Summary
In this chapter, we looked at forensics using the Autopsy Forensic Browser with The Sleuth Kit. Compared to individual tools, Autopsy has case management features and supports various types of file analysis, searching, and the sorting of allocated, unallocated, and hidden files. Autopsy can also perform hashing on the file and directory levels to maintain evidence integrity. We also compared Autopsy for Linux and Windows to view the differences. It's up to you to decide which one you prefer to work with. We will now move on to the Digital Forensic Framework (DFF), which, like Autopsy, allows us to perform file carving and analysis on forensic images.