Use Autopsy to solve the following Frensic problem while you screenshot steps for a better understanding: Add commentry where nessessary.

Windows Investigation with Autopsy

Instructions

Create a lab report that includes the answers and screen shots requested below. Be

sure to number your responses and label them clearly. While you are finding answers to

the questions below make sure to Tag the relevant items. There are two kinds of tags,

Result tags and File tags. Make sure to use the appropriate tag for the data you are

interested in$.$

$1.$ Create a new case using Autopsy.

$1.$ Add the CBARROW evidence file to the case

$2.$ You can uncheck the following ingest modules: Android Analyzer,

PhotoRec Carve, Process Unallocated Space

$3.$ On the Hash Lookup ingest module make sure to check the option to

calculate MD$5$ hash values

$4.$ Once the options are configured add the evidence to the case and let

Autopsy finish processing.

$2.$ Answer the following questions about the disk image:

$1.$ What version of Windows is this?

$2.$ What is the install date and time of the system?

$3.$ Who is the owner of the system?

$4.$ What human useable user accounts exist?

$5.$ What version of WinZip is installed?

$6.$ Have any USB drives been used with this system? Provide a

manufacturer if so$.$

$3.$ Create a new Hash Database under the Tools $>$ Options menu.

$1.$ Click the Create Database button in the dialog.

$2.$ Name the hash set SuspiciousImages and save the database in your

Week$7$ folder.

$3.$ The type should be Known Bad and check the box to send messages.

$4.$ In some cases you may receive hashes as part of some IoCs and you would add

them directly to the case. Here we are going to build our own simulated IoC

hashes by adding some hashes to our SuspiciousImages hash set.

$1.$ Using the tree pane on the left side of Autopsy expand the Data

Sources item.

$2.$ Expand the tree to find the My Pictures folder of the user Clyde.

$3.$ Add all of the images with the yellow evidence banner into the

SuspicousImages hash set.

$5.$ Once you have built the complete hash set we are going to rerun the hash ingest

module to determine if there are any other suspicious images.

$1.$ Locate the CBARROW.E$01$ item under the Data Sources item in the tree

view.

$2.$ Right click the E$01$ and choose the Run ingest modules option.