Autopsy: tags, notes, and a report a second reader can use

Tag the exhibit, then write why

A tag is a label on a file or a result inside the case. Use a small set. For this exam, “payroll-copies,” “activity-rows,” and “needs-other-tool” are enough. Tag the two workbook paths, the link file, and the powershell.exe hash-match note if the tool lets you tag that result. A tag without a comment becomes a color. The comment should hold the one-line reason: “same SHA-256 as the Documents workbook” or “Edge download store has no row in the window.”

Notes belong on the item and in the case log. The item note travels with the file when you generate a report. The case log holds decisions: timezone, hash verification, ingest list, and the window you cared about. Future you, and the other examiner, will trust the log over a memory of which filter was on. Write the decision when you make it. A log written at the end is a reconstruction.

Separate the artifact from the conclusion

Counsel and the SOC will ask what happened. You answer in layers. The first layer is the exhibit: path, hash, time, source, timezone. The second layer is what that exhibit can support: two paths share content, a browser store does not contain the download, a known-file hash identifies powershell.exe. The third layer is what it cannot support yet: who was at the keyboard, whether the Temp file left the network, whether a remote host received it. Leaving the third layer explicit is part of the report. A reader who cannot see the gap will fill it in.

If Sysmon or memory later supplies a process and a destination, you add them as their own exhibits and you say they came from those sources. Autopsy does not become wrong because a log is richer. The disk report stays the disk report. Cross-references are sentences, with the other tool named.

Export what you tagged

Generate the report from the tags, and also export a CSV of the timeline rows you cited, so a reader without Autopsy can see the times. Include the case number, the image hash, the timezone, and the ingest modules on the first page or in the cover note you attach. Screenshots help when the point is a layout, and they are weak when the point is a hash. Prefer the text export for anything you expect someone to search.

Extracted files that leave the case get a manifest: original path, extract path, SHA-256, and the reason. YARA and CyberChef work in this course is aimed at those extracts and at blobs already in the notes. The manifest is how you prove the extract is the file you think it is. Store the report and the manifest with the case number in the filename so NL-2026-041 is obvious without opening the file.

• Cover: case number, image name, verified hash, timezone, module list.
• Body: each tagged item with path, hash, times, source, and the one-line comment.
• Gaps: the questions the disk did not answer.
• Manifest: anything copied out for another tool.

Read it once as a stranger

Open the report the way counsel will. Can you find the two hashes? Can you tell which time is $FILE_NAME and which is a download record? Can you see that the Edge store was checked? If a sentence uses “the attacker” or “stolen” and the exhibits only show a copy into Temp, rewrite the sentence until it matches the exhibits. The tool will happily export a confident paragraph you typed over a thin tag. The second read is the control.

Then stop adding modules for their own sake. Another carver, another keyword, another browser profile you already listed as absent: each one is justified by a question still open, or it waits. Record the stop. An exam that ends with a list of open questions is finished. An exam that ends with a mood is not.

Worked case: a two-page note counsel can use

You tag the Documents workbook, the Temp copy, the Recent link, and the carved candidate. Comments say the two named files share a SHA-256, the link file is 09:16 America/New_York, and the carved file is a different hash at a recorded offset. The cover note lists the verified image hash, America/New_York, and the four ingest choices. A short gap section says the disk does not show a browser download of p4.xlsx and does not show the destination host.

You export the tagged HTML report, a CSV of the three timeline rows, and a manifest for the Temp file because YARA practice and a hash comparison may want a copy. The case log’s last line is the window 09:12–09:18 and the next sources to read: the Sysmon export and the memory image, both already in the lab. You leave Avery’s intent unwritten. You do not have it.