingest)
└── Prefetch file timestamps
Navigation:
- Drag timeline left/right to navigate
- Zoom in for hour/minute resolution
- Click a spike to see events at that time
- Filter by artifact type (files, registry, web activity)
Investigation approach:
1. Identify the approximate attack window from SIEM/alert
2. Navigate to that time window in Autopsy Timeline
3. Look for spikes (unusual activity density)
4. Zoom into spikes to identify specific file operations
5. Use "Pin to timeline" on key events to build your narrative
Pro tip: use the cluster view (bar chart) first to find anomalous
high-activity periods, then switch to list view within that window
to see individual events.
Q & A
Q: Autopsy's ingest is taking 4 hours on a 500 GB image. Can you start the investigation before ingestion completes?
Yes — Autopsy allows investigation while ingest modules are still running. The File Browser is available as soon as the image is mounted (seconds after adding the data source). Deleted file detection from MFT parsing completes relatively quickly (10-20 minutes for 500 GB). Keyword search requires the search indexing module to complete before results are available — but you can navigate to specific paths and extract files manually before that. Best practice for time-constrained investigations: start targeted TSK command-line analysis (fls, icat) immediately while Autopsy ingests in the background. TSK gives you actionable results in minutes; Autopsy gives you comprehensive results in hours. Use both concurrently — TSK for immediate answers, Autopsy for thorough analysis.