The sample image file used in Autopsy
The image file used for analysis is publicly available for download at http://downloads.digitalcorpora.org/corpora/scenarios/2009-m57-patents/usb/.
The file we will be working with is terry-work-usb-2009-12-11.E01, as in the following screenshot:
Tip:
Be sure to note the location of the downloaded sample file, as this will be required later on.
When investigating hard drives and devices, be sure to always follow proper acquisition procedures and use a write blocker to avoid tampering with original evidence.