Sleuth Kit - Open Source Forensic Tool to Analyze Disk Images and Recover Files

SIFT is a Ubuntu based forensics distribution provided by SANS Inc. It consist of many forensics tools such as Sleuth kit / Autopsy etc . However, Sleuth kit/Autopsy tools can be installed on Ubuntu/Fedora distribution  instead of downloading complete distribution of SIFT.

Sleuth Kit /Autopsy is open source digital forensics investigation tool which is used for recovering the lost files from disk image and analysis of images for incident response. Autopsy tool is a web interface of sleuth kit which supports all features of sleuth kit. This tool is available for both  Windows and Linux Platforms.

Install Sleuth kit

First of all, download Sleuth kit software from sleuthkit website. Use wget command to download it in terminal which is shown in the figure.

Free and Open Source SAR Image Proc...

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

Free and Open Source SAR Image Processing Software

# wget http://cznic.dl.sourceforge.net/project/sleuthkit/sleuthkit/4.1.3/sleuthkit-4.1.3.tar.gz

Extract the sleuthkit-4.1.3.tar.gz  using following command and go inside the extracted directory

# tar -xvzf sleuthkit-4.1.3.tar.gz

Run following command which perform the requirement check before sleuth kit installation

#./configure

Make command compile the sleuth kit code.

#make

Finally following command install it under /usr/local path.

#make install

Install Autopsy Tool

Sleuth kit installation is complete and now we will install autopsy interface. Download Autopsy software from sleuthkit's autopsy page . Use wget command to download it in terminal which is shown in the figure.

# wget http://kaz.dl.sourceforge.net/project/autopsy/autopsy/2.24/autopsy-2.24.tar.gz

Extract the autopsy-2.24.tar.gz  using following command and go inside the extracted directory

# tar -xvzf autopsy-2.24.tar.gz

Configuration script of autopsy asks for NSRL (National Software Reference Library) and path of Evidence_Locker folder.

Enter "n" for NSRL prompt and create Evidence_Locker folder under /usr/local directory. Autopsy stores the configuration files, audit logs and output under Evidence_Locker folder.

#mkdir /usr/local/Evidence_Locker

#cd autopsy-2.24

#./configure

After adding Evidence_Locker path in installation process , autopsy stores configuration files in it and shows a following message to run the autopsy program.

Type ./autopsy command in terminal to start the graphical interface of Sleuth kit tool.

Type following address in the web browser to access the interface of autopsy .

http://localhost:9999/autopsy

Main web page of autopsy plugin is shown int the following figure.

Click on the New Case button to start analysis in autopsy tool. Enter the case name, description about the investigation and name of agent which is shown in the following figure.

Following web page will appear  after entering the details in the above page. Click on Add Host button to add details for the analyst machine.

Enter host name, description and time zone setting of analyst machine on the next page.

Click on the Add Image button to add image file for forensics analysis.

Click on the Add Image File button on the following web page.  It opens new web page which require Path of image file and select  type  & importing method.

As shown in the following figure, we have entered path of Linux image file. In our case, image file is  partition of disk.

Click on the next button and select Calculate hash option in the next page which is shown in the following figure. It also detect the file system type of the given image.

Following window shows the MD5 hash of the image file before static analysis .

On the next web page, autopsy shows following information about the image file.

• mount point for the image
• name of image
• file system type of given image

Click on the details button to get more information about the given image file. It also offer extraction of unallocated fragments and strings from the  volume of image file which is shown in the following figure.

Click on Analyze button which is shown in the below figure to start analysis on given image  . It opens another page which shows the multiple options for image analysis.

Autopsy offer following features during image analysis process.

• File Analysis
• Keyword Search
• File Type
• Image Details
• Data Unit

File Analysis on given  image of Linux partition is shown in the following figure.

It extracts all files and folders from the given image . Extraction of deleted files are shown int he figure.

Conclusion

Hopefully this article will be useful for the beginner in static forensics analysis of disk image. Autopsy is web interface for sleuth kit which provides features such as extraction of strings , recovery of deleted files, timeline analysis, extraction of web surfing history, keyword search and email analysis on windows and linux disk images.