# Does Autopsy or TSK do this?

**URL:** <https://sleuthkit.discourse.group/t/does-autopsy-or-tsk-do-this/2618>\
**Category:** Autopsy Help\
**Created:** [May 1, 2021, 11:55pm UTC](https://sleuthkit.discourse.group/t/does-autopsy-or-tsk-do-this/2618 "2021-05-01T23:55:11Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ForensicGrey](https://avatars.discourse-cdn.com/v4/letter/f/3be4f8/32.png) [@ForensicGrey](https://sleuthkit.discourse.group/u/ForensicGrey)\
**Post date:** [May 1, 2021, 11:55pm UTC](https://sleuthkit.discourse.group/t/does-autopsy-or-tsk-do-this/2618/1 "2021-05-01T23:55:11Z")

</div>

Hi everyone,

Im pretty sure the answer is no, but can anyone confirm, does autopsy or TSK inform a practitioner about possible secure deletion having occurred on a filesystem by flagging known wipe patterns? Im convinced there is no functionality/ingest for this that I can find?

---

<div class="post-metadata">

**Author:** ![Mark\_McKinnon](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/mark_mckinnon/32/42_2.png) [@Mark\_McKinnon](https://sleuthkit.discourse.group/u/Mark_McKinnon)\
**Post date:** [May 3, 2021, 1:59am UTC](https://sleuthkit.discourse.group/t/does-autopsy-or-tsk-do-this/2618/2 "2021-05-03T01:59:12Z")

</div>

No there is not. Does this question have anything to do with the DF Challenge 2021 201-Shredder test? If it does and you figure something out you can always create a plugin to alert an examiner to this.

---

<div class="post-metadata">

**Author:** ![ForensicGrey](https://avatars.discourse-cdn.com/v4/letter/f/3be4f8/32.png) [@ForensicGrey](https://sleuthkit.discourse.group/u/ForensicGrey)\
**Post date:** [May 3, 2021, 7:08pm UTC](https://sleuthkit.discourse.group/t/does-autopsy-or-tsk-do-this/2618/3 "2021-05-03T19:08:07Z")

</div>

Thanks for confirming. Its not actually, but I would certainly be interested to know more about the challenge. It actually concerns a recent paper published which evaluates TSK’s performance in a range of anti forensic scenarios:-

Can computer forensic tools be trusted in digital investigations? in Science and Justice.  
[https://www.sciencedirect.com/science/article/pii/S1355030620303002?dgcid=rss\_sd\_all#:~:text=Investigators%20cannot%20absolutely%20rely%20on,data%20hiding%2C%20and%20forging%20timestamps.](https://www.sciencedirect.com/science/article/pii/S1355030620303002?dgcid=rss_sd_all#:~:text=Investigators%20cannot%20absolutely%20rely%20on,data%20hiding%2C%20and%20forging%20timestamps.)

The article implies that the practitioner should expect that TSK should detect wipe patterns?.. but if it doesnt have this functionality?!

---

<div class="post-metadata">

**Author:** ![Mark\_McKinnon](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/mark_mckinnon/32/42_2.png) [@Mark\_McKinnon](https://sleuthkit.discourse.group/u/Mark_McKinnon)\
**Post date:** [May 3, 2021, 8:41pm UTC](https://sleuthkit.discourse.group/t/does-autopsy-or-tsk-do-this/2618/4 "2021-05-03T20:41:39Z")

</div>

I understand what you are saying. I am not sure why the authors would think that TSK should detect wipe patterns. TSK’s main purpose is to access the on-disk structures and present them to the examiner for them to analyze with or without a tool. Detecting wipe patterns falls under analysis not on presentation of On-disk structures.