Autopsy: open a case you can still explain

What the case is holding

Autopsy is the desktop examiner in front of The Sleuth Kit. You give it a disk image, or a folder of logical files you were allowed to take, and it builds a case database of file-system metadata, file content, and the results of the ingest modules you choose. The image stays the evidence. The database is your working copy of what the tool parsed, and it is allowed to grow. The image is not a scratch disk.

Northline’s counsel already authorized case NL-2026-041 and handed you NL-FIN-14.E01, a laptop image made that afternoon. Your job in the first hour is to make a case a second examiner can reopen in six months and understand: which file you added, which hash you checked, which clock you used for display, and which modules you ran. Curiosity about the payroll file can wait until that record exists.

Add the image you were given

A forensic image is a file that claims to be a byte-for-byte copy of a disk or volume, plus metadata from the imager. E01 is a common wrapper. A raw image is the bytes alone, and the hash has to live in your notes because the file itself may not carry it. Either way, you record the hash the imager printed, then let the case compute a hash of the data source and compare the two. A mismatch stops the exam. You find out whether you received the wrong file, a truncated copy, or a damaged archive before you build a theory on it.

Prefer the image over the original laptop. Opening the live disk from the examiner’s machine can change access times and unallocated space. If the only copy is the laptop, that is a decision you write down and make with a write blocker, under the same authorization. In this lab the E01 is already on the bench, so the data source type is a disk image and the path is the file you hashed.

• Case number, examiner name, and the date you opened it.
• Image filename, imager tool, and the hash algorithm plus the value you were given.
• Whether verification matched, and where you stored the verification output.
• The host name and the user the request is about, so later tags stay attached to NL-FIN-14 and NORTHLINE\avery.

Pick the timezone on purpose

NTFS stores its timestamps in UTC. Autopsy converts them for display with the timezone on the case or the data source. The bytes do not move when you change the zone. The wall-clock times in every screenshot and CSV do. NL-FIN-14 lived in the Brooklyn office, so the zone that matches the people in the report is America/New_York. A lab laptop left on UTC will show the payroll file five hours off in April, and every comparison with a Sysmon export in Eastern time will look like two different mornings.

Write the zone into the case notes in a sentence: “Display times are America/New_York because the laptop was used in Brooklyn. The image hashes were checked before ingest.” If you later quote a time to counsel, quote the zone with it. A bare “13:05” is incomplete the moment two tools disagree.

Run ingest you can name

Ingest modules walk the image and fill the database. File type identification, hash lookup, extension mismatch, keyword search, recent activity, and interesting-file rules are the usual first pass on a Windows laptop. Each module is a choice. Recent activity is what makes browser history and downloads show up as events. Hash lookup only helps if you actually point it at a set. Keyword lists that contain half the English language bury the payroll filename in noise.

Start with the modules that answer the question you were asked. Here the question is whether Avery’s account staged Payroll-April.xlsx and what else landed on disk around that time. File type identification, hash lookup with a known-file set and any lab known-bad set you were given, recent activity, and a keyword list that contains the workbook name and the lab host drop.lab.example are enough to begin. You can add a carver later, on a second ingest, and you will record that you did. An exam that runs every module and remembers none of them is a long case, and it is a weak one.

Worked case: the Brooklyn image on a UTC bench

The imager sheet says NL-FIN-14.E01, SHA-256 7c1a…e4, acquired 15 April 2026 at 14:10 America/New_York. You copy the image to the lab volume, compute the hash, and it matches. You create case NL-2026-041, set the timezone to America/New_York, and add the E01 as a disk image. Ingest is file type, hash lookup against the National Software Reference Library (NSRL) set for that Windows build plus the two-hash lab set counsel provided, recent activity, and a four-word keyword list: Payroll-April, p4.xlsx, drop.lab.example, 203.0.113.44.

Twenty minutes later the case has a file tree and a small set of keyword hits. You have not opened the workbook. You have a record that the image is the one Northline sent, that times on screen are Brooklyn times, and that the next lesson can build a timeline without guessing which clock you used.