Introduction to Caine

Autopsy is a web-based investigation tool. Autopsy uses the concept of a case to allow you to manage images involved in an investigation. This activity will walk you through creating your first autopsy case, and adding an image to it

1. Start the Autopsy interface by accessing it through:
   1. Main Menu > Forensic Tools > Autopsy 2.24
2. You will be asked for the super user password. This is the password you used to login with.

3. The main page gives you a set of options. You may have to scroll down in the browser in your vnc window to see the options. The options are:
   1. Open case
   2. New Case
   3. Help
4. Now create your own new Case
   1. Click on New Case
   2. Type a new Case Name (no spaces, letters and numbers only). Make the case name "introduction"
   3. Give it a description
   4. Type your name into one of the Investigator Name boxes
   5. Click New Case
5. Autopsy shows you that the Case File has been created. Check the locations displayed by Autopsy to ensure they exist:
   /usr/share/caine/report/autopsy/CASE_NAME

6. Go back to Autopsy. Click on the Add Host button
   1. For each case you can add multiple hosts. A host can represent an entire disk, a disk image, a partition image, and so on.
7. Give the host the name "host1", and add a description. Ignore the other options. We will deal with these in later labs. Click Add Host.

8. Each Host must be associated with an image. We are going to associated our host with the image fat-img-kw.dd
9. Click Add Image File
10. Type in the full path location of the file fat-img-kw.dd. It can be found in /images.
11. Select the Type to be Partition.
12. Select the Import method to Symlink.
13. Click Next
14. File System Details
    1. It should identify the File System Type as fat16. It will identify it as Mount Point C: - but this can be changed.
15. In the Data Integrity option, select Calculate. Leave the other options and click Add
16. Autopsy will now calculate the MD5 sum for the file you added.
    1. Make a note of the MD5 is produces. Click OK when it finishes.

What was the md5 sum for this image file? Use uppercase hexadecimal.

Enter the md5 sum: CAC12239BD466FA6C86CEB0B0426DA0A 9AC12239BD466FA6C86CEB0B0426DA0A AAC12239BD466FA6C86CEB0B0426DA0A BAC12239BD466FA6C86CEB0B0426DA0A

17. Autopsy should return to the Case Gallery, which lists all the hosts added to the case, along with the associated image name.

Once you have managed to to successfully to get the image file loaded into Autopsy, go to the Host Manager Screen (Figure 1) and click on the Analyze button.

Figure 1: Select a volume

Once in the analyse menu, click on the Keyword Search button (Figure 2). Make sure ASCII and Unicode are selected.

Figure 2: keyword search

Enter the following search string into the text box: first

Click on the Search button. Autopsy will report that it is searching for both ASCII and Unicode strings.

Once it has finished searching, the side panel should look like Figure 3 (depending on the screen size - it may not have the scroll bar).

Figure 3: keyword found

Autopsy will report whether it finds the string for both ASCII and Unicode. Was it ASCII or UNICODE?

ASCII UNICODE

Next to the result, click on the Hex link. In the right-hand pane, a hex view of Sector 271 should appear (Figure 4). Depending on your screen size, you may need to use the scroll bars to see the additional information.

Figure 4: keyword sector

What was the offset of the string you just searched for?

Enter the offset:

What is the full path name of the file which contains this keyword? Specify it in the form DRIVE:/pathname, e.g. D:/mystuff.com. You get this from the metadata address link.

Enter the path: