Hard Disk Image Forensics and Analysis with Autopsy | TryHackMe | Computer Forensics

Video Description

🚀 Cyber Security Certification Notes https://shop.motasem-notes.net/collections/cyber-security-study-notes 🚀OR Certification Notes with Cheat Sheets https://buymeacoffee.com/notescatalog/extras 💡Cyber Security Notes | Membership Access https://buymeacoffee.com/notescatalog/membership 🔥Download FREE Cyber Security 101 Study Notes https://buymeacoffee.com/notescatalog/e/290985 *** In this video walkthrough, we covered Disk analysis and forensics using Autopsy. We extracted forensic artifacts about the operating system and uses. #forensics #autopsy ***** Receive Cyber Security Field, Certifications Notes and Special Training Videos https://www.youtube.com/channel/UCNSdU_1ehXtGclimTVckHmQ/join ****** Writeup https://motasem-notes.net/hard-disk-image-forensics-and-analysis-with-autopsy-tryhackme-computer-forensics/ TryHackMe Disk Analysis & Autopsy https://tryhackme.com/room/autopsy2ze0 **** Store https://buymeacoffee.com/notescatalog/extras Patreon https://www.patreon.com/motasemhamdan Instagram https://www.instagram.com/motasem.hamdan.official/ Google Profile https://maps.app.goo.gl/eLotQQb7Dm6aiL8z6 LinkedIn [1]: https://www.linkedin.com/in/motasem-hamdan-7673289b/ [2]: https://www.linkedin.com/in/motasem-eldad-ha-bb42481b2/ Instagram https://www.instagram.com/mastermindstudynotes/ Twitter https://twitter.com/ManMotasem Facebook https://www.facebook.com/motasemhamdantty/ ****** 0:00 - Introduction to Disk Analysis and Autopsy Room 0:12 - Announcement of TyphonCon CTF Event 2:11 - Starting Disk Analysis in TryHackMe 3:14 - Extracting the MD5 of the Disk Image 4:29 - Importance of MD5 for Forensic Integrity 5:15 - Finding the Computer Account Name 7:58 - Listing User Accounts in Alphabetical Order 9:07 - Determining the Number of User Accounts 11:38 - Identifying the Last User to Log In 12:44 - Finding the IP Address of the Computer 14:26 - Finding the MAC Address of the Computer 16:18 - Naming the Network Cards on the Computer 18:24 - Identifying the Network Monitoring Tool 20:28 - Retrieving Coordinates from a Google Maps Bookmark 23:04 - Finding the User's Full Name on the Desktop Wallpaper 26:13 - Recovering the First Flag Changed by PowerShell 27:40 - Investigating PowerShell Commands on the System 30:25 - Message to the Device Owner from Privilege Escalation Exploit 32:16 - Identifying Two Hack Tools Found on the System 35:25 - Inspecting a Yara File for Author Information 41:57 - Identifying an Archive with MSNRPC Exploit 47:12 - Conclusion and Final Thoughts on Disk Analysis