---
title: "Forensic Artifact Analysis Using Autopsy: File System Reconstruction and Timeline Carving"
date: 2026-01-26
canonical: "https://codeandcypher.com/papers/csol590-examine-the-evidence-using-autopsy/"
author: "Joshua A. Wortz"
institution: "University of San Diego"

report_type: "Academic Research Paper / CSOL590"
doi: "10.5281/zenodo.22287669"
pdf_url: "https://codeandcypher.com/papers/csol590-examine-the-evidence-using-autopsy.pdf"
description: "Forensic artifact investigation using Autopsy, examining file system timestamps, deleted inode carving, and keyword index analysis."
---

# Forensic Artifact Analysis Using Autopsy: File System Reconstruction and Timeline Carving

**Author:** Joshua A. Wortz, MSCOL, CISSP ([ORCID: 0009-0003-6722-1019](https://orcid.org/0009-0003-6722-1019))  
**Institution:** University of San Diego  
**Publication Date:** January 26, 2026  
**DOI:** [10.5281/zenodo.22287669](https://doi.org/10.5281/zenodo.22287669)  
**PDF Download:** [Full Research Paper PDF](https://codeandcypher.com/papers/csol590-examine-the-evidence-using-autopsy.pdf)  

---

## Abstract

Academic research analysis exploring examine the evidence using autopsy within the context of Cyber Incident Response and Computer Network Forensics.

---

## Research Paper Body

1. Open Autopsy
Figure 1
Autopsy has opened.
2. Create new case
Figure 2
A new case was created.

3. Add evidence
Figure 3
Evidence was added through the USB drive image from last assignment.
4. Select Ingest Options
Figure 4
Options were selected.

5. Review results
Figure 5
Home Screen View.
6. Find the deleted file
Figure 6
The deleted syllabus file was located.

7. Note dates and hash value
Figure 7
Dates and hash from the deleted file.
8. Add in original image
Figure 8
Added Original Image

9. Find the original file
Figure 9
Original File location
10.Are the dates the same?
Yes, the dates are the same.
11.Are the hash values the same?
No, the hashes are different
12.Can you tell when the file was deleted?
The file was deleted at 16:27 {ST

### References
Wortz, J. (2026). Various Images [Digital]. Personal PC, Oceanside, CA.


---

> **Archival Artifact:** The complete, formatted research publication can be accessed directly as a PDF at [https://codeandcypher.com/papers/csol590-examine-the-evidence-using-autopsy.pdf](https://codeandcypher.com/papers/csol590-examine-the-evidence-using-autopsy.pdf).


---

## Citation (APA 7th Edition)
Wortz, J. A. (2026). *Forensic Artifact Analysis Using Autopsy: File System Reconstruction and Timeline Carving*. Code and Cypher. https://doi.org/10.5281/zenodo.22287669