Forensic Suites: ProDiscover, and Hands-On with Autopsy
Where you are: Part V — Forensics in Practice: Scenarios, Software and Business Cases · Lesson 5.4 · This lesson follows Chapter 10 of Dr. Al-Doori's IT Forensics Essentials: ProDiscover software.
Ethical scope: the hands-on part of this lesson uses only your own practice image from Lesson 2.6, or NIST's public, fictional "Hacking Case" practice data. Only examine devices, accounts and systems you own or are explicitly authorized to work with.
What you'll be able to do
By the end of this lesson you will be able to explain what a complete forensic suite does, and open a practice case in one.
- Describe the features of a forensic suite, using the book's example, ProDiscover.
- Explain how those features support integrity, analysis and reporting in real use cases.
- Create a case in Autopsy, add a data source and explore the results.
What a Forensic Suite Does
Chapter 10 presents ProDiscover, a comprehensive forensic software tool for acquiring, analyzing and presenting digital evidence in legal and investigative work, including e-discovery. It is a good model of what any full forensic suite offers. The book describes six groups of features.
- Evidence acquisition. Acquiring data from hard drives, USB devices, memory cards and mobile devices; supporting both logical and physical acquisition, so that raw data such as deleted files and unallocated space is captured; and creating exact bit-for-bit images.
- Write protection. Built-in write-blocking features, so that nothing is accidentally modified and the chain of custody is protected. Lesson 4.2 covered what software write protection can and cannot guarantee.
- Data analysis. File preview, file system analysis and file carving to recover deleted or damaged files; analysis of documents, images, emails and videos and their metadata; and integrated email analysis.
- Search and filtering. Keyword and regular expression (regex) searches, which match patterns such as card numbers or email addresses, plus filters by file type and creation or modification date.
- Reporting and visualization. Detailed, customizable reports of metadata, recovered files and search results, formatted to legal standards, and visual tools that help non-technical people such as juries and lawyers understand complex findings.
- Integrity, decryption and platforms. Hash values (MD5 and SHA-1) generated at acquisition to prove evidence has not changed; help with decryption and password recovery where legally permitted; support for Windows, Mac, Linux and mobile file systems; and detailed evidence-handling logs that keep the chain of custody traceable.
Where Suites Are Used
The book lists five uses: corporate investigations (breaches, insider threats, IP theft), law enforcement (cybercrime, hacking, fraud and exploitation cases), e-discovery in legal cases, presenting evidence clearly to non-technical audiences, and incident response (tracing malware, ransomware and breaches). It highlights four benefits: data integrity, ease of use, comprehensive functionality and support for legal compliance.
From ProDiscover to Autopsy
For hands-on practice, this course uses Autopsy, a free, open-source forensic platform developed by Sleuth Kit Labs. It offers most of the same feature groups:
| Feature group (book) | In Autopsy |
|---|---|
| Acquisition and images | Adds disk images (raw and E01) and other data sources to a case |
| Integrity | Data Source Integrity module checks the image against its recorded hash |
| Carving and recovery | Shows deleted files; PhotoRec Carver module carves unallocated space |
| Hash filtering | Hash Lookup module, including known-file sets such as NIST's NSRL |
| Search and filtering | Keyword Search module, including regular expressions; file-type and extension-mismatch modules |
| Email and web | Email Parser and Recent Activity modules |
| Timelines | Built-in Timeline viewer |
| Reporting | Generates reports of tagged items and results |
Try It: Open a Practice Case in Autopsy (Optional)
You need a computer you own, Autopsy from its official website (Windows has an installer; Linux and macOS need extra setup), and either your USB image from Lesson 2.6 or one of the image files of NIST's CFReDS Hacking Case, a fictional abandoned laptop prepared for training.
- Create a case. Start Autopsy and choose New Case. Give it a name and, on the next screen, a case number and your name as examiner. Autopsy keeps everything for the case in its own folder.
- Add a data source. Choose Disk Image or VM File and select your image.
- Choose ingest modules. Ingest modules are the automatic analyses Autopsy runs on the data. For a first look, keep the defaults, which include file-type identification, hash lookup, recent activity and keyword search.
- Explore. As results arrive, look at the tree on the left: Data Sources (the file system), File Views (files by type, and deleted files), and Data Artifacts and Analysis Results (web history, installed programs, keyword hits). Open the Timeline to see activity over time.
- Tag and report. Tag two or three items that interest you, then use Generate Report to produce a simple report.
If you are using the Hacking Case, try to answer two of NIST's own questions: What operating system was used on the computer? and What is the computer account name? (It concerns the computer itself, so keep it apart from user account names and from the registered owner.) You will return to this case in Capstone A.
Reading-only alternative. If you cannot run Autopsy, study the table above and watch the video in this lesson.
Real-World Example
Imagine (a fictional scenario) a corporate investigator handling a suspected insider theft at an engineering firm. In a forensic suite she adds the laptop image and runs ingest modules. Hash filtering removes 180,000 known operating-system files from view. A regex search for the format of the firm's part numbers finds hits in a deleted spreadsheet in unallocated space, which the carving module recovers. The timeline shows the spreadsheet was created an hour before a USB device was connected. She tags each item, and the report lists them with their paths, hashes and timestamps for the legal team. Each feature group from the book did one job, and the suite tied them together.
From the Book to 2026
What the book teaches. ProDiscover is a comprehensive, user-friendly suite with acquisition, write protection, analysis, search, reporting and MD5/SHA-1 integrity checking.
Why it made sense. It is a clear example of the full feature set a forensic suite needs, and that feature set has not changed.
What has changed. Two notes. ProDiscover is still offered, but this course could not confirm its current publisher, editions or licensing from an official source. Check the vendor's current offering before relying on any version. Free, open-source options such as Autopsy have matured and are widely used for training and casework. And as Lesson 2.1 explained, SHA-256 has joined MD5 and SHA-1 as the expected integrity hash.
What to do now. Learn the feature groups, not one product. Whichever suite you use, record its name and version, validate it against known data, and use SHA-256 where the tool supports it.
Watch: Starting a New Case in Autopsy
This DFIRScience video, from a channel run by a digital forensics academic, demonstrates starting a new digital forensic investigation case in Autopsy version 4.19 and later.
Questions to keep in mind as you watch:
- What information is entered when a case is created, and why does it matter for documentation?
- Which ingest modules are selected, and what does each contribute?
- How do the results map onto the feature groups from the book's ProDiscover chapter?
The video complements what you just read. The lesson is complete without it.
What Would You Do?
Your manager wants to buy an expensive commercial suite "because courts trust it", and to stop using Autopsy. What questions would you ask before agreeing or disagreeing? Decide, then compare with the model answer in the note below.
Knowledge Check
Which feature lets an examiner find every credit card number on a drive without knowing the numbers in advance?
Why does a forensic suite generate hash values at acquisition?
Which Autopsy module removes thousands of known operating-system files from view?
Answers explained
- Question 1: a. A regular expression matches a pattern, such as 16 digits in groups of four, so it finds numbers you do not know in advance.
- Question 2: a. Acquisition hashes prove integrity over time. They do not identify anyone (c).
- Question 3: c. Hash Lookup with known-file sets filters out recognized software files, the "exclude the known-good" use from Lesson 2.1.
On "What Would You Do?": Ask what problem the purchase solves. Does it support evidence types Autopsy does not handle well, such as particular phones or cloud sources? Can it process large cases faster? What training and support come with it? Has it been tested, for example in NIST's tool-testing program, and do we validate it ourselves? Courts look at whether a method is reliable and properly applied, not at the price of the tool. Many labs use several tools and cross-check results.
Key Takeaways
- A forensic suite combines acquisition, write protection, analysis (including carving and email), search (keyword and regex), reporting and integrity checking.
- Suites serve corporate, law enforcement, e-discovery, presentation and incident response work.
- Autopsy is a free, open-source suite with the same feature groups: images, hash lookup, carving, keyword search, timelines and reports.
- Learn the feature groups, record tool versions, validate your tools, and use SHA-256.
Sources
- Dr. Tahseen Al-Doori — IT Forensics Essentials: Concepts, Tools, and the Practice of Digital Investigation, Chapter 10
- Autopsy — Sleuth Kit Labs
- Autopsy — Download
- Autopsy User Documentation (ingest modules, Timeline, reports)
- NIST CFReDS archive — Hacking Case
- NIST — National Software Reference Library (NSRL)
- NIST — Computer Forensics Tool Testing Program (CFTT)