Disk Image Analysis

Autopsy

Autopsy is an open-source forensic tool used to analyze disk images as evidence.

• Download Autopsy
• Autopsy Documentation

---

🛠️ General Forensic Tools

• TRACE – Similar to Autopsy
• Foremost – Tool for recovering deleted files
• PhotoRec – File recovery tool for lost/deleted files

---

🐧 Linux Forensics

• dcfldd – Enhanced version of dd for forensic acquisition
• dc3dd – Another enhanced dd variant for disk acquisition

---

🪟 Windows Forensics

• FTK Imager – Disk and RAM acquisition tool for Windows
• Sleuth Kit – Open-source NTFS analysis tool

---

🔌 USB Forensics

USB flash drives are commonly found as evidence in digital forensic investigations. Proper procedures must be followed to ensure that evidence is preserved without alteration.

📚 Tutorials

• USB Forensics Detection Investigation – HackingArticles
• Uncovering USB Footprints: A Deep Dive into Windows Registry Forensics – Medium

🔍 Tools

• USBDetective – USB forensics tool for analyzing device connections