> For the complete documentation index, see [llms.txt](https://notes.nomanaziz.me/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.nomanaziz.me/cybersecurity/blue-teaming/digital-forensics-and-incidence-response/disk-analysis-with-autopsy.md).

# Disk Analysis with Autopsy

### Disk Forensics

* Process of extracting forensics info for storage mediums like HDDs, USBs, firmwares, etc.
* In order to forensically analyze a disk, you need to create a forensic image of the drive
* Forensic image is an exact digital copy of a physical drive and data contained in it
* Forensic image can be created with various tools like
  * **FTK Imager**
  * **Encase Imager**
* Forensic imager tools do not change or modify any data. This is accomplished with use of bitstream

***

### Autopsy

* Free and open source digital forensics tool used to perform forensic analysis on disk images
* Used to extract important information like
  * Deleted Files
  * Email Messages
  * Browser History and Cookies
  * Installed Programs
  * File Metadata
* Used by LEAs worldwide to analyze and extract evidence from hard drives and other storage mediums used in crimes

***