Hacking Trainer AcademyAmeerpet · Hyderabad
+91 86868 92922 Book free classes

SOC and blue team

Autopsy and the Sleuth Kit for Beginners: Disk Forensics

· 2 min read · By Thimmagurudu Bathini, Lead Trainer and Curriculum Designer

The Sleuth Kit is a set of command-line forensic tools, and Autopsy is a graphical program built on it. Together they let you look through a disk image without changing it. First read digital forensics for beginners. Use only evidence you created or that is published for training.

Make a Practice Image

On a Linux virtual machine, build a small disk image with some files, then delete one:

  • dd if=/dev/zero of=practice.img bs=1M count=64
  • mkfs.ext4 practice.img
  • mkdir mnt && sudo mount -o loop practice.img mnt
  • Copy a few text files into mnt, delete one, then sudo umount mnt.
  • sha256sum practice.img records the hash. Check it again before and after your analysis to prove the image did not change.

Look with the Sleuth Kit

  • fls -r practice.img lists files, and deleted ones are marked with an asterisk.
  • fls -r -d practice.img lists only deleted entries.
  • icat practice.img INODE > recovered.txt extracts a file by its inode number.
  • mmls shows the partition layout of a real disk image.

Install with sudo apt install sleuthkit.

Review It in Autopsy

  • Download Autopsy from the Sleuth Kit website (the Windows installer is the easiest).
  • Create a new case and add practice.img as a data source.
  • Keep the default ingest modules, such as file type identification and hash lookup, then let them finish.
  • Browse the file tree, open the Deleted Files view and check the Timeline.
  • Generate a report to see how findings are exported.

Good Habits

  • Always work on a copy and keep the original hash.
  • Write down every step with the date and time.
  • Say what you could not determine, not only what you found.

Where It Fits

Disk analysis is covered in the modules of EC-Council's CHFI; see the CHFI exam guide. Memory is the other half of the evidence; see Volatility for beginners.

Sources and Further Reading

Want to work with crafted evidence files under supervision? Book free trial classes. Contact us or call +91 86868 92922.

Courses Mentioned in This Guide

Intermediate to advanced · EC-Council certification

Computer Hacking Forensic Investigator (CHFI v11)

Investigate incidents and handle digital evidence properly.

₹37,000 + GST

  • Evidence acquisition
  • Disk and OS forensics
  • Network and cloud forensics
  • Reporting
View the certification →
Beginner to intermediate · Course · 6 weeks, 90 hours

SOC Analyst and DFIR

The core concepts of EC-Council's CCT, CSA, ECIH and CHFI, taught hands-on with Splunk, Wazuh and forensics tools, in six weeks.

₹20,000 + GST · 6 weeks

  • CCT, CSA, ECIH, CHFI core concepts
  • Splunk and Sentinel
  • Phishing triage and hunting
  • Incident handling
  • Forensics and malware analysis
View the course →
Advanced · EC-Council certification

Certified Incident Handler (ECIH v3)

When the alert is real. Respond, investigate and recover.

₹34,000 + GST

  • Incident response
  • Digital forensics
  • Malware analysis
  • Legal compliance
View the certification →

More Guides

SOC and blue team · 2 min read

Digital Forensics for Beginners: Chain of Custody and First Steps

A beginner guide to digital forensics: the investigation process, chain of custody, why you never work on the original, free tools to practice and the career.

Read the guide →
SOC and blue team · 2 min read

Volatility for Beginners: Memory Forensics Cheat Sheet

Volatility 3 cheat sheet for memory forensics: list processes, command lines and network connections, and find injected code in a Windows image.

Read the guide →
Certification · 2 min read

CHFI v11 Certification: Exam Format, Eligibility and 15 Modules

What the EC-Council CHFI exam looks like: 150 questions in 4 hours, the 15 modules, 68 labs, who can start and what digital forensics work involves.

Read the guide →
SOC and blue team · 2 min read

Ransomware Explained: How It Works and How to Respond

How ransomware gets in, spreads and encrypts, what double extortion means, the defenses that matter and the first response steps for a security team.

Read the guide →

Start Your Cyber Security Career

Talk to a counselor, choose the right course for your goals, and get the fee, syllabus and next batch dates in writing.

Book Free Trial Classes

By submitting, you agree that Hacking Trainer Academy may contact you about courses by phone, WhatsApp or email. See our privacy notice and refund policy.

WhatsApp