Disk Forensics

Exercises

• The Sleuth Kit Intro

• Filecarving with foremost

• Filecarving with scalpel

• Bulk extractor

• Disk acquisition with dd

• Disk acquisition with dcfldd

• Disk acqusition with ewftools

• Mount disk image (raw)

• Unknown USB Stick

• USB Stick Filecarving

• Autopsy Exercise