Autopsy Hands on Labs

Practise finding a missing project file in your browser, then use the real Autopsy tool to examine a small training image. Both labs end with a file and notes to hand over.

Interactive Lab

Browser practice

Autopsy Interactive Lab

Expand labOpen in new tab

✓ No installation

The Aster review file is missing from workstation WS-07. Your team has a checked disk image copy. Find the file, check when it moved to the Recycle Bin and save a copy with your notes.

Browser exercise · Based on the Autopsy 4.22.1 screenshots. Search example records and save a harmless text file. This uses browser sample data; no real disk image is opened and no Autopsy module runs.

Step 1 of 4Create your case

Select New Case. Name it SUSA-AUT-032 and use C:\Labs\Cases as the base directory.

1. 1Create case
2. 2Add source
3. 3Find file
4. 4Hand over

Show hint

Start with New Case.

SUSA-AUT-032 · WS-07Find: Aster-review.txt

Full Lab

Self hosted / real disk image examination

Autopsy Full Lab

Windows VM + training image

Case SUSA-AUT-033 / missing project file

Find the missing file and explain what happened.

The Aster team cannot find its review note. You have permission to examine a training disk image. Use Autopsy to find the note, check its Recycle Bin record and save a copy for the next analyst. Your job is to report what the records show, including what they leave unanswered.

Tick each box after saving its files or notes. This page saves your ticks, but cannot check Autopsy or your workstation.

Case brief

Your taskFind Aster-review.txt, recover its readable contents and check the recorded removal time.

What you will use

One small NTFS training VHD, two ingest modules and a separate case folder. No malware or whole disk carving is needed.

In this case: the original is kept separately and examination is approved. Use the actual image source, permissions and handling procedure in a real investigation. A Recycle Bin record alone does not identify who deleted a file.

Before you start

You need: a disposable Windows 11 x64 analysis VM, Windows PowerShell 5.1 and Autopsy installed from the official download. Follow Install and open first. Use a separate NTFS disk on E: for the image, working copy, case, index, exports and notes. For the small image below, allow 10 GiB free on E:; larger images need more space. Confirm E: is your intended evidence storage disk.

Training image: use an instructor provided, detached, single file NTFS VHD at E:\TrainingImages\Autopsy-Aster.vhd. It should contain readable Aster-review.txt contents in the Recycle Bin, a matching removal record, and review-log.txt mentioning that filename. Keep its source notes and supplied VHD file checksum. Use the optional setup below if you do not have this image.

How to follow: allow about 30 to 45 minutes after setup. Open one step at a time and check its Look for result. You will finish with an extracted text file, a Recycle Bin table and a short handover. Timeline and HTML reporting are optional follow up activities.

No training image? Make a small one on this disposable VM

This makes practice material, not an acquired workstation image. Use only a new virtual disk created for this exercise.

1. In Explorer, create E:\TrainingImages. Check that Autopsy-Aster.vhd does not already exist.
2. Open Disk Management as administrator. Choose Action > Create VHD: path E:\TrainingImages\Autopsy-Aster.vhd, size 1 GB, format VHD, Fixed size.
3. Identify the new 1 GB virtual disk by its size and VHD path. Initialise only that new disk as GPT, then create an NTFS volume named AUTOPSY-TRAINING with a free letter such as T:. Do not initialise or format an existing disk. If you cannot identify the new disk, stop and use an instructor's image.
4. On that new volume, create T:\Users\Alex\Documents\Aster. In Notepad, save Aster-review.txt there with the following text. Check that Windows has not added a second .txt extension.

ASTER PROJECT - Aster-review.txt
Access review still pending.
Check the project approval log before drawing conclusions.

1. In the same folder, save review-log.txt with this text:

Training review log
The team expected Aster-review.txt in the project folder.
This line is a reference to the filename, not the missing file itself.

1. Before deleting the note, open Windows PowerShell and save its hash outside the VHD. Change T: only if your new training volume uses another letter. This block only reads the note and saves a new CSV.

$autSeed = 'T:\Users\Alex\Documents\Aster\Aster-review.txt'
$autSeedRecord = 'E:\TrainingImages\Aster-review-seed-sha256.csv'
if (Test-Path -LiteralPath $autSeedRecord) { throw 'Keep the earlier seed record. Use a new filename for this run.' }
Get-FileHash -Algorithm SHA256 -LiteralPath $autSeed -ErrorAction Stop |
    Export-Csv -LiteralPath $autSeedRecord -NoTypeInformation

1. Close Notepad. In Recycle Bin Properties, select the new training volume and confirm normal deletion moves files to the Recycle Bin. In Explorer, select only Aster-review.txt and press Delete, not Shift+Delete. Confirm it appears in the Recycle Bin with its original T: path. Do not empty the bin or restore the file. If Windows offers permanent deletion, cancel and fix the training volume settings first.
2. Close windows using T:. In Disk Management, right click the new virtual disk's left hand label and choose Detach VHD, leaving any delete image option unticked. Confirm T: disappears and the VHD stays on E:.

Record that you made the image, its NTFS volume name, sector size (512 bytes), workstation time zone and approximate deletion time. Alex is a folder name in this fixture; it does not establish the deleting account. The recorded original path will use your actual drive letter, unlike the browser example's C: path.

What do image, ingest and hash mean?

A disk image holds copied disk contents. A working copy is the copy you examine. Ingest means Autopsy runs selected modules to read files and build results. A SHA-256 hash is a fingerprint calculated from file contents.

The commands here hash the whole single VHD file. A matching copy hash checks that copy, not the quality of an acquisition. For E01 segments or multi file VMDKs, check the complete image set with the appropriate verification method. Adding an optional hash in Autopsy's source wizard stores that value; it does not run a verification check by itself.

Activity 1: Prepare the case

First resultA checked working copy and an Autopsy case ready to search.

1. Make a checked copy in a new case folder

Keep the training VHD detached. Open Windows PowerShell 5.1. Change $autOriginal if your instructor supplied a different location. This creates a new case folder and refuses to overwrite an earlier one.

$autCase = 'E:\SUSA-AUT-033'
$autOriginal = 'E:\TrainingImages\Autopsy-Aster.vhd'
if ($PSVersionTable.PSVersion.ToString() -notlike '5.1.*') { throw 'Open Windows PowerShell 5.1.' }
$autImage = Get-Item -LiteralPath $autOriginal -ErrorAction Stop
if ($autImage.PSIsContainer -or $autImage.Extension -ne '.vhd' -or $autImage.Length -eq 0) { throw 'Use the detached, single-file training VHD.' }
$autStorage = Get-Volume -DriveLetter E -ErrorAction Stop
if ($env:SystemDrive -eq 'E:' -or $autStorage.FileSystem -ne 'NTFS') { throw 'Use the intended separate NTFS disk on E:.' }
if ($autStorage.SizeRemaining -lt ($autImage.Length + 5GB)) { throw 'Allow room for the copy, case, index and exports.' }
if (Test-Path -LiteralPath $autCase) { throw 'Case folder already exists. Keep it and choose a new folder.' }
New-Item -ItemType Directory -Path "$autCase\working", "$autCase\cases", "$autCase\exports\files", "$autCase\exports\tables", "$autCase\notes" -ErrorAction Stop | Out-Null
$autWorking = "$autCase\working\Autopsy-Aster.vhd"
$autSourceHash = Get-FileHash -Algorithm SHA256 -LiteralPath $autOriginal -ErrorAction Stop
Copy-Item -LiteralPath $autOriginal -Destination $autWorking -ErrorAction Stop
$autCopyHash = Get-FileHash -Algorithm SHA256 -LiteralPath $autWorking -ErrorAction Stop
@($autSourceHash, $autCopyHash) | Export-Csv -LiteralPath "$autCase\notes\before-sha256.csv" -NoTypeInformation
if ($autSourceHash.Hash -ne $autCopyHash.Hash) { throw 'Copy hash differs. Keep the failed check and stop.' }
@(
    'Case: SUSA-AUT-033; permission: this training image only'
    "Examiner: $env:USERNAME; computer: $env:COMPUTERNAME"
    "UTC: $((Get-Date).ToUniversalTime().ToString('o')); workstation time zone: $((Get-TimeZone).Id)"
    "Original: $autOriginal; bytes: $($autImage.Length); format: single VHD"
    "Working copy: $autWorking"
    'Task: find Aster-review.txt contents and its Recycle Bin removal record'
) | Set-Content -LiteralPath "$autCase\notes\case-context.txt"
@($autSourceHash, $autCopyHash) | Format-Table Path, Hash -AutoSize

Look for: matching hashes and the new case folders. Compare the original hash with any supplier's VHD file checksum too. Add the image source, permission, creation/acquisition details and checksum result to notes\case-context.txt. If you made the VHD, describe it as a self created fixture.

2. Create the Autopsy case and add the copy

1. Open Autopsy and record its version from Help > About. Choose New Case, name SUSA-AUT-033, base directory E:\SUSA-AUT-033\cases, Single User. Add your examiner name and finish.
2. In Add Data Source, generate a host name from the image name or specify a training host. Record the actual host. Select Disk Image or VM File, then browse to E:\SUSA-AUT-033\working\Autopsy-Aster.vhd.
3. Use the source time zone documented for your image and Auto Detect sector size. The self created NTFS image uses UTC stored file times; keep its workstation time zone in your notes. Source interpretation and display time zone are separate settings.
4. In Configure Ingest, select Recent Activity and Keyword Search. In Keyword Search settings, enable Add text to Solr Index so you can search later. Deselect extra modules for this small exercise; leave the ingest scope covering the whole source. If your build asks for an ingest profile, choose its custom setup.
5. Add the source. Wait for the source to finish adding and the ingest modules to finish. Save the selected modules, settings, start/end times and any errors in your notes. Recent Activity provides the Recycle Bin results; Keyword Search indexes text for the search.
6. Open the tree's view settings gear, or Tools > Options > Views, and set displayed times to UTC. Record the setting and take a screenshot of the source tree and completed ingest status.

Look for: the intended NTFS source under the recorded host, completed modules and no unexplained errors. The source wizard's optional hash fields are not a replacement for the copy check above. If ingest fails, keep its errors and resolve the source or module setup before searching.

The image will not open, or ingest is still running

Check the path, free case/index space and that you chose the complete VHD working copy. Do not mount it writable or run repair tools to force a result. A large image takes longer; check ingest status rather than starting another run. If a module failed, save its messages and rerun only after fixing the cause.

Ready to search I saved the source notes and matching original/working-copy hashes. I recorded the version, host, case path, time settings and completed ingest settings/errors.Pause point: close Autopsy and keep the whole case folder plus its working image. Reopen the existing case to continue; do not rerun the new case block.

Next: follow the filename and read the matching records.

Continue to the search ›

Activity 2: Find the file

Next resultThe note's contents and a matching record of its move to the Recycle Bin.

1. Search the filename and read what matched

Open Keyword Search, enter Aster-review.txt, choose Substring Match and restrict the search to this training source. Run the search. Record the term, match type, source, result count and paths of the useful results.

Select each useful row and open Text. The review log mentions the filename; that does not make it the missing note. Find the result containing the actual note text. It may be named $R…txt under $Recycle.Bin because Windows renamed it when moving it there. In File Metadata, record its full source path, size, file record and allocation flags, plus any relevant timestamps with their labels. Allocated means the file still has space assigned to it; a file in the bin can remain allocated.

Look for: readable note contents that differ from the log's filename reference. Counts can vary between Autopsy builds and images; do not aim for the browser lab's fixed count.

No keyword results?

Confirm ingest finished and Add text to Solr Index was enabled. Try Aster with Substring Match and check the selected source. You can also browse the source's $Recycle.Bin folders and read the $R text files. A content file named $R…txt need not contain the original filename unless the fixture text includes it. Save any indexing failure or missing file result rather than guessing.

2. Match the Recycle Bin record to the contents

Open Data Artifacts > Recycle Bin. Find the row whose original path ends in Users\Alex\Documents\Aster\Aster-review.txt. Read the path, Time Deleted, size and account information available in your build. Record the source metadata path, usually a $I… file in the same Recycle Bin folder.

Match that $I record to the $R content file using the same identifier after $I and $R, the same folder and the size. Save a screenshot of the row and a short note linking the two source paths. Use actual names, times and drive letters. If the username is blank or unknown, keep it unknown.

Look for: a record that links the readable contents to the original filename and a removal time. Moving a file to the Recycle Bin can leave its contents allocated and readable. Deleted Files may also show entries reconstructed by Recent Activity; seeing the same record in another view is not independent evidence. A modification timestamp is not the removal timestamp, and these records do not prove who performed the deletion.

No matching Recycle Bin row?

Check Recent Activity's completion and errors, the source scope and whether the image actually contains the expected $I/$R pair. For your own fixture, the Delete action must have moved the file into that volume's bin before detaching it. Preserve this image and your negative result; make a fresh fixture if setup was wrong. Do not edit the working image or invent a removal time.

File and record matched I saved the search settings and distinguished the note contents from a filename reference. I linked the content and Recycle Bin paths, saved the labelled time and recorded what remains unknown.Pause point: keep your screenshots and notes. Reopen the same case and source to export the matched file.

Next: export the note and give the next analyst a useful record.

Continue to handover ›

Activity 3: Export and hand over

Final resultThe recovered text, a saved results table and a short explanation another analyst can follow.

1. Save the file and table, then hash the exports

Right click the matched content file, not its $I metadata record, and select Extract File(s). Save it under E:\SUSA-AUT-033\exports\files, keeping Autopsy's exported filename. Record the original filename, source path and actual export path together. Open the harmless exported .txt in Notepad and check the contents against Autopsy's Text view.

Return to the Recycle Bin table. Choose Save Table as CSV and save E:\SUSA-AUT-033\exports\tables\recycle-bin.csv. Check its rows against the view. This exports the displayed table, so record which table, source and filters it represents. In a real case, limit exported material to the approved scope.

Run this block to save hashes of the two exports. It requires exactly one extracted text file so you cannot accidentally hash an unrelated export. For your own fixture, keep the saved seed CSV path. For an instructor image, use its matching seed CSV or set $autSeedRecord = '' if none was supplied.

$autCase = 'E:\SUSA-AUT-033' # Use your actual case path if you changed it.
$autSeedRecord = 'E:\TrainingImages\Aster-review-seed-sha256.csv' # Set to '' if no matching seed CSV was supplied.
$autFiles = @(Get-ChildItem -LiteralPath "$autCase\exports\files" -File -Recurse -Filter '*.txt' -ErrorAction Stop)
if ($autFiles.Count -ne 1 -or $autFiles[0].Length -eq 0) { throw 'Expected one nonempty extracted training text file.' }
$autTable = Get-Item -LiteralPath "$autCase\exports\tables\recycle-bin.csv" -ErrorAction Stop
if ($autTable.PSIsContainer -or $autTable.Length -eq 0) { throw 'Save and check the Recycle Bin CSV first.' }
$autExportHash = Get-FileHash -Algorithm SHA256 -LiteralPath $autFiles[0].FullName -ErrorAction Stop
$autTableHash = Get-FileHash -Algorithm SHA256 -LiteralPath $autTable.FullName -ErrorAction Stop
@($autExportHash, $autTableHash) | Export-Csv -LiteralPath "$autCase\notes\export-sha256.csv" -NoTypeInformation
if ($autSeedRecord) {
    $autSeedRows = @(Import-Csv -LiteralPath $autSeedRecord -ErrorAction Stop)
    if ($autSeedRows.Count -ne 1 -or $autSeedRows[0].Algorithm -ne 'SHA256' -or $autSeedRows[0].Hash -notmatch '^[A-Fa-f0-9]{64}$') { throw 'Invalid saved seed hash. Keep the record and investigate.' }
    $autSeedMatch = $autExportHash.Hash -eq $autSeedRows[0].Hash
    "Recovered text matches saved seed: $autSeedMatch" | Set-Content -LiteralPath "$autCase\notes\seed-comparison.txt"
    if (-not $autSeedMatch) { throw 'Recovered text differs from the saved seed. Keep both hashes and investigate.' }
}
@($autExportHash, $autTableHash) | Format-Table Path, Hash -AutoSize

Look for: the readable note, checked CSV and notes\export-sha256.csv. If you made the fixture, seed-comparison.txt should say True. For an instructor image, compare the recovered file hash with its supplied file checksum if available. Record when no comparison was possible. An export hash by itself fingerprints the output; it does not prove a source/export match.

2. Write the handover and check the image after closing

Create notes\handover.txt. Fill in these prompts using your saved observations:

Case SUSA-AUT-033
Image: [supplier or self-created fixture; original/working paths; size; hash checks]
Setup: [Autopsy version; case; host; modules; indexing; time zones; errors]
Search: [term; match type; selected source; result count]
File: [content path; original name/path; size; flags; what the text says]
Removal record: [$I path; linked $R path; Time Deleted and display zone]
Exports: [actual file and CSV paths; SHA-256 values; any seed/source comparison]
Finding: [what the contents and removal record support]
Still unknown: [account attribution, intent or any missing/failed checks]
Next step: [the specific record you would check next and why]

A useful finding describes the readable review note and the record of its move to the Recycle Bin. The pending access review is a lead, not proof of theft. Checking the project approval log and relevant account activity is a reasonable next step. If a file or record is absent, report that plainly; a missing result is valid even though that checkpoint cannot be ticked.

Close the case and exit Autopsy. Run this check using the same original and working paths from Activity 1. It reads the saved hashes, so it also works after a pause.

$autCase = 'E:\SUSA-AUT-033'
$autOriginal = 'E:\TrainingImages\Autopsy-Aster.vhd'
$autWorking = "$autCase\working\Autopsy-Aster.vhd"
$autBefore = @(Import-Csv -LiteralPath "$autCase\notes\before-sha256.csv" -ErrorAction Stop)
$autSavedCopy = @($autBefore | Where-Object { $_.Path -eq $autWorking })
$autSavedSource = @($autBefore | Where-Object { $_.Path -eq $autOriginal })
if ($autSavedCopy.Count -ne 1 -or $autSavedSource.Count -ne 1) { throw 'Cannot identify the saved starting hashes.' }
$autAfterCopy = Get-FileHash -Algorithm SHA256 -LiteralPath $autWorking -ErrorAction Stop
$autAfterSource = Get-FileHash -Algorithm SHA256 -LiteralPath $autOriginal -ErrorAction Stop
@($autAfterCopy, $autAfterSource) | Export-Csv -LiteralPath "$autCase\notes\after-sha256.csv" -NoTypeInformation
if ($autAfterCopy.Hash -ne $autSavedCopy[0].Hash -or $autAfterSource.Hash -ne $autSavedSource[0].Hash) {
    throw 'An image changed. Keep the copies and checks; investigate before handing over.'
}
"UTC final check: $((Get-Date).ToUniversalTime().ToString('o'))" | Set-Content -LiteralPath "$autCase\notes\final-check-time.txt"
@($autAfterCopy, $autAfterSource) | Format-Table Path, Hash -AutoSize

Look for: unchanged original and working image hashes and a handover that states what was found, what is unknown and what to check next. Keep failed checks too; a tick should not hide an error.

Ready to hand over I saved and checked the recovered text and table, their paths and export hashes. I saved the handover, closed Autopsy and confirmed the original and working image hashes stayed unchanged.Keep the complete Autopsy case and its working image, not just the exported file.

Next: review the saved case before restoring the VM.

Review the case files ›

Check your case files

Files to keep0 of 6 evidence checkpoints marked.

• 1Starting recordSource notes, original/copy hashes, Autopsy version, case and host, time settings and ingest record.
• 2File and removal recordSearch notes, file and Recycle Bin paths, labelled removal time, screenshots and anything still unknown.
• 3Exports and handoverRecovered text, Recycle Bin CSV, export hashes, final image checks and your handover note.

Before restoring the VM: keep the original, working image and complete case folder on storage that survives the restore.

Optional: show the sequence or make an HTML report

For time context, open Timeline, select this source and a narrow range around the recorded removal time. Record the event type, range, filters and UTC display setting. Compare modification and Recycle Bin events without treating them as the same timestamp.

For a report, tag the relevant file and record, then choose Generate Report, select HTML and include only the useful tagged results. Keep the generated report folder and review it before sharing. Add its location to your handover; a generated report does not replace your explanation or source records.

Finish: keep the case before restoring Windows

Check the saved case

Reopen the retained case and confirm that you can read its image, exports and notes before restoring the clean snapshot.

Autopsy links to the image at its source path. Keep that image available at the recorded path, or use the tool's relocation workflow. Reset progress clears this page's ticks; it does not delete your files.

You recovered readable Recycle Bin contents. Overwritten data may be unrecoverable, and these records do not identify the person who deleted the file.

Continue with Create and analyse for the screenshot walkthrough, or Understanding Disk Image & Recovery to compare recovery methods.

PreviousCreate and analyseReviewReturn to Autopsy overview