analyzing-disk-image-with-autopsy

name	analyzing-disk-image-with-autopsy
description	Perform comprehensive forensic analysis of disk images using Autopsy to recover files, examine artifacts, and build investigation timelines. Use when performing comprehensive forensic analysis of disk images using autopsy to.
domain	cybersecurity
tags	["forensics","autopsy","disk-analysis","sleuth-kit","file-recovery","artifact-analysis"]
subdomain	digital-forensics
version	1.0
author	oyi77
license	Apache-2.0
nist_csf	["RS.AN-01","RS.AN-03","DE.AE-02","RS.MA-01"]

Analyzing Disk Image With Autopsy

Overview

Cybersecurity skill for analyzing disk image with autopsy. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "analyzing disk image with autopsy"

• "Perform comprehensive forensic analysis of disk images using Autopsy to recover "

• When you have a forensic disk image and need structured analysis of its contents

• During investigations requiring file recovery, keyword searching, and timeline analysis

• When non-technical stakeholders need visual reports from forensic evidence

• For examining file system metadata, deleted files, and embedded artifacts

• When building a comprehensive case from multiple disk images

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Autopsy 4.x installed (Windows) or Autopsy 4.x with The Sleuth Kit (Linux)
• Forensic disk image in raw (dd), E01 (EnCase), or AFF format
• Minimum 8GB RAM (16GB recommended for large images)
• Java Runtime Environment (JRE) 8+ for Autopsy
• Sufficient disk space for the Autopsy case database (2-3x image size)
• Hash databases (NSRL, known-bad hashes) for file identification

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v in IOC_PATTERNS.items()}