Forensics & Analysis

Write protection lets you read but not write a medium, so no timestamps are made and the evidence is not contaminated. If you genuinely cannot write-block, fall back to a normal connection — but document exactly what was done, ideally with witnesses or even on film. Store data securely (who has access? is the room logged?) and have a defined way to exchange images with partners and authorities.

Autopsy is a forensic framework built on The Sleuth Kit (TSK) from the Linux world, now used worldwide. It loads image files — commonly E01 (EnCase) and DD (raw) — and can carve data, extract web cache and visited sites, read registry hives, hash and compare against known files, and much more.

Ingest modules are Autopsy's built-in automation — they look for specific data such as databases, GPS data, carved (deleted) files and search history. Several are pre-installed; more can be downloaded from the community modules repo and Python plugins dropped into the autopsy python_module folder.