The first thing we're going to take a look at is case management.
Managing your cases effectively means that you'll be
able to keep track of evidence, its chain of custody,
and improve workflows within your organization or perhaps
even just your own personal workflows.
Within Autopsy,
you can upload various evidence types to each case for further examination.
Before we start finding bad,
we've got to know how to leverage the tools that we have at hand.
In our first demonstration,
we're going to do a quick overview of the Autopsy GUI.
Specifically,
we're going to look into how to open a new case and how
to load evidence files into that case.
This is going to lay a lot of the groundwork for
future demonstrations in this course.
Our first demonstration is just going to be taking a look at
Autopsy and looking at how to open up a new case,
as well as add evidence files to that case.
When you open up Autopsy for the first time,
you're going to be presented with something very
similar to what I have open here.
So to get started,
we're just going to go ahead and double‑click on the New Case button. On the
Case Information page, this is your opportunity to enter a case name. For this
example, we're going to be using Example_Case. And set the base directory.
We'll be keeping ours as the S drive for now.
On the next screen is the Optional Information screen.
This allows you to input things like case number and examiner name, as well as
contact information. For this demonstration, we're just going to keep the
examiner name entered, and we'll leave the phone and email spots blank. But
we'll enter some notes just in case anyone else decides to use this. For our
purposes, this is just an example case.
Okay, folks, now once Autopsy finishes processing our case, we're
presented with a Data Source screen. We'll leave the default and have it
generate a new host name based on the data source name. For these demos,
we'll be using a disk image or VM file.
However,
Autopsy does give you a pretty decent variety of data sources to choose from,
which can really come in handy during investigations. Here,
we'll browse to select our evidence file. And in this case,
we'll be using the Example_Image.EO1 file.
We'll be keeping the ingest modules on the default setting and
allowing it to run on unallocated space.
However,
you have the option not to run these on unallocated space
or even create and edit custom filters.
We'll also be selecting all of the default modules
to run against our evidence file.
Once you hit Finish on the screen,
you have successfully opened your first case and loaded
your first piece of data into Autopsy.