> For the complete documentation index, see [llms.txt](https://www.iblue.team/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.iblue.team/ctf-challenges/compromised-windows-server-2022-simulation/autopsy-forensics.md).

# Autopsy Forensics

## Setup case file and process E01

Download, install, and run Autopsy.

New Case > Enter case information > Next > (complete optional information) > Finish

<figure><img src="/files/Vs0SH0ELrQmM05IEqAkK" alt=""><figcaption></figcaption></figure>

This results in a new Autopsy case being created in the location you specific. Now we need to add our data source/E01 image file.

Add Data Source > Disk Image or VM File > Next

<div align="left"><figure><img src="/files/9d2Bswi2eZp5PYstfPC0" alt=""><figcaption></figcaption></figure></div>

<div align="left"><figure><img src="/files/nX9U8OqLTq6DVQMKGe7d" alt=""><figcaption></figcaption></figure></div>

This is where our previous examination of the SYSTEM hive is important - the timezone defaults to GMT -8 but the image is of a system whose timezone offset is GMT/UTC. Change this to GMT+0/UTC.

De-select irrelevant modules and it should look like this

<div align="left"><figure><img src="/files/LfpVJoyxhXVZ9w7w6FRn" alt=""><figcaption></figcaption></figure></div>

We'll look at installing additional ingest modules shortly.

Click Next and wait for Autopsy to ingest the E01.

## Generate timeline