Extracting files, and or recovery of critical forensic information is key within the process of computer forensics. Out in the wild there are a plethora of tools that a forensic examiner may choose to utilize in order to do so. Although this does not directly relate to recovery of files from a forensic stand point, it can also be utilized for users who have lost data and want to try their hand at recovery of information. The focus of this document will be around Autopsy and how to use the free tool in order to recover said files.
Although stated in a previous writeup concerning computer forensics, it can be quite an expensive endeavor. Some of the things that you may come across whereby an expense is needed you may be able to get away with utilizing, Linux. When we discussed the need for write-blockers, it was said that you needed to purchase an expensive write-blocker that would allow you to make a disk image with ease of mind. However, you don't really need to do this. This article will explain how you can utilize Linux in order to pull a disk image and then feed it into ProDiscover and of course, bypass the need for a write blocker. This document will also detail how you can recover files that were deleted for a forensic investigation.