From storage media to user activity

Host & Storage Analysis

Recover, examine, and correlate persistent evidence from disks, file systems, Windows artefacts, browsers, the Registry, and event logs.

Find my pathStart the foundations

Artefactsplaced in context

6analysis routes44practical tools1supported timeline

01

Move from image to finding

Select each stage to follow a repeatable host-analysis workflow.

01PreserveProtect the source 02OrientUnderstand the host 03ExtractCollect useful records 04InterpretRespect artefact meaning 05CorrelateSupport the finding

Stage 1Preserve the working basis

Work from a verified image or controlled copy, retain the original evidence, and record the tools and time settings used.

Ask: Can I return to the same starting point?

02

Find your analysis path

Choose the evidence question that most closely matches your starting point.

I have an image or damaged media I need system activity I need user or account activity

Best matchStart with disk image and recovery

Mount or examine an image safely, then identify recoverable files and useful volumes.

Image-first routeDisk Image & RecoveryMount, inspect, carve, and recover files while protecting the source.Level Beginner to intermediate Evidence Image or mediaOutcome Create a controlled examination view and recover relevant data. System activity routeWindows & File-System ArtefactsInterpret persistent operating-system and NTFS records.Level Intermediate Evidence Windows volumeOutcome Reconstruct supported file and system activity. User activity routeBrowser, Registry & Event LogsConnect browsing, configuration, identity, and logged activity.Level Beginner to intermediate Evidence Profiles and logsOutcome Build a contextual account or user-activity picture.

03

Build your foundation

Open the concept guide that matches the evidence you are examining.

1

Media and imagesUnderstanding Disk Image & Recovery

Examine images and recover data without changing the source.

2

Operating-system evidenceUnderstanding Windows Artefacts

Interpret records created by Windows and user activity.

3

NTFS structuresUnderstanding File-System Analysis

Use metadata and journals to reconstruct file activity.

4

Web activityUnderstanding Browser Forensics

Connect history, downloads, cookies, and cached content.

5

Windows configurationUnderstanding the Registry

Interpret keys and values in their user and system context.

6

Recorded eventsUnderstanding Event Logs

Filter, validate, and correlate Windows event records.

04

Choose a tool by evidence

Begin with one focused tool and record the version, inputs, settings, and outputs.

IMGDisk imagesBroad examination and recovery WINWindows artefactsParse common host records NTFSFile-system recordsMetadata, journals, and indexes EVTXEvent logsFilter and detect activity

Best starting point for broad image examinationAutopsy

Examine a disk image through an integrated case workflow and review multiple artefact types.

Also consider Arsenal Image Mounter for presenting an image as a disk or PhotoRec for focused file recovery.

Explore Autopsy

05

Check analysis readiness

Confirm that your working basis and interpretation context are recorded.

!

Preparation required5 checks remaining.

I am working from a verified image or controlled copy.I recorded the system time zone and relevant time range.I know which user profiles and volumes are relevant.I will record tool versions, settings, errors, and exported results.I will corroborate important findings with an independent source.