Windows Forensics Practice: Learning to use Autopsy
Learning the basics of investigating using Autopsy. I'm trying to get some experience using windows forensics tools. The lab provides a forensic image that you have to import into Autopsy for analysis. Once imported there are some questions to answer through using the tool for investigation. 1. What is the hostname of the user's machine? I found the hostname through exploring the Operating System Information in the Extracted Content. Once selected you can see the hostname is IE11WIN7. 2. Looking at EXIF data, what camera make was "Hack-Messages[1].jpg" After navigating to the EXIF data folder, you can see the camera make is shown to be a Canon. 3. In the IEUser's desktop there is a zip file; what is the token stored in the file in the zip archive? After navigating to the IEUser's Desktop folder and selecting the Hidden.zip file, you can see the token located in the strings.
