Autopsy User Documentation  4.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
Interesting Files Module

Overview

The Interesting Files module allows you to search for files or directories in a data source and generate alerts when they are found. You configure rules for the files that you want to find.

You would use this to be notified when certain things are found. There are examples later in this file to generate alerts when VMWare images are found or when iPhone backup files are found. This module is useful for file types that will frequently have a consistent name and that may not be part of the stanadrd checklist that you look for (or if you simply want to automated your checklist).

Rules

Add rules using Tools -> Options -> Interesting Files.

All rules need to be part of a set. Sets need to have the following defined:

Rules specify what to look for in a data source. Each rule specifies:

Example

VMWare

This set of rules is to detect VMWare Player or vmdk files. This would help to make sure you look into the virtual machines for additional evidence.

NOTE: This is not extensive and is simply a minimal example:

iPhone Backups

This set of rules is to detect a folder for iPhone Backups. These are typically in a folder such as "%AppData%\Roaming\Apple Computer\MobileSync\Backup" on Windows. Here is a rule that you could use for that.

Using the Module

When you enable the Interesting Files module, you can choose what rule sets to enable. To add rules, use the "Advanced" button from the ingest module panel.

When files are found, they will be in the Interesting Files area of the tree. You shoudl see the set and rule names with the match.


Copyright © 2012-2015 Basis Technology. Generated on Wed Apr 6 2016
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.