# Launch autopsy # open GUI # → browser: http://localhost:9999/autopsy # CLI batch mode (Autopsy 4+) java -Xmx4g -cp autopsy.jar \ org.sleuthkit.autopsy.casemodule.CaseNewAction \ --casedir /tmp/case --casename mycase # Create case → add data source → analyze # Key modules to enable: # ✓ Hash Lookup # ✓ File Type Identification # ✓ Embedded File Extractor # ✓ Keyword Search # ✓ Recent Activity # ✓ Email Parser # ✓ Interesting Files # Add image: disk.img, memory.dmp, .e01, .l01
| Panel | What to look for |
|---|---|
| Data Sources | Browse raw filesystem incl. deleted files (marked *) |
| Views → Deleted Files | All deleted files across image |
| Views → File Types | Filter by extension: Images, Documents, Archives |
| Keyword Search | Search "picoCTF", "flag", "password" |
| Results → Interesting Files | Auto-flagged suspicious items |
| Results → Extracted Content | Browser history, recent docs, emails |
| Timeline | Activity timeline — spot anomalous timestamps |
| Communications | Email, chat, contact artifacts |
| Reports | Generate full HTML/Excel report |
# Scan image / file and extract artifacts bulk_extractor -o output/ disk.img bulk_extractor -o output/ memory.dmp bulk_extractor -o output/ file.bin # Parallel threads bulk_extractor -j 4 -o output/ disk.img # Specific scanner only bulk_extractor -e email -o out/ disk.img bulk_extractor -e url -o out/ disk.img bulk_extractor -e zip -o out/ disk.img # Disable scanner bulk_extractor -x base64 -o out/ disk.img # Recursive (scan inside zip/archive) bulk_extractor -R -o out/ disk.img # Set context window (bytes around hit) bulk_extractor -C 512 -o out/ disk.img
| File | Contains |
|---|---|
| email.txt | Email addresses found |
| url.txt | URLs |
| domain.txt | Domain names |
| ccn.txt | Credit card numbers |
| telephone.txt | Phone numbers |
| zip.txt | ZIP archives found |
| json.txt | JSON fragments |
| base64.txt | Base64 blobs |
| pii.txt | Personal identifiable info |
| carved/ | Extracted files (zip, pdf, etc.) |
| report.xml | Full machine-readable report |
# Quick: grep output for flag grep -r "picoCTF" output/ cat output/base64.txt | base64 -d 2>/dev/null | strings | grep "CTF"
# 1. Fast string hunt (30 seconds) strings disk.img | grep -i "picoCTF{\|flag{\|CTF{" strings -el disk.img | grep -i "picoCTF" # Unicode # 2. bulk_extractor sweep (background) bulk_extractor -j 4 -o /tmp/be_out/ disk.img & # 3. Mount and browse (while bulk_extractor runs) sudo mount -o ro,noload,loop disk.img /mnt/img find /mnt/img -type f | xargs file 2>/dev/null find /mnt/img -name ".*" # hidden files find /mnt/img -name "*.txt" -o -name "*.pdf" # interesting extensions # 4. Deleted files (Sleuth Kit) fls -rd disk.img # deleted fls -r -m "/" disk.img > body.txt mactime -b body.txt -d | grep "197\|198" # timestomping # 5. Autopsy for deeper analysis (GUI, parallel) # Use Keyword Search: "picoCTF", "flag", "password", "secret" # 6. Check bulk_extractor results grep -r "picoCTF" /tmp/be_out/ ls /tmp/be_out/carved/ # extracted files cat /tmp/be_out/base64.txt | while read line; do echo "$line" | base64 -d 2>/dev/null | grep -a "CTF" done
| Location | Tool | Command |
|---|---|---|
| Deleted files | TSK / Autopsy | fls -rd disk.img → icat |
| Timestomped files | TSK mactime | fls -r -m / | mactime | grep "197" |
| File slack space | TSK / blkls | blkls -s disk.img | strings |
| Unallocated space | TSK / foremost | blkls disk.img | foremost |
| Hidden files (.name) | find | find /mnt -name ".*" |
| Alternate data streams | TSK (NTFS) | fls -r disk.img | grep ":" |
| NTFS $MFT / $LogFile | Autopsy | Metadata Artifacts panel |
| Steganography in images | steghide / zsteg | steghide extract -sf img.jpg |
| Browser history | Autopsy / sqlite | Results → Web History |
| Registry Run keys | Autopsy / regripper | Results → Registry |
| Prefetch files | Autopsy | Results → Recent Activity |
| Base64 in files | bulk_extractor | cat output/base64.txt |
strings disk.img | grep "picoCTF{"
② bulk_extractor -j4 -o out/ disk.img
③ Mount → find -name ".*" → hidden files
④ fls -rd disk.img → deleted → icat
⑤ Autopsy Keyword Search → "flag", "picoCTF", "password"
⑥ grep -r picoCTF out/ → bulk_extractor results