> For the complete documentation index, see [llms.txt](https://cas-cyber.gitbook.io/cas-cybersecurity/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cas-cyber.gitbook.io/cas-cybersecurity/forensic-exercises/disk-forensics.md).

# Disk Forensics

### Exercises

* [The Sleuth Kit Intro](/cas-cybersecurity/forensic-exercises/disk-forensics/the-sleuth-kit-intro.md)
* [Filecarving with foremost](/cas-cybersecurity/forensic-exercises/disk-forensics/filecarving-with-foremost.md)
* [Filecarving with scalpel](/cas-cybersecurity/forensic-exercises/disk-forensics/filecarving-with-scalpel.md)
* [Bulk extractor](/cas-cybersecurity/forensic-exercises/disk-forensics/bulk-extractor.md)
* [Disk acquisition with dd](/cas-cybersecurity/forensic-exercises/disk-forensics/disk-acquisition-with-dd.md)
* [Disk acquisition with dcfldd](/cas-cybersecurity/forensic-exercises/disk-forensics/disk-acquisition-with-dcfldd.md)
* [Disk acqusition with ewftools](/cas-cybersecurity/forensic-exercises/disk-forensics/disk-acquisition-with-ewftools.md)
* [Mount disk image (raw)](/cas-cybersecurity/forensic-exercises/disk-forensics/mount-disk-image-raw.md)
* [Unknown USB Stick](/cas-cybersecurity/forensic-exercises/disk-forensics/unknown-usb-stick.md)
* [USB Stick Filecarving](/cas-cybersecurity/forensic-exercises/disk-forensics/usb-stick-filecarving.md)
* [Autopsy Exercise](/cas-cybersecurity/forensic-exercises/disk-forensics/autopsy-exercise.md)