Monday, 15 June 2015

Installation of Autopsy third party modules

Autopsy Forensic Browser is a graphical interface to the The Sleuth Kit and other digital investigation tools. Using both of them, you can analyze Windows and LINUX disks and file systems (NTFS, FAT, UFS1/2, Ext2/3, etc.). I was going through all the features of Autopsy on my desktop to gain first-hand experience.

A number of Autopsy modules are available here - http://wiki.sleuthkit.org/index.php?title=Autopsy_3rd_Party_Modules

For my reference, the procedure for installation of Autopsy module is given below:
  • Navigate to the latest .nbm module file - e.g. https://github.com/williballenthin/Autopsy-WindowsRegistryIngestModule/tree/master/precompiled
  • Click on the .nbm file so that the View Raw text appears.
  • Right-click on the View Raw text and select Save Link As... to save the raw .nbm file.
  • Start Autopsy and close the Welcome screen.
  • From the menu, select Tools | Plugins.
  • Open Downloaded tab and click the Add Plugins button.
  • From the Add Plugins window, navigate to the downloaded .nbm module file and open it.
  • Click Install and follow the wizard.

2 comments: