Downloading sample files for use and creating a case in the Autopsy browser
In this section, we will find the links to download the required sample files that we will be analyzing using the Autopsy browser.
Download the image file
The image file used for analysis is publicly available for download at http://downloads.digitalcorpora.org/corpora/scenarios/2009-m57-patents/usb/.
Be sure to note the location of the downloaded sample file, as this will be required later on.
The file we will be working with is terry-work-usb-2009-12-11.E01, as shown in the following screenshot:
Figure 12.1 – Sample evidence files at digitalcorpora.org
Please note
When investigating hard drives and devices, be sure to always follow proper acquisition procedures and use a write-blocker to avoid tampering with original evidence.
Now that we have our sample image file downloaded (or perhaps even a forensically acquired image of our own), let’s proceed...
