Autopsy - open-source digital forensics platform

Based on Autopsy Basics and Hands On (8-Hours) Course

Typical Workflow

1. Create a case.

2. Add a data source.

3. Configure case-relevant keywords.

4. Run ingest with relevant modules.

5. Review data as it comes in.

6. Update keywords as you find more relevant terms.

7. Tag files of interest.

8. Generate report.

Base Concepts

  • Deployment options: "Desktop/Single-User" and "Cluster/Multi-User" with Central Repository

  • Multi-user Autopsy deployment

    • Two types of databases supported by a Central Repository deployment: SQLite for single user, PostgreSQL for multiple

    • allows for "Auto-Ingest" mode, where new media is automatically analyzed 24 x 7 by multiple nodes and Analysis can be faster (if you have fast hardware)

    • One of the primary reasons for having the Central Repository is that it allows you to easily access metadata from past cases.

    • You can store hash sets in the Central Repository that can be shared by everyone in the lab.

Installation

  • You can have multiple versions of Autopsy installed on an endpoint at the same time.

  • Running on OSX or Linux requires more manual steps that are outlined in Running_Linux_OSX.txt.

  • For all Autopsy releases prior to Autopsy 4.15, the Central Repository is disabled by default.

  • Central Shared Storage and 2 Servers are the minimum resources needed for a multi-user Autopsy deployment

  • Autopsy needs to be installed on each examiner's computer, whether using a single-user or multi-user deployment

  • Autopsy supports Machine Translation integration from Google and Microsoft

Cases and Data Sources

  • A case groups the investigation data you are going to analyze.

  • Supported data sources

    • Disk Images

      • Raw (dd) single and split

      • E01

      • Raw disk images of phones (Android)

      • Virtual machine formats

    • Local Drives

      • Preview a live system (i.e. triage)

      • USB-attached device (write blocker)

    • Local Files (Logical Files/Folders)

      • JPEGs, Word docs

      • L01 file

    • Output from Autopsy Logical Imager

    • Unallocated Space Files (no structure)

  • Populate the case database

    • File Metadata

    • Partition layouts

  • Finding Orphan files in FAT file systems in time intensive

    • can be disabled when image is added

  • PhotoRec - open-source carving tool

    • Carving recovers deleted files without relying on file system knowledge

    • Relies on file structure internals (e.g. JPEG, PDF)

    • Needed when File System doesn't have pointers to file content anymore

  • Unallocated space is represented as files.

  • Local Drive Analysis

    • need admin privileges on all drives

    • VHD File created that copies the drive as it goes

      • will be complete copy if you keep it running

  • Local Files

    • not copied or moved

    • info about each file is added to DB

  • In a multi-user cluster, all examiners need to have access to the case directory at the same path (i.e. \server\cases or Z:\Cases)

  • Autopsy is able to ingest Disk Images/VM files and logical files directly.

  • When adding a data source to Autopsy, in-depth analysis on the data is not automatically performed.

  • The Autopsy case database does not store full copies of every single file contained within a data source.

  • Autopsy supports many volume systems, including: DOS, BSD, GPT

  • Orphan files, deleted file that no longer has a parent folder, are stored under the $OrphanFile folder.

  • When adding "Local Files and Folders" to a case in Autopsy, file times aren't added to the database.

  • When adding an E01 file to a case within Autopsy, the E01 file is not automatically validated upon import.

Lab

Renzik has been dognapped. Ransom notes have been sent. Laptop is found in a car. Media card to be found later in search of house.

  • Downloaded the disk images

    • device1_laptop.e01

    • device2_mediacard.e01

  • Made case1 from device1_laptop.e01

    • 6 volumes

    • Unallocated file in vol1: Unalloc_3_0_1048576

    • vol7 is of type NTFS

    • Data Base File is called autopsy.db, ~225 MB

UI Basics

  • Notable tags get applied with a Hash hit

  • Suspicious tags are marked by a module as interesting

  • Comments, Occurrences if file seen in past cases (requires Central Repo)

  • File names and text can be translated

  • Hex viewer, Text/Strings, Application viewer, Message viewer, Metadata, Analysis results, Annotations, Occurences

  • Video Triage, takes snapshots of a video so you can quickly check relevance

  • Ingest inbox for when ingest modules find something but don't want to disturb you

  • Timeline - displays events sorted by time

  • Image Gallery - photos, videos grouped by folder

  • Communications - accounts, messages, call logs, etc

Lab

  • By extension, how many databases are there?

    • 59

  • What is the size of the largest database?

    • 5242880

  • Are there any databases by MIME type yet?

    • No, because file types have not been yet determined.

  • What are the names of the files between 200MB and 1GB in size?

    • chrome.7z, Winre.wim, $BadClus:$Bad

Analyzing Data Sources

  • Ingest Modules - plug-ins responsible for analyzing the data on the drive

    • Two types:

      • File Ingest Modules

      • Data Source Ingest Modules

    • Ingest modules can run in parallel

    • Save their results as Blackboard Artifacts (Type, Value pair)

      • one or more attributes

      • Saved under "Extracted Content"

      • e.g. Web Bookmark, Hash Hit, Encryption Detected

    • Autopsy prioritizes files so that important ones are analyzed first. The priority order is:

      • User Folders

      • Program Files and other root folders

      • Windows folder

      • Unallocated space

Hash Lookup Module

  • The "Hash Lookup" can calculate the MD5 hash of a file.

  • Why?

    • Identify notable ("known bad") files

    • Hide known files from UI

    • Make ingest faster

  • Files found in a hash set will be in the Hashset Hits part of the tree

  • An index allows Autopsy to lookup hash values faster.

  • Supports: EnCase, NIST NSRL, md5sum, Hashkeeper, .kdb files

Lab

We are now going to begin analyzing the laptop. We are starting off the case with some clues. Most notably, we have pictures that were sent with the ransom emails to Basis Technology

  • Right click on device1_laptop.e01 image in tree and choose “Run Ingest Modules”

  • Enable Hash Lookup, File Type Identification, Extension Mismatch Detector, Embedded File Extractor, Exif Parser, Email Parser, Correlation Engine

  • Configure the Hash Lookup module with two hash sets:

    • NSRL File

    • New Hash set that just contains the hash for the ransom note

      • 07c94320f4e41291f855d450f68c8c5b

  • Hash hits: “RN.jpg” and “f_000239”

  • 6 total hits are found under the “Hashset Hits” results after running the Hash Lookup Ingest Module

  • 7 total ".jpg" files are in the folder “Pictures” where the notable hash hit was found

Various Small Modules

  • Modules

    • File Type Module: determines MIME types based on signatures

      • define custom file types (Tools -> Options -> File Types)

        • specify MIME type (or make one), offset of signature, signature

    • File Extension Mismatch Module (false positives due to renames: .tmp, .bak, .0, .1)

    • Exif Module - extracts Exif structure from JPEGs

      • identify camera type, time of pic, geo-coordinates

    • Embedded File Extractor - opens ZIP, RAR, other archives

      • will flag a file if it is password protected

      • you can supply the password by right clicking on the file

    • Email Module - identify email based communications

    • Interesting Files Module - flags files and folders you configure to be "interesting"

      • alerts for iPhone backups, VMWare images, Bitcoin wallets, cloud storage clients

    • Encryption Detection Module - flags files and volumes that are or could be encrypted

      • looks for High entropy, multiple of 512 bytes, no distinguishable file type

    • Plaso Module - parse logs and file types to extract time stamps for timeline

      • ironically very time intensive, disabled by default

    • VM Extractor Module - detects, copies, and feeds them back in as data sources

    • Data Source Integrity Module - validates and calculates hash of disk image

      • ensure integrity of evidence, generates an alert if different

  • MIME type "application/octet-stream" designates unknown type

Lab

  • Search images by camera type

    • iPhone 7 Plus: 1 picture

    • Samsung Galaxy S8: 0 pictures

    • BLU R1 HD: 15 pictures

  • 113 Extension mismatches detected

    • .rsrc -> image/png

    • .dat -> application/x-msoffice

    • .bytes -> image/png

  • Ran Interesting Files module looking for "veracrypt.exe" and "truecrypt.exe"

    • found VeraCrypt.exe

Recent Activity Module

  • Web Activity (depending on Browser)

    • History

    • Bookmarks

    • Cookies

    • Downloads

    • Cache

    • Addresses and Web Form autofill

  • Registry Analysis using RegRipper

    • USB Devices

    • User accounts

    • Installed Programs

    • Programs Run

  • Recycle Bin Analysis

Lab

  • 5 Web Bookmarks

  • Twitter Account username: AntiRenzik

  • Randomizer ransom note generator is suspicious URL

  • YouTube Cookies all made on November 12, 2019

  • how to treat a dog bite searched on November 12, 2019

  • how to make a ransom note searched on November 5, 2019

  • hostage negotiation tactics searched on November 5, 2019

  • antirenzik@gmail.com

  • 2 flash drives, 9 VMs

  • 3 items in recycle bin

Keyword Search Module

  • Updates and searches a text index to enable text-based searching

  • Uses Apache Solr and Apache Tika

  • A text index is an organized collection of words and the files that contain them.

Lab

  • in order to ensure that renzik is treated properly.docx

  • 10 hits for “Renzik” in NTUSER.DAT

Correlation Engine Module

  • Queries Central Repository, to see if items in current case were previously seen, and adds data to Central Repository

  • Repo stores:

    • Value

    • Case

    • Data Source

    • File Path

    • User-supplied Comment

    • Notable Status

  • There is one row in the Central Repository for every instance of a property

Lab

At this point in the scenario, the police have searched the house and, with the help of Siri the electronic sniffing K9, found a media card. We will add that to our case and find some correlations.

  • IMG_20191024_155744.jpg was found on both.

    • 2019-10-24 on media card

    • 2019-11-01 on laptop

  • Also showed up as f_00022e on laptop

Andriod Analyzer Module

  • Locates SQLite DBs and files from Andriod and 3rd party apps

    • Call Logs

    • Contacts

    • Messages

    • Browsers

    • File Transfer

    • Geo

Timeline Analysis

  • The timeline feature allows an analyst to view a graphical representation of time based events that occurred on a system

  • Main areas: Filters, Events, Files and Content

  • In the List View, the letter "A" under Event Type stands for Last Accessed

  • In the List View, the letter "B" under Event Type stands for Date Created

  • Allows you tomore easily review sets of images and videos

  • Folders are prioritized by density of hash hits and total number of images

  • Add-on for Law Enforcement: integrate with DBs incl. Project Vic and C4ALL

Communications UI

  • Oriented around Accounts over data types

    • Data extracted from Andriod Analyzer and Email Parser

  • Review relationships between Accounts and Device Accounts

    • A special account that is created by Autopsy for a data source when it doesn't know what account was used is called a Device account

  • Accounts in Autopsy have both a "type" and a unique "identifier"

  • By default, accounts are sorted by the number of relationships they have in the case.

Tagging, Commenting, and Reporting

  • Tagging allows a user to reference a file or object to easily find it later

  • When viewing a result (aka a Blackboard Artifact) you have the choice to tag either the result or its source file

  • In a multi-user environment, tags are associated with the examiner who made them

  • You can tag a specific part of an image

  • Generate a Portable case: includes only tagged files and interesting item hits

Installing 3rd Party Modules

  • Official Repo: autopsy_addon_modules

  • Java: Tools -> Plugins menu, then just Add Plugin and Install

  • Python: Copy module folder into the python_modules folder

Last updated