Digital Forensics Lab: Disk Image Analysis with Autopsy
Go hands-on with the forensic imaging and analysis workflow — write-blocking, hash verification, the NTFS MFT, file carving, and timeline reconstruction in Autopsy.
Learning Objectives
- → Explain the disk imaging process and why write-blockers and hash verification matter
- → Navigate Autopsy's core modules: timeline analysis, file carving, and deleted file recovery
- → Interpret NTFS's Master File Table (MFT) as the primary source of file metadata and timestamps
- → Reconstruct a suspect's activity timeline from combined filesystem and application artifacts
- → Explain file carving as a technique for recovering data with no intact filesystem metadata
From Concept to Practice
"Incident Response & Digital Forensics" introduced chain of custody, order of volatility, and forensic imaging at a conceptual level. This lab goes hands-on with the actual workflow: acquiring a forensically sound disk image and analyzing it in Autopsy, the leading open-source disk forensics platform.
Imaging: Getting a Forensically Sound Copy
Before any analysis, the original evidence must never be touched directly:
- Connect the suspect drive through a write-blocker — hardware or software that physically prevents any write command from reaching the original media
- Create a bit-for-bit image (commonly
.E01or raw.ddformat) - Compute a cryptographic hash (SHA-256) of both the original drive and the resulting image
- Confirm the hashes match — this is the technical proof that the image is an exact, unaltered copy, and the foundation of the chain-of-custody argument in court
Every step of analysis from here forward happens on the image, never the original.
The Master File Table (MFT): NTFS's Source of Truth
On an NTFS filesystem, the MFT records metadata for every file: name, size, timestamps (created, modified, accessed, MFT-entry-modified — the "MACE" times), and pointers to where its data actually lives on disk. Even after a file is deleted, its MFT entry often persists until overwritten, which is exactly why deleted files are frequently recoverable — the data blocks aren't immediately erased, only unlinked.
Autopsy's Core Modules
| Module | Purpose |
|---|---|
| Timeline Analysis | Plots file system events (creation, modification, access) chronologically across the entire image |
| File Carving | Recovers files by scanning raw disk space for known file signatures (magic bytes), independent of filesystem metadata |
| Deleted File Recovery | Surfaces files whose MFT entries still exist but whose directory entries were removed |
| Keyword Search | Indexes and searches all recovered text across the image |
File Carving: Recovery Without Metadata
When a file's MFT entry itself has been overwritten (not just its directory entry), Autopsy can still often recover it via file carving — scanning raw disk sectors for a file type's known header/footer byte signatures (e.g. JPEG's FFD8FF header) and extracting everything in between as a candidate file, with no dependency on filesystem metadata surviving at all.
Building a Timeline
A single artifact rarely tells the whole story. A forensic timeline combines multiple sources — MFT timestamps, Windows Event Logs, browser history, prefetch files (which record program execution) — into one chronological view, letting an investigator answer "what happened, in what order" rather than examining isolated artifacts individually.
Common Pitfalls
- Analyzing the original drive directly instead of a verified image, destroying the chain-of-custody argument
- Trusting a single timestamp type (e.g. only "modified" time) without cross-referencing MACE times, which can each tell a different part of the story
- Assuming a deleted file is unrecoverable just because it doesn't appear in a normal directory listing
- Treating file carving results as automatically reliable — carved files lack filename/timestamp context and require independent corroboration
A matching hash is the entire technical basis of the chain-of-custody argument for a forensic image.
Why must the original drive's hash and the forensic image's hash match before analysis begins?
Deletion typically only unlinks a directory entry — the underlying MFT record and data blocks can persist for a long time afterward.
Why are deleted files on NTFS often still recoverable?
Carving works directly on raw bytes, with no dependency on any filesystem structure surviving at all.
What does file carving rely on to recover a file when its MFT entry is gone?
💪 Exercises & Challenges
Digital Forensics Lab: Disk Image Analysis with Autopsy MCQ
Test your understanding of Digital Forensics Lab: Disk Image Analysis with Autopsy.
Reconstruct a Timeline from Multiple Artifacts
Given three artifacts from a disk image — (1) an MFT entry showing a file 'invoice.exe' created at 14:02, (2) a Windows Event Log entry showing a process execution for 'invoice.exe' at 14:03, (3) a pr
Choose the Right Recovery Technique
A forensic image shows: an MFT entry for 'update.exe' whose directory entry no longer exists (i.e., the file has been deleted from the visible file listing), but the MFT entry itself is intact and una