Lab: Autopsy — Deleted File Recovery & Activity Timeline
🔬 Lab Practical — DFIR Practical 2 | Est. time: 4 hrs
🎯 Objective
Load a pre-seeded forensic image in Autopsy; recover deleted files; extract recent activity artefacts; build a chronological timeline.
📝 Procedure
Step 1: Create Case in Autopsy
- Open Autopsy → New Case
- Enter case name and number
- Add Data Source → Disk Image (.E01)
- Enable all ingest modules
- Wait for processing to complete
Step 2: Recover Deleted Files
- Navigate to “Deleted Files” in tree view
- Look for deleted documents, images, executables
- Right-click → Extract File(s) → Save to analysis folder
- Note: file path, original name, timestamps
Step 3: Extract Activity Artefacts
- Recent Documents: Check Recent Documents module
- Browser History: Web History module → URLs, timestamps, search queries
- USB Devices: Check extracted registry artefacts
- Downloads: Check Downloads folder and browser downloads
Step 4: Build Timeline
- Use Timeline module in Autopsy
- Or export to CSV for manual analysis
- Create chronological narrative (min 5 events)
| # | Timestamp | Event | Source | Significance |
|---|---|---|---|---|
| 1 | ||||
| 2 |
✅ Expected Output
- Deleted file recovery screenshot
- Recent documents list
- Browser history screenshot
- USB device table
- Timeline CSV with 5-event narrative
💭 Observation Questions
- In NTFS, when does deleted data become truly unrecoverable?
- Timeline shows document access at 23:47 and USB connection at 23:49. What hypothesis does this support?