# Autopsy Exercise
### 1. Introduction
> Jens Vogel works for a technology company as a research manager in a highly sensitive laboratory work area. During the routine security check at the exit of the company area, the security staff discovers that Mr. Vogel is carrying a private a private USB flash drive in his briefcase.\
> In a conversation with his managers, Mr. Vogel. becomes entangled in contradictions. There is therefore a suspicion that he has tried to steal internal company information or that he has at least been careless with confidential data.
In this scenario, find inculpatory and exculpatory circumstantial evidence in connection with attempted or even completed data theft. For this purpose, we provide you with data carrier images of the workstation PC and the discovered USB stick.
### 2. Analysis Workstation
Start autopsy, create a new case and load the first image file
Select disk image or VM file
Select data source (Worksation image)
Load all modules (Will be more time consuming)
On the left side we can see a lot of interessting artifacts:
The email artifacts are very interessting. We can see that Jens Vogel had a e-mail conversation with a `spy`
If we follow the conversation we can see that Jens Vogel did share files over GDrive with `spy`
He was also instructed to copy even more data. Jens wants to stop it. Spy gave Jens Vogel a warning that he should be careful, because USB Devices can be easyli detected
Jens Vogel tries and got caught!
Let's check another interessting artifact:
I could identify two USB Sticks:
Let's check the Downloads folder:
We can see that Jens Vogel did download gdrive and icloud sync software
Search history reveals that Jens Vogel was searching for `anti forensics` and `how to delete data`
Autopsy has a artifact collector for web searches:
Recent documents reveals also interessting informations:
Here we can see that he was working on several files named with secret fom network, local and removable media paths. We also could find a resignation letter.
We can also see this with the shellbags artifact:
Notice: We can see alot of interessting filenames that contains the wording `secret`
### 3. Timeline explorer
Autopsy brings a module timelineexplorer. From here I'll set a filter with the keyword `secret`
Let's check details:
### 4. Analysis USB Stick
There are a lot of pictures which are probably classified as secret:
More pictures:
Some files are tagged with `[secret project]`
