Autopsy User Documentation  4.12.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
Logical Imager

Overview

The logical imager allows you to collect files from a live Windows computer. The imager is configured with rules that specify what files to collect. Rules can be based on file attributes such as folder names, extensions, and sizes. You can use this feature when you do not have time or authorization to perform a full drive acquisition.

The logical imager produces one or more sparse VHD images that contain all of the file system data that was read. These VHD images can be imported into Autopsy or mounted by Windows. The imager also enumerates the user accounts on the system and can generate alerts if encryption programs exist.

The general workflow is:

Configuration

To start, open Autopsy and go to Tools->Create Logical Imager.

tools_menu.png

In either case you can now configure your imager. If the configuration file already exists, this screen will be loaded with the current settings from the file.

main_config_panel.png

On the left side you can see each rule in the configuration file. Each of these rules will be applied against the live system. A rule has a name, an optional description, one or more conditions, and settings for what should happen when a file matching the rule is found. When you select a rule you'll see all the settings for that rule on the right side of the panel. You can edit or delete rules once you select them. There are also two global settings in the bottom right that apply to the configuration file as a whole:

To make a new rule, click on the "New Rule" button.

new_attr_rule.png

There are two rule types to choose from:

For either rule type, you start by entering a rule name and optional description. You will also need to choose at least one action to take when a match is found.

Attribute rules can have one or more conditions. All conditions must be true for a rule to match.

Full path rules have a single condition.

full_path_rule.png

Running Logical Imager

Running with the Default Configuration

Using the defaults in the configuration process will create a drive with the config file (named "logical-imager-config.json") and the logical imager executable in the root folder of your drive.

exe_folder.png

The default case is to run the logical imager on every drive except the one containing it. Note that the logical imager executable must be in the root directory for the drive to be skipped. To run the imager, right-click on "tsk_logical_imager.exe" and select "Run as administrator". This will open a console window where you'll see some information about the processing and if you set any rules to create alerts, you'll see matches in the console window as well. The window will close automatically when the processing is complete.

The logical imager will start writing the sparse VHD(s) and any other data to a directory next to the executable.

output_folder.png

Running from a Command Prompt

To run the logical imager with custom settings, you'll need to first open a command prompt in administrator mode (right-click and then select "Run as administrator"). Then switch to the drive where logical imager is located. You can run using the default configuration by simply typing "tsk_logical_imager.exe".

command_prompt.png

If your configuration file is not named "logical-imager-config.json" (for example, if you have multiple configuration files for different situations), you'll need to specify the file name using the "-c" flag.

config_flag.png

If you want to specify the drive to run on, you can use the "-i" flag. This can be helpful for testing your configuration file - you can create a small USB drive with files that should match your rules to ensure that everything is working correctly before using it on a real system. The following example shows how to only run on the "G" drive on this system:

image_flag.png

Viewing Results

The logical imager results can be added to an Autopsy case as a data source. This brings in the sparse VHD(s) as a disk image and also adds the other files created by the logical imager. Select the "Autopsy Imager" option and proceed to the next page.

dsp_select.png

In the top section, you can see all the logical imager result folders in the root folder of each drive. Select the one you want to add and then hit the "Next" button.

import.png

If your logical imager results are in a different location, select "Manually Choose Folder" and use the "Browse" button to locate your results.

In either case you'll get to configure the ingest modules to run. You can run any of them, but since your disk image may not be complete you may see more errors than normal. For example, the sparse VHD may contain the entire file allocation table but the actual data that goes with the files will be missing.

The alert and user files created by the logical imager can be found under the Reports section of the Tree Viewer.


Copyright © 2012-2019 Basis Technology. Generated on Wed Sep 18 2019
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.