Lion Cipher Lab
Set up Autopsy for digital forensics
- Digital Forensics & IR (DFIR)
- Beginner
- ~40 min
- Free · no account required
Why it matters
Autopsy is the tool a huge share of people first do real digital forensics in: it is free, open-source, and wraps The Sleuth Kit's command-line forensics engine in a case-based graphical interface. Almost every beginner DFIR room, university module, and "analyse this image" exercise assumes you can already install it, open a case, and load evidence. Learn that once and the analysis labs stop being blocked on setup. Just as important, doing it correctly bakes in the habit the whole field runs on: you point the tool at a copy or an image, never the original, so the evidence you started with…
What you'll learn
- installing Autopsy
- creating a forensic case
- adding a disk image as a data source
- choosing and running ingest modules
- hash lookup, keyword, and web-artifact analysis
- forensic hygiene (work on a copy)
Steps in this lab
- What Autopsy is, and the words you need
- The one rule before you touch anything: work on a copy
- Install Autopsy on Windows
- Install Autopsy on Linux (notes)
- Create a new case
- Add your disk image as a data source
- Pick your ingest modules and let it process
- What you built, and where it goes next