Running Autopsy Forensic VM Plugin

To efficiently use the Autopsy ForensicVM plugin, it’s essential to initialize a new case within the Autopsy framework and then seamlessly integrate a new data source. Below, the comprehensive procedure is outlined:

  1. Add a New Case to Autopsy

    Initiate the Autopsy application and from the wizard interface, choose the option to add a new case. This is the first step in creating a structured environment for your forensic analysis.

    Add a New Case to Autopsy

    Fig. 31 Add a New Case to Autopsy

  2. Fill in Case Name in Case Information

    Once the case addition window pops up, provide a unique and descriptive name for your case. This helps in distinguishing it from other cases in the future.

    Fill in Case Name in Case Information

    Fig. 32 Fill in Case Name in Case Information

  3. Fill Optional Information

    Here, you can include additional details about the case. While this is optional, it’s recommended to fill in as much information as possible for thorough documentation.

    Fill Optional Information

    Fig. 33 Fill Optional Information

  4. Choose Host Options

    Decide on the host configuration for this case. You can either: - Generate a new host using the data source parameters. - Specify a new host name manually. - Or, utilize an existing host from a previous case or configuration.

    Choose Host Options

    Fig. 34 Choose Host Options

  5. Select Data Source Type as “Disk Image or VM File”

    Choose the type of data source you’re incorporating. For this procedure, select “term:Disk Image or VM File”, which allows Autopsy to process VM images and disk snapshots.

    Select Data Source Type

    Fig. 35 Select Data Source Type

  6. Browse and Choose Your Forensic Image

    Navigate through your file system and pick the appropriate forensic image or VM file. Ensure that the chosen file is compatible and accessible.

    Choose Your Forensic Image

    Fig. 36 Choose Your Forensic Image

  7. Select Extra Parameters Like Time Zone and Sector Size

    Fine-tune your forensic analysis by selecting the relevant time zone and determining the sector size. These parameters help in accurate data extraction and interpretation.

    Select Extra Parameters

    Fig. 37 Select Extra Parameters

  8. Configure the Python Ingest Plugin to Run and Select the ForensicVM Client Plugin

    Activate the Python Ingest Plugin for automated data ingestion. Also, ensure to select the ForensicVM Client plugin, which is pivotal for the VM forensic analysis.

    Configure the Python Ingest Plugin

    Fig. 38 Configure the :term:Python`` Ingest Plugin

  9. Monitor the Data Source Processing Progress

    As the data gets processed, an intuitive progress bar displays the ongoing activities and the completion percentage. Keep an eye on this to gauge the processing speed and potential completion time.

    Data Source Processing Progress

    Fig. 39 Data Source Processing Progress

  10. Await the ForensicVM Loader**’s Initialization**

The ForensicVM Loader will make a brief appearance. This indicates that the plugin is gearing up for execution. It will automatically close once the plugin is fully initialized.

ForensicVM Loader Initialization

Fig. 40 ForensicVM Loader Initialization

  1. Complete the Procedure and Minimize Autopsy Window

Click on the “Finish” button to round off the ‘Add Data Source’ wizard. For better visibility and multitasking, it’s advisable to minimize the main Autopsy window at this juncture.

Finish Data Source Wizard

Fig. 41 Finish Data Source Wizard

  1. Engage with the Autopsy ForensicVM Client Plugin Interface

Post the previous steps, the dedicated window for the Autopsy ForensicVM Client plugin will emerge. Here, you can conduct in-depth VM forensics using the myriad features offered by the plugin.

ForensicVM Client Plugin Interface

Fig. 42 ForensicVM Client Plugin Interface