Proving websites were visited help?

Autopsy Help
1

Hi,

I’ve been trying to learn autopsy but have really been struggling. I’ve set myself a goal where I want to prove that a user has visited websites he shouldn’t have.

So I’ve made a Windows Virtual machine, and I’ve gotten the .vdi file of that machine. I’ve also converted it to a raw Img file so I can open it inside autopsy aswell. However I’ve been coming up short on what do do next.

Any help would be greatly appreciated.

2

You’re going to want to run the Recent Activity ingest module to get results about web pages visited/bookmarked/etc.

https://sleuthkit.org/autopsy/docs/user-docs/4.14.0/recent_activity_page.html

Check out the quick start guide for general information about analyzing an image with Autopsy:
https://sleuthkit.org/autopsy/docs/user-docs/4.14.0/quick_start_guide.html