F 200: Examining a Forensic Image with Autopsy (15 pts.)

What You Need for This Project

Installing Autopsy

Install Autopsy in single-user mode, as explained here:

http://sleuthkit.org/autopsy/docs/user-docs/4.19.3/installation_page.html

Troubleshooting

If a box pops up saying "Windows protected your PC", right-click the Autopsy installer file, click Properties, and check Unblock. Then run the installer again.

Troubleshooting

If the font is tiny when launching Autopsy, right-click the its desktop shortcut, and click Properties.

On the Compatibility tab, click "Change high DPI settings".

Try various settings. On my system, I got the best appearance by checking the "Override high DPI scaling behavior" box and selecting "System" below it.

Downloading the Evidence File

On your Windows machine, download this file:

F200.E01

Creating a Case

Launch Autopsy. In the Welcome box, click "New Case", as shown below.

Make these selections:

F 200.1: Flag 1 (15 pts)

Use the left pane to explore the data Autopsy found, as shown below.

There's a file containing a flag. Find it and capture an image showing the flag.

Posted: 8-19-22
Folder selection step added 9-15-22