analyzing-disk-image-with-autopsy

使用 Autopsy 分析磁盘映像

适用场景

• 拥有取证磁盘映像，需要对其内容进行结构化分析时
• 在需要恢复文件、搜索关键词和分析时间线的调查过程中
• 非技术相关方需要查看取证证据的可视化报告时
• 检查文件系统元数据、已删除文件和嵌入式痕迹时
• 根据多个磁盘映像构建完整案件时

前提条件

• 已安装 Autopsy 4.x（Windows），或已安装 Autopsy 4.x 和 The Sleuth Kit（Linux）
• 原始（dd）、E01（EnCase）或 AFF 格式的取证磁盘映像
• 至少 8GB RAM（大型映像建议使用 16GB）
• Autopsy 需要 Java Runtime Environment（JRE）8+
• 有足够的磁盘空间存储 Autopsy 案件数据库（映像大小的 2～3 倍）
• 用于文件识别的哈希数据库（NSRL、已知恶意哈希）

工作流

步骤 1：安装 Autopsy 并配置环境

# On Linux, install Sleuth Kit and Autopsy
sudo apt-get install autopsy sleuthkit

# Download Autopsy 4.x (GUI version) from official source
wget https://github.com/sleuthkit/autopsy/releases/download/autopsy-4.21.0/autopsy-4.21.0.zip
unzip autopsy-4.21.0.zip -d /opt/autopsy

# On Windows, run the MSI installer from sleuthkit.org
# Launch Autopsy
/opt/autopsy/bin/autopsy --nosplash

# For Sleuth Kit command-line analysis alongside Autopsy
sudo apt-get install sleuthkit

步骤 2：创建新案件并添加磁盘映像

1. Launch Autopsy > "New Case"
2. Enter Case Name: "CASE-2024-001-Workstation"
3. Set Base Directory: /cases/case-2024-001/autopsy/
4. Enter Case Number, Examiner Name
5. Click "Add Data Source"
6. Select "Disk Image or VM File"
7. Browse to: /cases/case-2024-001/images/evidence.dd
8. Select Time Zone of the original system
9. Configure Ingest Modules (see Step 3)

# Alternatively, use Sleuth Kit CLI to verify the image first
img_stat /cases/case-2024-001/images/evidence.dd

# List partitions in the image
mmls /cases/case-2024-001/images/evidence.dd

# Output example:
# DOS Partition Table
# Offset Sector: 0
# Units are in 512-byte sectors
#      Slot    Start        End          Length       Description
#      00:  -----   0000000000   0000002047   0000002048   Primary Table (#0)
#      01:  00:00   0000002048   0001026047   0001024000   NTFS (0x07)
#      02:  00:01   0001026048   0976771071   0975745024   NTFS (0x07)

# List files in a partition (offset 2048 sectors)
fls -o 2048 /cases/case-2024-001/images/evidence.dd

步骤 3：配置并运行摄取模块

Enable the following Autopsy Ingest Modules:
- Recent Activity: Extracts browser history, downloads, cookies, bookmarks
- Hash Lookup: Compares files against NSRL and known-bad hash sets
- File Type Identification: Identifies files by signature, not extension
- Keyword Search: Indexes content for full-text searching
- Email Parser: Extracts emails from PST, MBOX, EML files
- Extension Mismatch Detector: Finds files with wrong extensions
- Exif Parser: Extracts metadata from images (GPS, camera, timestamps)
- Encryption Detection: Identifies encrypted files and containers
- Interesting Files Identifier: Flags files matching custom rule sets
- Embedded File Extractor: Extracts files from ZIP, Office docs, PDFs
- Picture Analyzer: Categorizes images using PhotoDNA or hash matching
- Data Source Integrity: Verifies image hash during ingest

# Configure NSRL hash set for known-good filtering
# Download NSRL from https://www.nist.gov/itl/ssd/software-quality-group/national-software-reference-library-nsrl
wget https://s3.amazonaws.com/rds.nsrl.nist.gov/RDS/current/rds_modernm.zip
unzip rds_modernm.zip -d /opt/autopsy/hashsets/

# Import into Autopsy:
# Tools > Options > Hash Sets > Import > Select NSRLFile.txt
# Mark as "Known" (to filter out known-good files)

步骤 4：分析文件系统并恢复已删除文件

# In Autopsy GUI: Navigate tree structure
# - Data Sources > evidence.dd > vol2 (NTFS)
# - Examine directory tree, note deleted files (marked with X)

# Using Sleuth Kit CLI for targeted recovery
# List deleted files
fls -rd -o 2048 /cases/case-2024-001/images/evidence.dd

# Recover a specific deleted file by inode
icat -o 2048 /cases/case-2024-001/images/evidence.dd 14523 > /cases/case-2024-001/recovered/deleted_document.docx

# Extract all files from a directory
tsk_recover -o 2048 -d /Users/suspect/Documents \
   /cases/case-2024-001/images/evidence.dd \
   /cases/case-2024-001/recovered/documents/

# Get detailed file metadata
istat -o 2048 /cases/case-2024-001/images/evidence.dd 14523
# Shows: creation, modification, access, MFT change timestamps, size, data runs

步骤 5：执行关键词搜索并标记证据

In Autopsy:
1. Keyword Search panel > "Ad Hoc Keyword Search"
2. Search terms: credit card patterns, SSN regex, email addresses
3. Example regex for credit cards: \b(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14})\b
4. Example regex for SSN: \b\d{3}-\d{2}-\d{4}\b
5. Review results > Right-click items > "Add Tag"
6. Create tags: "Evidence-Critical", "Evidence-Supporting", "Requires-Review"
7. Add comments to tagged items documenting relevance

# Using Sleuth Kit for CLI keyword search
srch_strings -a -o 2048 /cases/case-2024-001/images/evidence.dd | \
   grep -iE '(password|secret|confidential)' > /cases/case-2024-001/keyword_hits.txt

# Search for specific file signatures
sigfind -o 2048 /cases/case-2024-001/images/evidence.dd 25504446
# 25504446 = %PDF header signature

步骤 6：构建时间线并生成报告

In Autopsy:
1. Timeline viewer: Tools > Timeline
2. Select date range of interest (incident window)
3. Filter by event type: File Created, Modified, Accessed, Web Activity
4. Zoom into suspicious time periods
5. Export timeline events as CSV for external analysis

Generate Report:
1. Generate Report > HTML Report
2. Select tagged items and data sources to include
3. Configure report sections: file listings, keyword hits, timeline
4. Export to /cases/case-2024-001/reports/

# Using Sleuth Kit mactime for CLI timeline
fls -r -m "/" -o 2048 /cases/case-2024-001/images/evidence.dd > /cases/case-2024-001/bodyfile.txt

# Generate timeline from bodyfile
mactime -b /cases/case-2024-001/bodyfile.txt -d > /cases/case-2024-001/timeline.csv

# Filter timeline to specific date range
mactime -b /cases/case-2024-001/bodyfile.txt \
   -d 2024-01-15..2024-01-20 > /cases/case-2024-001/incident_timeline.csv

核心概念

概念	描述
摄取模块	导入数据源时对其进行处理的自动化分析插件
MFT（主文件表）	NTFS 元数据结构，记录所有文件条目和属性
文件雕刻	使用文件签名从未分配空间恢复文件
哈希筛选	使用 NSRL 或自定义哈希集排除已知良性文件，或标记已知恶意文件
时间线分析	按时间顺序重建文件系统和用户活动事件
已删除文件恢复	恢复目录条目已被移除但数据仍然存在的文件
关键词索引	根据所有文件内容（包括松弛空间）构建的全文搜索索引
痕迹提取	自动解析浏览器、电子邮件、注册表和特定操作系统的痕迹

工具与系统

工具	用途
Autopsy	用于磁盘映像分析的开源 GUI 取证平台
The Sleuth Kit（TSK）	Autopsy 底层的命令行取证工具包
fls	列出磁盘映像中的文件和目录，包括已删除的条目
icat	根据 inode 编号从磁盘映像中提取文件内容
mactime	根据 TSK bodyfile 格式生成时间线
mmls	显示磁盘映像的分区布局
NSRL	用于识别已知软件文件的 NIST 哈希数据库
sigfind	在扇区级别搜索文件签名

常见场景

场景 1：员工数据盗窃调查 导入员工工作站映像，运行所有摄取模块，搜索公司机密文件名和关键词，在“最近活动”中检查 USB 连接痕迹，检查云存储客户端痕迹，查看已删除文件以查找数据准备证据，为法务团队生成 HTML 报告。

场景 2：恶意软件感染取证 添加受感染的系统映像，启用扩展名不匹配和加密检测模块，检查预取目录以查找执行证据，搜索已知恶意软件哈希值，围绕感染时间段构建时间线，提取可疑可执行文件，以便在沙箱中进一步分析。

场景 3：儿童性虐待材料（CSAM）调查 导入映像，并启用 PhotoDNA 和 Project VIC 哈希集，运行图片分析器模块，将所有图像文件与已知恶意数据库进行哈希比对，按严重程度标记并分类匹配项，生成包含证据保管链文档的执法报告。

场景 4：知识产权纠纷 将多份员工磁盘映像作为独立数据源导入同一案件，使用专有术语和项目名称进行关键词搜索，比较不同数据源中的文件哈希值，构建显示文件访问和传输模式的时间线，导出证据供法务审查。

输出格式

Autopsy Case Analysis Summary:
  Case:           CASE-2024-001-Workstation
  Image:          evidence.dd (500GB NTFS)
  Partitions:     2 (System Reserved + Primary)
  Total Files:    245,832
  Deleted Files:  12,456 (recoverable: 8,234)

  Ingest Results:
    Hash Matches (Known Bad):  3 files
    Extension Mismatches:      17 files
    Keyword Hits:              234 across 45 files
    Encrypted Files:           5 containers detected
    EXIF Data Extracted:       1,245 images with metadata

  Tagged Evidence:
    Critical:     12 items
    Supporting:   34 items
    Review:       67 items

  Timeline Events:  1,234,567 entries (filtered to incident window: 892)
  Report:          /cases/case-2024-001/reports/autopsy_report.html