End-to-end digital forensics lab: forensic image acquisition with FTK Imager and deleted file recovery & artifact analysis with Autopsy
Objective • Tools • Acquisition • Analysis • Findings • References
Simulate a post-incident data recovery scenario on a potentially compromised USB flash drive. The goal is to perform a forensically sound acquisition of the physical media, preserve evidentiary integrity via cryptographic hash verification, and recover deleted data from unallocated NTFS sectors — following a workflow aligned with NIST SP 800-86 guidelines.
| Tool | Version | Purpose |
|---|---|---|
| FTK Imager | 4.7.1 | Forensic disk imaging & integrity verification |
| Autopsy | 4.22.1 | Open-source digital forensics platform (The Sleuth Kit GUI) |
| Property | Value |
|---|---|
| Device | SanDisk Cruzer Blade USB |
| Interface | USB (Removable) |
| Capacity | 7,632 MB (~7.45 GB) |
| Sector Count | 15,630,336 |
| Bytes/Sector | 512 |
| File System | NTFS |
Selected the USB device as a physical drive (\\.\PHYSICALDRIVE1) to enable raw sector-level access, capturing the complete bitstream including unallocated space, slack space, and hidden partitions.
Chose E01 (Expert Witness Format) for the forensic image:
- Embeds metadata (examiner name, case number, timestamps, notes)
- Supports compression to reduce storage footprint
- Supports image fragmentation (1.5 GB segments)
- Optional AES-256 encryption for evidence confidentiality
Populated chain-of-custody metadata fields:
- Case Number, Evidence Number
- Examiner Name
- Description and Notes
- Image source:
\\.\PHYSICALDRIVE1 - Output:
data recovery case.E01throughdata recovery case.E06 - Write speed: ~22 MB/sec
- Total size: ~7.5 GB across 6 E01 segments
Enabled both MD5 and SHA-1 hashing for pre- and post-image integrity verification.
| Algorithm | Computed Hash | Stored Verification Hash | Result |
|---|---|---|---|
| MD5 | 1dfbdb9f8dbedf54bc6165c1c85577c3 |
1dfbdb9f8dbedf54bc6165c1c85577c3 |
Match |
| SHA-1 | 419ef6f163508e5a91a38ada7238650270... |
419ef6f163508e5a91a38ada7238650270... |
Match |
Bad Blocks: None detected — zero data tampering confirmed.
- Drive Geometry: 972 Cylinders, 255 Tracks/Cylinder, 63 Sectors/Track
- Acquisition window:
Sat May 24 00:48:44 2025→Sat May 24 00:54:19 2025
| File | Size |
|---|---|
data recovery case.E01 – .E05 |
1,535,925 KB each (~1.5 GB) |
data recovery case.E06 |
138,421 KB (final segment) |
data recovery case.E01.csv |
26 KB (file listing) |
data recovery case.E01.txt |
2 KB (acquisition log) |
Created a new case (test case autopsy) and loaded the .E01 image as the data source. Autopsy detected:
- vol1 — Unallocated (sectors 0–31)
- vol2 — NTFS / exFAT (sectors 32–15,630,335)
Enabled all ingest modules to maximize artifact extraction:
| Module | Function |
|---|---|
| Recent Activity | Browser history, USB activity, recent documents |
| Hash Lookup | NSRL & custom hash set matching |
| File Type Identification | MIME-type detection via magic bytes |
| Extension Mismatch Detector | Flags renamed/obfuscated files |
| Embedded File Extractor | Extracts files from archives and containers |
| Picture Analyzer | EXIF metadata, geolocation extraction |
| Keyword Search | Full-text indexing with regex support |
| Email Parser | Parses email archives (PST, MBOX) |
| Encryption Detection | Identifies encrypted volumes/files |
| Interesting Files Identifier | Rule-based flagging of notable artifacts |
| PhotoRec Carver | Header/footer-based file carving from unallocated space |
| Virtual Machine Extractor | Detects and extracts VM disk images |
Autopsy parsed the NTFS file system and scanned unallocated space, recovering 70+ deleted files:
Recovered file types:
.pdf(25 files) — IoT lecture materials, wireless protocol documentation.ppt/.pptx(20 files) — Presentation slide decks.docx— Word documents.jpg— Image files with EXIF metadata
Recovery sources:
$MFTremnants (Master File Table entries for deleted files)$LogFiletransaction logs- Slack space and unallocated NTFS clusters
- PhotoRec carved fragments (header/footer signature matching)
Demonstrated advanced search capabilities:
- Name-based search (e.g., keyword
iot) - Date range filtering with MAC timestamp support (Modified, Accessed, Created, Changed)
- Size filtering, MIME type filtering
- Known status matching (Unknown, NSRL Known, Notable)
- Deleted file filter toggle
- Hash-based search (MD5, SHA-256)
Autopsy 4.22.1 plugin architecture supports:
- Java-based ingest modules and viewers
- Python-based plugins for custom analysis workflows
- Modules for keyword search, recent activity, email parsing
- Extensible via third-party plugin installer
Exported structured metadata for all file system entries including:
| Field | Description |
|---|---|
Filename |
Original filename |
Full Path |
Partition + NTFS path |
Size (bytes) |
File size |
Created / Modified / Accessed |
MAC timestamps (UTC) |
Is Deleted |
Deletion status flag |
| Metric | Value |
|---|---|
| Total files recovered | 70+ |
| Deleted files identified | 70 (from unallocated + $MFT) |
| File types recovered | PDF, PPT, DOCX, JPG |
| Hash verification | MD5 + SHA-1 — both matched |
| Bad blocks detected | 0 |
| EXIF metadata entries | 1 (geolocation-embedded image) |
| Keyword hits | 16 |
| Email addresses extracted | 16 |
| Suspicious items flagged | 14 |
This lab follows the digital evidence handling workflow defined by:
- NIST SP 800-86 — Guide to Integrating Forensic Techniques into Incident Response
- SWGDE Best Practices — Scientific Working Group on Digital Evidence
- ACPO Guidelines — Association of Chief Police Officers (digital evidence principles)
┌─────────────────────────────────────────────────────────────────┐
│ FORENSIC WORKFLOW │
├─────────────────────────────────────────────────────────────────┤
│ │
│ ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────┐ │
│ │Identifi- │───▶│Acquisi- │───▶│ Analysis │───▶│Reporting │ │
│ │cation │ │tion │ │ │ │ │ │
│ └──────────┘ └──────────┘ └──────────┘ └──────────┘ │
│ Select USB FTK Imager Autopsy 4.22 HTML/CSV │
│ as physical E01 format Full ingest export + │
│ evidence MD5 + SHA1 module suite hash logs │
│ verification │
└─────────────────────────────────────────────────────────────────┘
- Forensically sound disk imaging (bit-for-bit acquisition)
- Cryptographic integrity verification (MD5 / SHA-1)
- E01 (Expert Witness Format) image creation and management
- NTFS file system internals ($MFT, $LogFile, unallocated space)
- Deleted file recovery and file carving techniques
- MAC timestamp analysis for timeline reconstruction
- EXIF metadata extraction and geolocation mapping
- Keyword search and regular expression matching
- Chain of custody documentation
- Forensic report generation (HTML, CSV, Excel)
- NIST SP 800-86 — Guide to Integrating Forensic Techniques into Incident Response
- Autopsy Documentation — The Sleuth Kit
- FTK Imager User Guide — Exterro
- SWGDE Best Practices for Digital & Multimedia Evidence
This project is for educational purposes only. All forensic analysis was conducted on personally owned media.
⭐ If you found this project useful, consider starring the repository.
Built as a hands-on digital forensics lab for DFIR skill development