CSE4004: Digital Forensics

Keyword Search - USB Drive

& Disk
Name: Aditya Singh
Reg. no:18BCE0595

Autopsy is an open-source digital forensics tool developed by Basis Technology, first released
in 2000. It is a free to use and quite efficient tool for hard drive investigation with features like
multi-user cases, timeline analysis, registry analysis, keyword search, email analysis, media
playback, EXIF analysis, malicious file detection and much more.It’s a tool that uses the
forensic platform and graphical interfaces like Sleuth Kit and other more forensic tools. We
will use the Keyword Search Tool for this assignment.

System Information:

Operating System: Windows 10

System Manufacturer: Acer
System Type: x64 based PC

Software Used:

Autopsy 4.17.0

The disk image used for the keyword search is downloaded from the following site:
http://dftt.sourceforge.net/test11/index.html
 A. Disk Image Capture
Disk Imaging is the process of copying a hard drive as a backup copy or an archive. The process
entails copying all the data stored on the source drive including data like the master boot record and
table allocation information. This image, however, is a single file that can be stored in any storage
device and not necessarily an identical hard drive. In the event that a restoration is necessary, the
image will have to be applied to the hard drive. Unlike the cloned drive, system restore is not
possible by just copying the image file on the hard drive. A software imaging program will have to
be employed to install and open the image on the hard drive. The backup device can therefore be
used to store multiple image files, unlike the cloned drive where only a single clone can be stored on
the duplicate drive.
1. Open Capture Tool and load Disk.
2. Capture Complete
3. Captured Image Details

File configuration

Email address
Exif metadata

Metadata
4. List of Search Results
 USB Drive
USB drives can often hold key evidence in an investigation phase. The goal is to analyze and
investigate the drive to find out if there is suspicious data and evidence relating to the blackmailing.The
starting point of the analysis was a .dd image, a bit to bit copy of the original USB drive. It’s good
practise to make an image/copy of the device for further analysis and keep the original USB drive for
evidence. Furthermore, to be sure that the image is the same copy of information a integrity check can
be done.
1. Start the application.
2. Capture Complete

3. Files obtained from the scanning:

Email address
User content suspected
Metadata

Files desciption
4. Search for a keyword using search tools.

5. List of files with the search term “PDC” in USB Drive image.