Digital Forensics Lab: Recovering a JPEG from a Deleted Partition in Autopsy

In this digital forensics lab, we walk through how to recover a JPEG image from a deleted partition using Autopsy. This project focuses on loading a forensic image, configuring ingest modules, performing keyword searches, locating target evidence, tagging relevant artifacts for follow-up, extracting files, and generating an investigative report.

You’ll also see how metadata collection, examiner documentation, and reporting play an important role in a real digital forensics workflow. This is a strong hands-on exercise for students learning partition recovery, file identification, evidence handling, and Autopsy-based forensic analysis. The lab includes work with keyword hits, tagged files, extracted artifacts, and final reporting to support a structured forensic examination.

Disclaimer:
This video is for educational purposes only. This lab is based on material from Guide to Computer Forensics and Investigations, 7th Edition — Cengage. The material is used here for instructional and academic discussion. All credit for the original source material belongs to the respective author(s) and publisher. This video is intended only to support authorized learning in digital forensics and cybersecurity education.

Видео Digital Forensics Lab: Recovering a JPEG from a Deleted Partition in Autopsy канала Practical Academy