Digital Forensics with Autopsy: A Practical Recovery Workflow
Autopsy is free, but a sloppy case built on it is worse than no case at all. Chain of custody, hashing and ingest order matter as much as the tool. Here's the workflow I run on every disk-based investigation.
Image first, analyze never on the original
Write-block the source and pull a bit-for-bit image with FTK Imager or dd. Hash before and after (MD5 + SHA256) — a mismatched hash invalidates the whole case before you've opened Autopsy.
Run the right ingest modules
Autopsy's ingest modules do the heavy lifting, but running all of them on a large image wastes hours on noise. Scope the run to what the case actually needs.
- Hash Lookup against a known-bad (NSRL/custom) set first
- Recent Activity + Timeline for user and OS activity
- Keyword Search scoped to case-relevant terms, not defaults
- EXIF + File Type for media and disguised extensions
Recovering deleted data
Deleted doesn't mean gone. Autopsy's unallocated-space carving (via PhotoRec) pulls files the file table has forgotten, while MFT/journal analysis on NTFS often recovers names and timestamps carving alone can't.
- Carve unallocated space for deleted files and fragments
- Parse $MFT and $LogFile for deletion and rename events
- Recover browser history/cache and shellbag artifacts for user activity
Build a timeline that survives cross-examination
Correlate MACB timestamps across the filesystem, registry and application artifacts into a single timeline. One artifact is a data point; three artifacts agreeing is a finding.
Report for the audience, not for yourself
Export the case with tagged evidence, bookmarks and a clear narrative. A technically perfect analysis that no one outside forensics can follow doesn't hold up in an incident review or a courtroom.
Tools mentioned
Forensic recovery is a chain-of-custody discipline wearing a tool's UI. Image cleanly, hash everything, scope your ingest, and let the timeline — not a single artifact — carry the conclusion.