Lion Cipher Lab
Investigate a disk image with Autopsy
- Digital Forensics & IR (DFIR)
- Intermediate
- ~60 min
- Free · no account required
Why it matters
Opening a case is the easy part; the investigation is where the value is. A disk image can hold hundreds of thousands of files, plus deleted fragments, browser history, and system records that quietly document what happened on a machine. Autopsy pulls those out and organises them, but organising is not concluding. The skill that matters — the one that separates someone who clicks around a tool from someone who can actually answer 'what happened here' — is reading those artifacts as evidence: corroborating them against each other, questioning whether a finding really means what it appears to…
What you'll learn
- navigating the Autopsy tree (file system, folders, and result views)
- recovering deleted and carved files
- reviewing web history, downloads, and recent-activity artifacts
- running a keyword search across a data source
- checking file hashes against a known set
- reading the timeline to place events in order
- tagging findings and generating a report
- interpreting artifacts as evidence rather than treating a hit as a conclusion
Steps in this lab
- Where you are, and what an artifact is
- Navigate the tree: file system and folders
- Find deleted and carved files
- Review web history, downloads, and recent activity
- Run a keyword search
- Check file hashes against a known set
- Use the timeline
- Tag findings, then report — and remember who built the story
- My take: the analyst is the instrument