# Proving websites were visited help?

**URL:** <https://sleuthkit.discourse.group/t/proving-websites-were-visited-help/536>\
**Category:** Autopsy Help\
**Created:** [March 5, 2020, 2:01pm UTC](https://sleuthkit.discourse.group/t/proving-websites-were-visited-help/536 "2020-03-05T14:01:10Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rhysnot](https://avatars.discourse-cdn.com/v4/letter/r/c2a13f/32.png) [@Rhysnot](https://sleuthkit.discourse.group/u/Rhysnot)\
**Post date:** [March 5, 2020, 2:01pm UTC](https://sleuthkit.discourse.group/t/proving-websites-were-visited-help/536/1 "2020-03-05T14:01:10Z")

</div>

Hi,

I’ve been trying to learn autopsy but have really been struggling. I’ve set myself a goal where I want to prove that a user has visited websites he shouldn’t have.

So I’ve made a Windows Virtual machine, and I’ve gotten the .vdi file of that machine. I’ve also converted it to a raw Img file so I can open it inside autopsy aswell. However I’ve been coming up short on what do do next.

Any help would be greatly appreciated.

---

<div class="post-metadata">

**Author:** ![apriestman](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/apriestman/32/24_2.png) [@apriestman](https://sleuthkit.discourse.group/u/apriestman)\
**Post date:** [March 5, 2020, 2:05pm UTC](https://sleuthkit.discourse.group/t/proving-websites-were-visited-help/536/2 "2020-03-05T14:05:29Z")

</div>

You’re going to want to run the Recent Activity ingest module to get results about web pages visited/bookmarked/etc.

[https://sleuthkit.org/autopsy/docs/user-docs/4.14.0/recent\_activity\_page.html](https://sleuthkit.org/autopsy/docs/user-docs/4.14.0/recent_activity_page.html)

Check out the quick start guide for general information about analyzing an image with Autopsy:  
[https://sleuthkit.org/autopsy/docs/user-docs/4.14.0/quick\_start\_guide.html](https://sleuthkit.org/autopsy/docs/user-docs/4.14.0/quick_start_guide.html)