Undeleting files from NTFS with Autopsy

Originally,Autopsy was just a graphical interface for The Sleuth Kit. You have already learnt about the collection of command-line tools for file system forensic analysis in the previous recipe. Since the third version however, it has been totally rewritten and is now available as a standalone digital forensics platform. It is very widely used and forms part of the digital forensic toolkit of both law enforcement and corporate examiners. Why? It's easy to use, fast, and free. Also, if you enjoy programming, you can write your own modules for Autopsy - all the documentation you will need is freely available online, on The Sleuth Kit's website. Basis Technology even holds Autopsy module writing contests, so feel free to participate.

Getting...