File Category Type Analysis Help

Overview

Analyzing large file system images can be very daunting. One way of identifying files that should be examined is to sort the files based on file type. This mode of Autopsy will allow one to sort the files in an image based on type and to exclude known files (i.e. data reduction). It also allows one to flag files that are known to be bad.

Procedure

The sorter document in the docs directory of The Sleuth Kit has more details on the details, but this will provide an overview of the interface given by Autopsy.

The first step is to Sort the image. There are several options to choose when doing this. The sorter tool from The Sleuth Kit will perform the sorting. There are two major actions that sorter can do: sort files by type and validate extensions.

By default, Autopsy will perform both actions. If you do not want it to do a given action, deselect it.

Within sorting, there are two options:

During the sorting process, the sorter tool will also examine the extension of the file. If the file type is known, it has known extensions, and the file does not have one of those extensions, it will be added to a mismatch file. This can be deselected if it is not wanted.

Hash Databases

One easy way of data reduction is to use hash databases. The sorter tool can use three different hash databases. Each can be configured within Autopsy and used in other screens.

More details can be found in the Hash Database Help.

Output

Currently, there is no way to view the output from within Autopsy. All data can be found in the output directory of the host. A directory is created for the sorter output. View the index.html file and it contains links to the other files.

References

Issues 3, 4, and 5 of The Sleuth Kit Informer discussed using the 'sorter' tool.
Brian Carrier